Edit tour

Linux Analysis Report
yakuza.i686.elf

Overview

General Information

Sample name:	yakuza.i686.elf
Analysis ID:	1581658
MD5:	6bdc27df8c2053f9044bb4bd108deecd
SHA1:	9e73b6b3d89ef6e0fc3cbeeeada86244d6efebd6
SHA256:	0c1a58b756dd6aa169097046eb145b32f2b5d2c4c91c919d7c5dcdf8d83ed871
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Machine Learning detection for sample

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "kill" or "pkill" command typically used to terminate processes

Reads CPU information from /sys indicative of miner or evasive malware

Reads the 'hosts' file potentially containing internal network hosts

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample contains strings indicative of password brute-forcing capabilities

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581658
Start date and time:	2024-12-28 12:46:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	yakuza.i686.elf
Detection:	MAL
Classification:	mal68.troj.linELF@0/0@3/0

Warnings

Report size exceeded maximum capacity and may have missing behavior information.
VT rate limit hit for: pirati.privatedns.org

Runtime Messages

Command:	/tmp/yakuza.i686.elf
PID:	5431
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	CAPSAICIN
Standard Error:

Process Tree

system is lnxubuntu20

yakuza.i686.elf (PID: 5431, Parent: 5357, MD5: 6bdc27df8c2053f9044bb4bd108deecd) Arguments: /tmp/yakuza.i686.elf

yakuza.i686.elf New Fork (PID: 5432, Parent: 5431)

yakuza.i686.elf New Fork (PID: 5433, Parent: 5432)

yakuza.i686.elf New Fork (PID: 5434, Parent: 5432)

yakuza.i686.elf New Fork (PID: 5435, Parent: 5432)

sh (PID: 5435, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 902i13 || busybox pkill -9 902i13"

sh New Fork (PID: 5437, Parent: 5435)

pkill (PID: 5437, Parent: 5435, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 902i13

sh New Fork (PID: 5467, Parent: 5435)

busybox (PID: 5467, Parent: 5435, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 902i13

yakuza.i686.elf New Fork (PID: 5468, Parent: 5432)

sh (PID: 5468, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 BzSxLxBxeY || busybox pkill -9 BzSxLxBxeY"

sh New Fork (PID: 5469, Parent: 5468)

pkill (PID: 5469, Parent: 5468, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 BzSxLxBxeY

sh New Fork (PID: 5470, Parent: 5468)

busybox (PID: 5470, Parent: 5468, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 BzSxLxBxeY

yakuza.i686.elf New Fork (PID: 5473, Parent: 5432)

sh (PID: 5473, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 HOHO-LUGO7 || busybox pkill -9 HOHO-LUGO7"

sh New Fork (PID: 5474, Parent: 5473)

pkill (PID: 5474, Parent: 5473, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 HOHO-LUGO7

sh New Fork (PID: 5475, Parent: 5473)

busybox (PID: 5475, Parent: 5473, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 HOHO-LUGO7

yakuza.i686.elf New Fork (PID: 5476, Parent: 5432)

sh (PID: 5476, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 HOHO-U79OL || busybox pkill -9 HOHO-U79OL"

sh New Fork (PID: 5477, Parent: 5476)

pkill (PID: 5477, Parent: 5476, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 HOHO-U79OL

sh New Fork (PID: 5478, Parent: 5476)

busybox (PID: 5478, Parent: 5476, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 HOHO-U79OL

yakuza.i686.elf New Fork (PID: 5479, Parent: 5432)

sh (PID: 5479, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 JuYfouyf87 || busybox pkill -9 JuYfouyf87"

sh New Fork (PID: 5480, Parent: 5479)

pkill (PID: 5480, Parent: 5479, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 JuYfouyf87

sh New Fork (PID: 5483, Parent: 5479)

busybox (PID: 5483, Parent: 5479, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 JuYfouyf87

yakuza.i686.elf New Fork (PID: 5484, Parent: 5432)

sh (PID: 5484, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"

sh New Fork (PID: 5485, Parent: 5484)

pkill (PID: 5485, Parent: 5484, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeR69xd

sh New Fork (PID: 5492, Parent: 5484)

busybox (PID: 5492, Parent: 5484, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeR69xd

yakuza.i686.elf New Fork (PID: 5493, Parent: 5432)

sh (PID: 5493, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SO190Ij1X || busybox pkill -9 SO190Ij1X"

sh New Fork (PID: 5494, Parent: 5493)

pkill (PID: 5494, Parent: 5493, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SO190Ij1X

sh New Fork (PID: 5495, Parent: 5493)

busybox (PID: 5495, Parent: 5493, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SO190Ij1X

yakuza.i686.elf New Fork (PID: 5498, Parent: 5432)

sh (PID: 5498, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 LOLKIKEEEDDE || busybox pkill -9 LOLKIKEEEDDE"

sh New Fork (PID: 5499, Parent: 5498)

pkill (PID: 5499, Parent: 5498, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 LOLKIKEEEDDE

sh New Fork (PID: 5500, Parent: 5498)

busybox (PID: 5500, Parent: 5498, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 LOLKIKEEEDDE

yakuza.i686.elf New Fork (PID: 5501, Parent: 5432)

sh (PID: 5501, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ekjheory98e || busybox pkill -9 ekjheory98e"

sh New Fork (PID: 5502, Parent: 5501)

pkill (PID: 5502, Parent: 5501, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ekjheory98e

sh New Fork (PID: 5503, Parent: 5501)

busybox (PID: 5503, Parent: 5501, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ekjheory98e

yakuza.i686.elf New Fork (PID: 5526, Parent: 5432)

sh (PID: 5526, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scansh4 || busybox pkill -9 scansh4"

sh New Fork (PID: 5527, Parent: 5526)

pkill (PID: 5527, Parent: 5526, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scansh4

sh New Fork (PID: 5528, Parent: 5526)

busybox (PID: 5528, Parent: 5526, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scansh4

yakuza.i686.elf New Fork (PID: 5529, Parent: 5432)

sh (PID: 5529, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MDMA || busybox pkill -9 MDMA"

sh New Fork (PID: 5530, Parent: 5529)

pkill (PID: 5530, Parent: 5529, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MDMA

sh New Fork (PID: 5531, Parent: 5529)

busybox (PID: 5531, Parent: 5529, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MDMA

yakuza.i686.elf New Fork (PID: 5534, Parent: 5432)

sh (PID: 5534, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 fdevalvex || busybox pkill -9 fdevalvex"

sh New Fork (PID: 5535, Parent: 5534)

pkill (PID: 5535, Parent: 5534, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 fdevalvex

sh New Fork (PID: 5537, Parent: 5534)

busybox (PID: 5537, Parent: 5534, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 fdevalvex

yakuza.i686.elf New Fork (PID: 5538, Parent: 5432)

sh (PID: 5538, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scanspc || busybox pkill -9 scanspc"

sh New Fork (PID: 5539, Parent: 5538)

pkill (PID: 5539, Parent: 5538, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scanspc

sh New Fork (PID: 5540, Parent: 5538)

busybox (PID: 5540, Parent: 5538, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scanspc

yakuza.i686.elf New Fork (PID: 5541, Parent: 5432)

sh (PID: 5541, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MELTEDNINJAREALZ || busybox pkill -9 MELTEDNINJAREALZ"

sh New Fork (PID: 5542, Parent: 5541)

pkill (PID: 5542, Parent: 5541, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MELTEDNINJAREALZ

sh New Fork (PID: 5545, Parent: 5541)

busybox (PID: 5545, Parent: 5541, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MELTEDNINJAREALZ

yakuza.i686.elf New Fork (PID: 5546, Parent: 5432)

sh (PID: 5546, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 flexsonskids || busybox pkill -9 flexsonskids"

sh New Fork (PID: 5547, Parent: 5546)

pkill (PID: 5547, Parent: 5546, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 flexsonskids

sh New Fork (PID: 5548, Parent: 5546)

busybox (PID: 5548, Parent: 5546, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 flexsonskids

yakuza.i686.elf New Fork (PID: 5549, Parent: 5432)

sh (PID: 5549, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scanx86 || busybox pkill -9 scanx86"

sh New Fork (PID: 5550, Parent: 5549)

pkill (PID: 5550, Parent: 5549, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scanx86

sh New Fork (PID: 5551, Parent: 5549)

busybox (PID: 5551, Parent: 5549, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scanx86

yakuza.i686.elf New Fork (PID: 5554, Parent: 5432)

sh (PID: 5554, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MISAKI-U79OL || busybox pkill -9 MISAKI-U79OL"

sh New Fork (PID: 5555, Parent: 5554)

pkill (PID: 5555, Parent: 5554, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MISAKI-U79OL

sh New Fork (PID: 5556, Parent: 5554)

busybox (PID: 5556, Parent: 5554, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MISAKI-U79OL

yakuza.i686.elf New Fork (PID: 5557, Parent: 5432)

sh (PID: 5557, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 foAxi102kxe || busybox pkill -9 foAxi102kxe"

sh New Fork (PID: 5558, Parent: 5557)

pkill (PID: 5558, Parent: 5557, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 foAxi102kxe

sh New Fork (PID: 5559, Parent: 5557)

busybox (PID: 5559, Parent: 5557, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 foAxi102kxe

yakuza.i686.elf New Fork (PID: 5560, Parent: 5432)

sh (PID: 5560, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 swodjwodjwoj || busybox pkill -9 swodjwodjwoj"

sh New Fork (PID: 5561, Parent: 5560)

pkill (PID: 5561, Parent: 5560, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 swodjwodjwoj

sh New Fork (PID: 5564, Parent: 5560)

busybox (PID: 5564, Parent: 5560, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 swodjwodjwoj

yakuza.i686.elf New Fork (PID: 5565, Parent: 5432)

sh (PID: 5565, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MmKiy7f87l || busybox pkill -9 MmKiy7f87l"

sh New Fork (PID: 5566, Parent: 5565)

pkill (PID: 5566, Parent: 5565, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MmKiy7f87l

sh New Fork (PID: 5567, Parent: 5565)

busybox (PID: 5567, Parent: 5565, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MmKiy7f87l

yakuza.i686.elf New Fork (PID: 5568, Parent: 5432)

sh (PID: 5568, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 freecookiex86 || busybox pkill -9 freecookiex86"

sh New Fork (PID: 5569, Parent: 5568)

pkill (PID: 5569, Parent: 5568, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 freecookiex86

sh New Fork (PID: 5572, Parent: 5568)

busybox (PID: 5572, Parent: 5568, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 freecookiex86

yakuza.i686.elf New Fork (PID: 5573, Parent: 5432)

sh (PID: 5573, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 sysgpu || busybox pkill -9 sysgpu"

sh New Fork (PID: 5574, Parent: 5573)

pkill (PID: 5574, Parent: 5573, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 sysgpu

sh New Fork (PID: 5575, Parent: 5573)

busybox (PID: 5575, Parent: 5573, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 sysgpu

yakuza.i686.elf New Fork (PID: 5576, Parent: 5432)

sh (PID: 5576, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"

sh New Fork (PID: 5577, Parent: 5576)

pkill (PID: 5577, Parent: 5576, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeR69xd

sh New Fork (PID: 5578, Parent: 5576)

busybox (PID: 5578, Parent: 5576, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeR69xd

yakuza.i686.elf New Fork (PID: 5583, Parent: 5432)

sh (PID: 5583, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 frgege || busybox pkill -9 frgege"

sh New Fork (PID: 5584, Parent: 5583)

pkill (PID: 5584, Parent: 5583, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 frgege

sh New Fork (PID: 5585, Parent: 5583)

busybox (PID: 5585, Parent: 5583, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 frgege

yakuza.i686.elf New Fork (PID: 5586, Parent: 5432)

sh (PID: 5586, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 sysupdater || busybox pkill -9 sysupdater"

sh New Fork (PID: 5587, Parent: 5586)

pkill (PID: 5587, Parent: 5586, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 sysupdater

sh New Fork (PID: 5588, Parent: 5586)

busybox (PID: 5588, Parent: 5586, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 sysupdater

yakuza.i686.elf New Fork (PID: 5589, Parent: 5432)

sh (PID: 5589, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 0DnAzepd || busybox pkill -9 0DnAzepd"

sh New Fork (PID: 5590, Parent: 5589)

pkill (PID: 5590, Parent: 5589, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 0DnAzepd

sh New Fork (PID: 5594, Parent: 5589)

busybox (PID: 5594, Parent: 5589, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 0DnAzepd

yakuza.i686.elf New Fork (PID: 5595, Parent: 5432)

sh (PID: 5595, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeRD0nks69 || busybox pkill -9 NiGGeRD0nks69"

sh New Fork (PID: 5596, Parent: 5595)

pkill (PID: 5596, Parent: 5595, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeRD0nks69

sh New Fork (PID: 5597, Parent: 5595)

busybox (PID: 5597, Parent: 5595, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeRD0nks69

yakuza.i686.elf New Fork (PID: 5598, Parent: 5432)

sh (PID: 5598, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 frgreu || busybox pkill -9 frgreu"

sh New Fork (PID: 5599, Parent: 5598)

pkill (PID: 5599, Parent: 5598, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 frgreu

sh New Fork (PID: 5602, Parent: 5598)

busybox (PID: 5602, Parent: 5598, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 frgreu

yakuza.i686.elf New Fork (PID: 5603, Parent: 5432)

sh (PID: 5603, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 telnetd || busybox pkill -9 telnetd"

sh New Fork (PID: 5604, Parent: 5603)

pkill (PID: 5604, Parent: 5603, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 telnetd

sh New Fork (PID: 5605, Parent: 5603)

busybox (PID: 5605, Parent: 5603, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 telnetd

yakuza.i686.elf New Fork (PID: 5606, Parent: 5432)

sh (PID: 5606, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 0x766f6964 || busybox pkill -9 0x766f6964"

sh New Fork (PID: 5607, Parent: 5606)

pkill (PID: 5607, Parent: 5606, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 0x766f6964

sh New Fork (PID: 5608, Parent: 5606)

busybox (PID: 5608, Parent: 5606, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 0x766f6964

yakuza.i686.elf New Fork (PID: 5611, Parent: 5432)

sh (PID: 5611, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeRd0nks1337 || busybox pkill -9 NiGGeRd0nks1337"

sh New Fork (PID: 5612, Parent: 5611)

pkill (PID: 5612, Parent: 5611, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeRd0nks1337

sh New Fork (PID: 5613, Parent: 5611)

busybox (PID: 5613, Parent: 5611, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeRd0nks1337

yakuza.i686.elf New Fork (PID: 5614, Parent: 5432)

sh (PID: 5614, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 gaft || busybox pkill -9 gaft"

sh New Fork (PID: 5615, Parent: 5614)

pkill (PID: 5615, Parent: 5614, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 gaft

sh New Fork (PID: 5616, Parent: 5614)

busybox (PID: 5616, Parent: 5614, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 gaft

yakuza.i686.elf New Fork (PID: 5619, Parent: 5432)

sh (PID: 5619, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 urasgbsigboa || busybox pkill -9 urasgbsigboa"

sh New Fork (PID: 5620, Parent: 5619)

pkill (PID: 5620, Parent: 5619, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 urasgbsigboa

sh New Fork (PID: 5621, Parent: 5619)

busybox (PID: 5621, Parent: 5619, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 urasgbsigboa

yakuza.i686.elf New Fork (PID: 5622, Parent: 5432)

sh (PID: 5622, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 120i3UI49 || busybox pkill -9 120i3UI49"

sh New Fork (PID: 5623, Parent: 5622)

pkill (PID: 5623, Parent: 5622, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 120i3UI49

sh New Fork (PID: 5624, Parent: 5622)

busybox (PID: 5624, Parent: 5622, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 120i3UI49

yakuza.i686.elf New Fork (PID: 5625, Parent: 5432)

sh (PID: 5625, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 OaF3 || busybox pkill -9 OaF3"

sh New Fork (PID: 5626, Parent: 5625)

pkill (PID: 5626, Parent: 5625, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 OaF3

sh New Fork (PID: 5629, Parent: 5625)

busybox (PID: 5629, Parent: 5625, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 OaF3

yakuza.i686.elf New Fork (PID: 5630, Parent: 5432)

sh (PID: 5630, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 geae || busybox pkill -9 geae"

sh New Fork (PID: 5631, Parent: 5630)

pkill (PID: 5631, Parent: 5630, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 geae

sh New Fork (PID: 5632, Parent: 5630)

busybox (PID: 5632, Parent: 5630, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 geae

yakuza.i686.elf New Fork (PID: 5633, Parent: 5432)

sh (PID: 5633, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 vaiolmao || busybox pkill -9 vaiolmao"

sh New Fork (PID: 5634, Parent: 5633)

pkill (PID: 5634, Parent: 5633, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 vaiolmao

sh New Fork (PID: 5635, Parent: 5633)

busybox (PID: 5635, Parent: 5633, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 vaiolmao

yakuza.i686.elf New Fork (PID: 5638, Parent: 5432)

sh (PID: 5638, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 123123a || busybox pkill -9 123123a"

sh New Fork (PID: 5639, Parent: 5638)

pkill (PID: 5639, Parent: 5638, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 123123a

sh New Fork (PID: 5640, Parent: 5638)

busybox (PID: 5640, Parent: 5638, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 123123a

yakuza.i686.elf New Fork (PID: 5641, Parent: 5432)

sh (PID: 5641, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 Ofurain0n4H34D || busybox pkill -9 Ofurain0n4H34D"

sh New Fork (PID: 5642, Parent: 5641)

pkill (PID: 5642, Parent: 5641, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 Ofurain0n4H34D

sh New Fork (PID: 5643, Parent: 5641)

busybox (PID: 5643, Parent: 5641, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 Ofurain0n4H34D

yakuza.i686.elf New Fork (PID: 5646, Parent: 5432)

sh (PID: 5646, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggTrex || busybox pkill -9 ggTrex"

sh New Fork (PID: 5647, Parent: 5646)

pkill (PID: 5647, Parent: 5646, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggTrex

sh New Fork (PID: 5649, Parent: 5646)

busybox (PID: 5649, Parent: 5646, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggTrex

yakuza.i686.elf New Fork (PID: 5650, Parent: 5432)

sh (PID: 5650, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 wasads || busybox pkill -9 wasads"

sh New Fork (PID: 5651, Parent: 5650)

pkill (PID: 5651, Parent: 5650, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 wasads

sh New Fork (PID: 5652, Parent: 5650)

busybox (PID: 5652, Parent: 5650, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 wasads

yakuza.i686.elf New Fork (PID: 5653, Parent: 5432)

sh (PID: 5653, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1293194hjXD || busybox pkill -9 1293194hjXD"

sh New Fork (PID: 5654, Parent: 5653)

pkill (PID: 5654, Parent: 5653, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1293194hjXD

sh New Fork (PID: 5657, Parent: 5653)

busybox (PID: 5657, Parent: 5653, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1293194hjXD

yakuza.i686.elf New Fork (PID: 5658, Parent: 5432)

sh (PID: 5658, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 OthLaLosn || busybox pkill -9 OthLaLosn"

sh New Fork (PID: 5659, Parent: 5658)

pkill (PID: 5659, Parent: 5658, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 OthLaLosn

sh New Fork (PID: 5660, Parent: 5658)

busybox (PID: 5660, Parent: 5658, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 OthLaLosn

yakuza.i686.elf New Fork (PID: 5661, Parent: 5432)

sh (PID: 5661, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggt || busybox pkill -9 ggt"

sh New Fork (PID: 5662, Parent: 5661)

pkill (PID: 5662, Parent: 5661, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggt

sh New Fork (PID: 5665, Parent: 5661)

busybox (PID: 5665, Parent: 5661, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggt

yakuza.i686.elf New Fork (PID: 5666, Parent: 5432)

sh (PID: 5666, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 wget-log || busybox pkill -9 wget-log"

sh New Fork (PID: 5667, Parent: 5666)

pkill (PID: 5667, Parent: 5666, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 wget-log

sh New Fork (PID: 5668, Parent: 5666)

busybox (PID: 5668, Parent: 5666, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 wget-log

yakuza.i686.elf New Fork (PID: 5669, Parent: 5432)

sh (PID: 5669, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1337SoraLOADER || busybox pkill -9 1337SoraLOADER"

sh New Fork (PID: 5670, Parent: 5669)

pkill (PID: 5670, Parent: 5669, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1337SoraLOADER

sh New Fork (PID: 5671, Parent: 5669)

busybox (PID: 5671, Parent: 5669, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1337SoraLOADER

yakuza.i686.elf New Fork (PID: 5674, Parent: 5432)

sh (PID: 5674, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SAIAKINA || busybox pkill -9 SAIAKINA"

sh New Fork (PID: 5675, Parent: 5674)

pkill (PID: 5675, Parent: 5674, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SAIAKINA

sh New Fork (PID: 5676, Parent: 5674)

busybox (PID: 5676, Parent: 5674, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SAIAKINA

yakuza.i686.elf New Fork (PID: 5677, Parent: 5432)

sh (PID: 5677, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggtq || busybox pkill -9 ggtq"

sh New Fork (PID: 5678, Parent: 5677)

pkill (PID: 5678, Parent: 5677, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggtq

sh New Fork (PID: 5679, Parent: 5677)

busybox (PID: 5679, Parent: 5677, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggtq

yakuza.i686.elf New Fork (PID: 5680, Parent: 5432)

sh (PID: 5680, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1378bfp919GRB1Q2 || busybox pkill -9 1378bfp919GRB1Q2"

sh New Fork (PID: 5681, Parent: 5680)

pkill (PID: 5681, Parent: 5680, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1378bfp919GRB1Q2

sh New Fork (PID: 5684, Parent: 5680)

busybox (PID: 5684, Parent: 5680, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1378bfp919GRB1Q2

yakuza.i686.elf New Fork (PID: 5685, Parent: 5432)

sh (PID: 5685, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SAIAKUSO || busybox pkill -9 SAIAKUSO"

sh New Fork (PID: 5686, Parent: 5685)

pkill (PID: 5686, Parent: 5685, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SAIAKUSO

sh New Fork (PID: 5687, Parent: 5685)

busybox (PID: 5687, Parent: 5685, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SAIAKUSO

yakuza.i686.elf New Fork (PID: 5688, Parent: 5432)

sh (PID: 5688, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggtr || busybox pkill -9 ggtr"

sh New Fork (PID: 5689, Parent: 5688)

pkill (PID: 5689, Parent: 5688, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggtr

sh New Fork (PID: 5690, Parent: 5688)

busybox (PID: 5690, Parent: 5688, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggtr

yakuza.i686.elf New Fork (PID: 5695, Parent: 5432)

sh (PID: 5695, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 14Fa || busybox pkill -9 14Fa"

sh New Fork (PID: 5696, Parent: 5695)

pkill (PID: 5696, Parent: 5695, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 14Fa

sh New Fork (PID: 5697, Parent: 5695)

busybox (PID: 5697, Parent: 5695, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 14Fa

yakuza.i686.elf New Fork (PID: 5698, Parent: 5432)

sh (PID: 5698, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SEXSLAVE1337 || busybox pkill -9 SEXSLAVE1337"

sh New Fork (PID: 5699, Parent: 5698)

pkill (PID: 5699, Parent: 5698, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SEXSLAVE1337

sh New Fork (PID: 5700, Parent: 5698)

busybox (PID: 5700, Parent: 5698, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SEXSLAVE1337

yakuza.i686.elf New Fork (PID: 5703, Parent: 5432)

sh (PID: 5703, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggtt || busybox pkill -9 ggtt"

sh New Fork (PID: 5704, Parent: 5703)

pkill (PID: 5704, Parent: 5703, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggtt

sh New Fork (PID: 5705, Parent: 5703)

busybox (PID: 5705, Parent: 5703, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggtt

yakuza.i686.elf New Fork (PID: 5707, Parent: 5432)

sh (PID: 5707, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1902a3u912u3u4 || busybox pkill -9 1902a3u912u3u4"

sh New Fork (PID: 5708, Parent: 5707)

pkill (PID: 5708, Parent: 5707, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1902a3u912u3u4

sh New Fork (PID: 5709, Parent: 5707)

busybox (PID: 5709, Parent: 5707, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1902a3u912u3u4

yakuza.i686.elf New Fork (PID: 5710, Parent: 5432)

sh (PID: 5710, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SO190Ij1X || busybox pkill -9 SO190Ij1X"

sh New Fork (PID: 5711, Parent: 5710)

pkill (PID: 5711, Parent: 5710, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SO190Ij1X

sh New Fork (PID: 5714, Parent: 5710)

busybox (PID: 5714, Parent: 5710, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SO190Ij1X

yakuza.i686.elf New Fork (PID: 5715, Parent: 5432)

sh (PID: 5715, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 haetrghbr || busybox pkill -9 haetrghbr"

sh New Fork (PID: 5716, Parent: 5715)

pkill (PID: 5716, Parent: 5715, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 haetrghbr

sh New Fork (PID: 5717, Parent: 5715)

busybox (PID: 5717, Parent: 5715, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 haetrghbr

yakuza.i686.elf New Fork (PID: 5718, Parent: 5432)

sh (PID: 5718, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 19ju3d || busybox pkill -9 19ju3d"

sh New Fork (PID: 5719, Parent: 5718)

pkill (PID: 5719, Parent: 5718, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 19ju3d

sh New Fork (PID: 5720, Parent: 5718)

busybox (PID: 5720, Parent: 5718, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 19ju3d

yakuza.i686.elf New Fork (PID: 5723, Parent: 5432)

sh (PID: 5723, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SORAojkf120 || busybox pkill -9 SORAojkf120"

sh New Fork (PID: 5724, Parent: 5723)

pkill (PID: 5724, Parent: 5723, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SORAojkf120

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
yakuza.i686.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
yakuza.i686.elf	Linux_Trojan_Gafgyt_f51c5ac3	unknown	unknown	0x24e:$a: 74 2A 8B 45 0C 0F B6 00 84 C0 74 17 8B 45 0C 40 89 44 24 04 8B
yakuza.i686.elf	Linux_Trojan_Gafgyt_27de1106	unknown	unknown	0x28e:$a: 0C 0F B6 00 84 C0 74 18 8B 45 0C 40 8B 55 08 42 89 44 24 04 89
yakuza.i686.elf	Linux_Trojan_Gafgyt_1b2e2a3a	unknown	unknown	0x3683:$a: 83 7D 18 00 74 25 8B 45 1C 83 E0 02 85 C0 74 1B C7 44 24 04 2D 00
yakuza.i686.elf	Linux_Trojan_Tsunami_0fa3a6e9	unknown	unknown	0x1d9:$a: EC 8B 55 EC C1 FA 10 0F B7 45 EC 01 C2 89 55 EC 8B 45 EC C1 0x887:$a: EC 8B 55 EC C1 FA 10 0F B7 45 EC 01 C2 89 55 EC 8B 45 EC C1
yakuza.i686.elf	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x13255:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x138f1:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
yakuza.i686.elf	Linux_Trojan_Tsunami_6b3974b2	unknown	unknown	0x457:$a: F4 89 45 EC 8B 45 EC C9 C3 55 89 E5 57 83 EC 0C EB 1F 8B 45 08 B9 FF FF
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5434.1.0000000008048000.000000000805f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5434.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Gafgyt_f51c5ac3	unknown	unknown	0x24e:$a: 74 2A 8B 45 0C 0F B6 00 84 C0 74 17 8B 45 0C 40 89 44 24 04 8B
5434.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Gafgyt_27de1106	unknown	unknown	0x28e:$a: 0C 0F B6 00 84 C0 74 18 8B 45 0C 40 8B 55 08 42 89 44 24 04 89
5434.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Gafgyt_1b2e2a3a	unknown	unknown	0x3683:$a: 83 7D 18 00 74 25 8B 45 1C 83 E0 02 85 C0 74 1B C7 44 24 04 2D 00
5434.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Tsunami_0fa3a6e9	unknown	unknown	0x1d9:$a: EC 8B 55 EC C1 FA 10 0F B7 45 EC 01 C2 89 55 EC 8B 45 EC C1 0x887:$a: EC 8B 55 EC C1 FA 10 0F B7 45 EC 01 C2 89 55 EC 8B 45 EC C1
5434.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x13255:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x138f1:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
5434.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Tsunami_6b3974b2	unknown	unknown	0x457:$a: F4 89 45 EC 8B 45 EC C9 C3 55 89 E5 57 83 EC 0C EB 1F 8B 45 08 B9 FF FF
5431.1.0000000008048000.000000000805f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5431.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Gafgyt_f51c5ac3	unknown	unknown	0x24e:$a: 74 2A 8B 45 0C 0F B6 00 84 C0 74 17 8B 45 0C 40 89 44 24 04 8B
5431.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Gafgyt_27de1106	unknown	unknown	0x28e:$a: 0C 0F B6 00 84 C0 74 18 8B 45 0C 40 8B 55 08 42 89 44 24 04 89
5431.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Gafgyt_1b2e2a3a	unknown	unknown	0x3683:$a: 83 7D 18 00 74 25 8B 45 1C 83 E0 02 85 C0 74 1B C7 44 24 04 2D 00
5431.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Tsunami_0fa3a6e9	unknown	unknown	0x1d9:$a: EC 8B 55 EC C1 FA 10 0F B7 45 EC 01 C2 89 55 EC 8B 45 EC C1 0x887:$a: EC 8B 55 EC C1 FA 10 0F B7 45 EC 01 C2 89 55 EC 8B 45 EC C1
5431.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x13255:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x138f1:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
5431.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Tsunami_6b3974b2	unknown	unknown	0x457:$a: F4 89 45 EC 8B 45 EC C9 C3 55 89 E5 57 83 EC 0C EB 1F 8B 45 08 B9 FF FF
5433.1.0000000008048000.000000000805f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5433.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Gafgyt_f51c5ac3	unknown	unknown	0x24e:$a: 74 2A 8B 45 0C 0F B6 00 84 C0 74 17 8B 45 0C 40 89 44 24 04 8B
5433.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Gafgyt_27de1106	unknown	unknown	0x28e:$a: 0C 0F B6 00 84 C0 74 18 8B 45 0C 40 8B 55 08 42 89 44 24 04 89
5433.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Gafgyt_1b2e2a3a	unknown	unknown	0x3683:$a: 83 7D 18 00 74 25 8B 45 1C 83 E0 02 85 C0 74 1B C7 44 24 04 2D 00
5433.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Tsunami_0fa3a6e9	unknown	unknown	0x1d9:$a: EC 8B 55 EC C1 FA 10 0F B7 45 EC 01 C2 89 55 EC 8B 45 EC C1 0x887:$a: EC 8B 55 EC C1 FA 10 0F B7 45 EC 01 C2 89 55 EC 8B 45 EC C1
5433.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x13255:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x138f1:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
5433.1.0000000008048000.000000000805f000.r-x.sdmp	Linux_Trojan_Tsunami_6b3974b2	unknown	unknown	0x457:$a: F4 89 45 EC 8B 45 EC C9 C3 55 89 E5 57 83 EC 0C EB 1F 8B 45 08 B9 FF FF
Process Memory Space: yakuza.i686.elf PID: 5431	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x448e:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x45c3:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x4c30:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
Process Memory Space: yakuza.i686.elf PID: 5433	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x44ca:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x45ff:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x4c6c:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
Process Memory Space: yakuza.i686.elf PID: 5434	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x43a6:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x44db:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x4b48:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
Click to see the 19 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: yakuza.i686.elf

ReversingLabs: Detection: 60%

Machine Learning detection for sample

Source: yakuza.i686.elf

Joe Sandbox ML: detected

Source: /usr/bin/pkill (PID: 5437)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5469)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5474)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5477)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5480)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5485)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5494)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5499)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5502)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5527)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5530)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5535)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5539)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5542)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5547)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5550)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5555)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5558)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5561)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5566)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5569)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5574)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5577)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5584)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5587)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5590)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5596)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5599)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5604)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5607)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5612)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5615)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5620)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5623)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5626)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5631)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5634)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5639)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5642)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5647)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5651)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5654)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5659)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5662)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5667)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5670)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5675)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5678)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5681)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5689)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5696)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5699)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5704)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5708)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5711)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5716)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5719)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5724)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/yakuza.i686.elf (PID: 5434)

Reads hosts file: /etc/hosts

Jump to behavior

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: pirati.privatedns.org
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: yakuza.i686.elf	String found in binary or memory: http://linux-it.abuser.eu/yak.sh;
Source: yakuza.i686.elf	String found in binary or memory: https://youtu.be/dQw4w9WgXcQ
Source: yakuza.i686.elf	String found in binary or memory: https://youtu.be/dQw4w9WgXcQNever

System Summary

Malicious sample detected (through community Yara rule)

Source: yakuza.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_f51c5ac3 Author: unknown
Source: yakuza.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_27de1106 Author: unknown
Source: yakuza.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a Author: unknown
Source: yakuza.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_0fa3a6e9 Author: unknown
Source: yakuza.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: yakuza.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_6b3974b2 Author: unknown
Source: 5434.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f51c5ac3 Author: unknown
Source: 5434.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_27de1106 Author: unknown
Source: 5434.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a Author: unknown
Source: 5434.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_0fa3a6e9 Author: unknown
Source: 5434.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: 5434.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_6b3974b2 Author: unknown
Source: 5431.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f51c5ac3 Author: unknown
Source: 5431.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_27de1106 Author: unknown
Source: 5431.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a Author: unknown
Source: 5431.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_0fa3a6e9 Author: unknown
Source: 5431.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: 5431.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_6b3974b2 Author: unknown
Source: 5433.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f51c5ac3 Author: unknown
Source: 5433.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_27de1106 Author: unknown
Source: 5433.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a Author: unknown
Source: 5433.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_0fa3a6e9 Author: unknown
Source: 5433.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: 5433.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_6b3974b2 Author: unknown
Source: Process Memory Space: yakuza.i686.elf PID: 5431, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: Process Memory Space: yakuza.i686.elf PID: 5433, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: Process Memory Space: yakuza.i686.elf PID: 5434, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown

Source: yakuza.i686.elf	ELF static info symbol of initial sample: passwords
Source: yakuza.i686.elf	ELF static info symbol of initial sample: usernames

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: pkill -9 %s \|\| busybox pkill -9 %s
Source: Initial sample	String containing 'busybox' found: pkill -9 %s \|\| busybox pkill -9 %shistory -c;history -wcd /root;rm -f .bash_historycd /var/tmp; rm -f *NOTICE %s :MOVE <server>

Source: Initial sample	String containing potential weak password found: guest
Source: Initial sample	String containing potential weak password found: default
Source: Initial sample	String containing potential weak password found: admin
Source: Initial sample	String containing potential weak password found: supervisor
Source: Initial sample	String containing potential weak password found: service
Source: Initial sample	String containing potential weak password found: administrator
Source: Initial sample	String containing potential weak password found: support
Source: Initial sample	String containing potential weak password found: 123456
Source: Initial sample	String containing potential weak password found: password
Source: Initial sample	String containing potential weak password found: 12345

Source: yakuza.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_f51c5ac3 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 34f254afdf94b1eb29bae4eb8e3864ea49e918a5dbe6e4c9d06a4292c104a792, id = f51c5ac3-ade9-4d01-b578-3473a2b116db, last_modified = 2021-09-16
Source: yakuza.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_27de1106 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9a747f0fc7ccc55f24f2654344484f643103da709270a45de4c1174d8e4101cc, id = 27de1106-497d-40a0-8fc4-929f7a927628, last_modified = 2021-09-16
Source: yakuza.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407, id = 1b2e2a3a-1302-41c7-be99-43edb5563294, last_modified = 2021-09-16
Source: yakuza.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_0fa3a6e9 reference_sample = 40a15a186373a062bfb476b37a73c61e1ba84e5fa57282a7f9ec0481860f372a, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = fed796c5275e2e91c75dcdbf73d0c0ab37591115989312c6f6c5adcd138bc91f, id = 0fa3a6e9-89f3-4bc8-8dc1-e9ccbeeb836d, last_modified = 2021-09-16
Source: yakuza.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: yakuza.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_6b3974b2 reference_sample = 2216776ba5c6495d86a13f6a3ce61b655b72a328ca05b3678d1abb7a20829d04, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 942a35f7acacf1d07577fe159a34dc7b04e5d07ff32ea13be975cfeea23e34be, id = 6b3974b2-fd7f-4ebf-8aba-217761e7b846, last_modified = 2021-09-16
Source: 5434.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f51c5ac3 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 34f254afdf94b1eb29bae4eb8e3864ea49e918a5dbe6e4c9d06a4292c104a792, id = f51c5ac3-ade9-4d01-b578-3473a2b116db, last_modified = 2021-09-16
Source: 5434.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_27de1106 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9a747f0fc7ccc55f24f2654344484f643103da709270a45de4c1174d8e4101cc, id = 27de1106-497d-40a0-8fc4-929f7a927628, last_modified = 2021-09-16
Source: 5434.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407, id = 1b2e2a3a-1302-41c7-be99-43edb5563294, last_modified = 2021-09-16
Source: 5434.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_0fa3a6e9 reference_sample = 40a15a186373a062bfb476b37a73c61e1ba84e5fa57282a7f9ec0481860f372a, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = fed796c5275e2e91c75dcdbf73d0c0ab37591115989312c6f6c5adcd138bc91f, id = 0fa3a6e9-89f3-4bc8-8dc1-e9ccbeeb836d, last_modified = 2021-09-16
Source: 5434.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: 5434.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_6b3974b2 reference_sample = 2216776ba5c6495d86a13f6a3ce61b655b72a328ca05b3678d1abb7a20829d04, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 942a35f7acacf1d07577fe159a34dc7b04e5d07ff32ea13be975cfeea23e34be, id = 6b3974b2-fd7f-4ebf-8aba-217761e7b846, last_modified = 2021-09-16
Source: 5431.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f51c5ac3 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 34f254afdf94b1eb29bae4eb8e3864ea49e918a5dbe6e4c9d06a4292c104a792, id = f51c5ac3-ade9-4d01-b578-3473a2b116db, last_modified = 2021-09-16
Source: 5431.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_27de1106 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9a747f0fc7ccc55f24f2654344484f643103da709270a45de4c1174d8e4101cc, id = 27de1106-497d-40a0-8fc4-929f7a927628, last_modified = 2021-09-16
Source: 5431.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407, id = 1b2e2a3a-1302-41c7-be99-43edb5563294, last_modified = 2021-09-16
Source: 5431.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_0fa3a6e9 reference_sample = 40a15a186373a062bfb476b37a73c61e1ba84e5fa57282a7f9ec0481860f372a, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = fed796c5275e2e91c75dcdbf73d0c0ab37591115989312c6f6c5adcd138bc91f, id = 0fa3a6e9-89f3-4bc8-8dc1-e9ccbeeb836d, last_modified = 2021-09-16
Source: 5431.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: 5431.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_6b3974b2 reference_sample = 2216776ba5c6495d86a13f6a3ce61b655b72a328ca05b3678d1abb7a20829d04, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 942a35f7acacf1d07577fe159a34dc7b04e5d07ff32ea13be975cfeea23e34be, id = 6b3974b2-fd7f-4ebf-8aba-217761e7b846, last_modified = 2021-09-16
Source: 5433.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f51c5ac3 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 34f254afdf94b1eb29bae4eb8e3864ea49e918a5dbe6e4c9d06a4292c104a792, id = f51c5ac3-ade9-4d01-b578-3473a2b116db, last_modified = 2021-09-16
Source: 5433.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_27de1106 reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9a747f0fc7ccc55f24f2654344484f643103da709270a45de4c1174d8e4101cc, id = 27de1106-497d-40a0-8fc4-929f7a927628, last_modified = 2021-09-16
Source: 5433.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_1b2e2a3a reference_sample = 899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407, id = 1b2e2a3a-1302-41c7-be99-43edb5563294, last_modified = 2021-09-16
Source: 5433.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_0fa3a6e9 reference_sample = 40a15a186373a062bfb476b37a73c61e1ba84e5fa57282a7f9ec0481860f372a, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = fed796c5275e2e91c75dcdbf73d0c0ab37591115989312c6f6c5adcd138bc91f, id = 0fa3a6e9-89f3-4bc8-8dc1-e9ccbeeb836d, last_modified = 2021-09-16
Source: 5433.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: 5433.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_6b3974b2 reference_sample = 2216776ba5c6495d86a13f6a3ce61b655b72a328ca05b3678d1abb7a20829d04, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 942a35f7acacf1d07577fe159a34dc7b04e5d07ff32ea13be975cfeea23e34be, id = 6b3974b2-fd7f-4ebf-8aba-217761e7b846, last_modified = 2021-09-16
Source: Process Memory Space: yakuza.i686.elf PID: 5431, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: Process Memory Space: yakuza.i686.elf PID: 5433, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: Process Memory Space: yakuza.i686.elf PID: 5434, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16

Source: classification engine

Classification label: mal68.troj.linELF@0/0@3/0

Source: yakuza.i686.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crt1.S
Source: yakuza.i686.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crti.S
Source: yakuza.i686.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crtn.S
Source: yakuza.i686.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/mmap.S
Source: yakuza.i686.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/vfork.S

Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/230/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/230/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/110/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/110/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/231/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/231/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/111/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/111/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/232/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/232/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/112/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/112/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/233/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/233/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/113/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/113/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/234/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/234/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/114/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/114/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/235/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/235/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/115/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/115/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/236/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/236/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/116/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/116/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/237/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/237/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/117/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/117/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/238/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/238/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/118/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/118/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/239/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/239/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/5379/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/5379/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/119/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/119/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/914/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/914/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/10/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/10/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/917/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/917/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/11/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/11/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/12/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/12/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/13/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/13/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/5274/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/5274/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/14/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/14/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/15/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/15/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/16/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/16/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/17/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/17/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/18/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/18/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/19/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/19/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/240/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/240/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/3095/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/3095/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/120/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/120/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/241/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/241/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/121/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/121/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/242/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/242/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/1/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/1/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/122/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/122/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/243/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/243/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/2/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/2/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/123/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/123/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/244/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/244/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/3/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/3/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/124/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/124/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/245/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/245/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/1588/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/1588/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/125/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/125/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/4/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/4/cmdline
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/246/status
Source: /usr/bin/pkill (PID: 5584)	File opened: /proc/246/cmdline

Source: /tmp/yakuza.i686.elf (PID: 5435)	Shell command executed: sh -c "pkill -9 902i13 \|\| busybox pkill -9 902i13"	Jump to behavior
Source: /tmp/yakuza.i686.elf (PID: 5468)	Shell command executed: sh -c "pkill -9 BzSxLxBxeY \|\| busybox pkill -9 BzSxLxBxeY"	Jump to behavior
Source: /tmp/yakuza.i686.elf (PID: 5473)	Shell command executed: sh -c "pkill -9 HOHO-LUGO7 \|\| busybox pkill -9 HOHO-LUGO7"	Jump to behavior
Source: /tmp/yakuza.i686.elf (PID: 5476)	Shell command executed: sh -c "pkill -9 HOHO-U79OL \|\| busybox pkill -9 HOHO-U79OL"	Jump to behavior
Source: /tmp/yakuza.i686.elf (PID: 5479)	Shell command executed: sh -c "pkill -9 JuYfouyf87 \|\| busybox pkill -9 JuYfouyf87"	Jump to behavior
Source: /tmp/yakuza.i686.elf (PID: 5484)	Shell command executed: sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"	Jump to behavior
Source: /tmp/yakuza.i686.elf (PID: 5493)	Shell command executed: sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"	Jump to behavior
Source: /tmp/yakuza.i686.elf (PID: 5498)	Shell command executed: sh -c "pkill -9 LOLKIKEEEDDE \|\| busybox pkill -9 LOLKIKEEEDDE"	Jump to behavior
Source: /tmp/yakuza.i686.elf (PID: 5501)	Shell command executed: sh -c "pkill -9 ekjheory98e \|\| busybox pkill -9 ekjheory98e"	Jump to behavior
Source: /tmp/yakuza.i686.elf (PID: 5526)	Shell command executed: sh -c "pkill -9 scansh4 \|\| busybox pkill -9 scansh4"	Jump to behavior
Source: /tmp/yakuza.i686.elf (PID: 5529)	Shell command executed: sh -c "pkill -9 MDMA \|\| busybox pkill -9 MDMA"	Jump to behavior
Source: /tmp/yakuza.i686.elf (PID: 5534)	Shell command executed: sh -c "pkill -9 fdevalvex \|\| busybox pkill -9 fdevalvex"	Jump to behavior
Source: /tmp/yakuza.i686.elf (PID: 5538)	Shell command executed: sh -c "pkill -9 scanspc \|\| busybox pkill -9 scanspc"	Jump to behavior
Source: /tmp/yakuza.i686.elf (PID: 5541)	Shell command executed: sh -c "pkill -9 MELTEDNINJAREALZ \|\| busybox pkill -9 MELTEDNINJAREALZ"	Jump to behavior
Source: /tmp/yakuza.i686.elf (PID: 5546)	Shell command executed: sh -c "pkill -9 flexsonskids \|\| busybox pkill -9 flexsonskids"	Jump to behavior
Source: /tmp/yakuza.i686.elf (PID: 5549)	Shell command executed: sh -c "pkill -9 scanx86 \|\| busybox pkill -9 scanx86"
Source: /tmp/yakuza.i686.elf (PID: 5554)	Shell command executed: sh -c "pkill -9 MISAKI-U79OL \|\| busybox pkill -9 MISAKI-U79OL"
Source: /tmp/yakuza.i686.elf (PID: 5557)	Shell command executed: sh -c "pkill -9 foAxi102kxe \|\| busybox pkill -9 foAxi102kxe"
Source: /tmp/yakuza.i686.elf (PID: 5560)	Shell command executed: sh -c "pkill -9 swodjwodjwoj \|\| busybox pkill -9 swodjwodjwoj"
Source: /tmp/yakuza.i686.elf (PID: 5565)	Shell command executed: sh -c "pkill -9 MmKiy7f87l \|\| busybox pkill -9 MmKiy7f87l"
Source: /tmp/yakuza.i686.elf (PID: 5568)	Shell command executed: sh -c "pkill -9 freecookiex86 \|\| busybox pkill -9 freecookiex86"
Source: /tmp/yakuza.i686.elf (PID: 5573)	Shell command executed: sh -c "pkill -9 sysgpu \|\| busybox pkill -9 sysgpu"
Source: /tmp/yakuza.i686.elf (PID: 5576)	Shell command executed: sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
Source: /tmp/yakuza.i686.elf (PID: 5583)	Shell command executed: sh -c "pkill -9 frgege \|\| busybox pkill -9 frgege"
Source: /tmp/yakuza.i686.elf (PID: 5586)	Shell command executed: sh -c "pkill -9 sysupdater \|\| busybox pkill -9 sysupdater"
Source: /tmp/yakuza.i686.elf (PID: 5589)	Shell command executed: sh -c "pkill -9 0DnAzepd \|\| busybox pkill -9 0DnAzepd"
Source: /tmp/yakuza.i686.elf (PID: 5595)	Shell command executed: sh -c "pkill -9 NiGGeRD0nks69 \|\| busybox pkill -9 NiGGeRD0nks69"
Source: /tmp/yakuza.i686.elf (PID: 5598)	Shell command executed: sh -c "pkill -9 frgreu \|\| busybox pkill -9 frgreu"
Source: /tmp/yakuza.i686.elf (PID: 5603)	Shell command executed: sh -c "pkill -9 telnetd \|\| busybox pkill -9 telnetd"
Source: /tmp/yakuza.i686.elf (PID: 5606)	Shell command executed: sh -c "pkill -9 0x766f6964 \|\| busybox pkill -9 0x766f6964"
Source: /tmp/yakuza.i686.elf (PID: 5611)	Shell command executed: sh -c "pkill -9 NiGGeRd0nks1337 \|\| busybox pkill -9 NiGGeRd0nks1337"
Source: /tmp/yakuza.i686.elf (PID: 5614)	Shell command executed: sh -c "pkill -9 gaft \|\| busybox pkill -9 gaft"
Source: /tmp/yakuza.i686.elf (PID: 5619)	Shell command executed: sh -c "pkill -9 urasgbsigboa \|\| busybox pkill -9 urasgbsigboa"
Source: /tmp/yakuza.i686.elf (PID: 5622)	Shell command executed: sh -c "pkill -9 120i3UI49 \|\| busybox pkill -9 120i3UI49"
Source: /tmp/yakuza.i686.elf (PID: 5625)	Shell command executed: sh -c "pkill -9 OaF3 \|\| busybox pkill -9 OaF3"
Source: /tmp/yakuza.i686.elf (PID: 5630)	Shell command executed: sh -c "pkill -9 geae \|\| busybox pkill -9 geae"
Source: /tmp/yakuza.i686.elf (PID: 5633)	Shell command executed: sh -c "pkill -9 vaiolmao \|\| busybox pkill -9 vaiolmao"
Source: /tmp/yakuza.i686.elf (PID: 5638)	Shell command executed: sh -c "pkill -9 123123a \|\| busybox pkill -9 123123a"
Source: /tmp/yakuza.i686.elf (PID: 5641)	Shell command executed: sh -c "pkill -9 Ofurain0n4H34D \|\| busybox pkill -9 Ofurain0n4H34D"
Source: /tmp/yakuza.i686.elf (PID: 5646)	Shell command executed: sh -c "pkill -9 ggTrex \|\| busybox pkill -9 ggTrex"
Source: /tmp/yakuza.i686.elf (PID: 5650)	Shell command executed: sh -c "pkill -9 wasads \|\| busybox pkill -9 wasads"
Source: /tmp/yakuza.i686.elf (PID: 5653)	Shell command executed: sh -c "pkill -9 1293194hjXD \|\| busybox pkill -9 1293194hjXD"
Source: /tmp/yakuza.i686.elf (PID: 5658)	Shell command executed: sh -c "pkill -9 OthLaLosn \|\| busybox pkill -9 OthLaLosn"
Source: /tmp/yakuza.i686.elf (PID: 5661)	Shell command executed: sh -c "pkill -9 ggt \|\| busybox pkill -9 ggt"
Source: /tmp/yakuza.i686.elf (PID: 5666)	Shell command executed: sh -c "pkill -9 wget-log \|\| busybox pkill -9 wget-log"
Source: /tmp/yakuza.i686.elf (PID: 5669)	Shell command executed: sh -c "pkill -9 1337SoraLOADER \|\| busybox pkill -9 1337SoraLOADER"
Source: /tmp/yakuza.i686.elf (PID: 5674)	Shell command executed: sh -c "pkill -9 SAIAKINA \|\| busybox pkill -9 SAIAKINA"
Source: /tmp/yakuza.i686.elf (PID: 5677)	Shell command executed: sh -c "pkill -9 ggtq \|\| busybox pkill -9 ggtq"
Source: /tmp/yakuza.i686.elf (PID: 5680)	Shell command executed: sh -c "pkill -9 1378bfp919GRB1Q2 \|\| busybox pkill -9 1378bfp919GRB1Q2"
Source: /tmp/yakuza.i686.elf (PID: 5685)	Shell command executed: sh -c "pkill -9 SAIAKUSO \|\| busybox pkill -9 SAIAKUSO"
Source: /tmp/yakuza.i686.elf (PID: 5688)	Shell command executed: sh -c "pkill -9 ggtr \|\| busybox pkill -9 ggtr"
Source: /tmp/yakuza.i686.elf (PID: 5695)	Shell command executed: sh -c "pkill -9 14Fa \|\| busybox pkill -9 14Fa"
Source: /tmp/yakuza.i686.elf (PID: 5698)	Shell command executed: sh -c "pkill -9 SEXSLAVE1337 \|\| busybox pkill -9 SEXSLAVE1337"
Source: /tmp/yakuza.i686.elf (PID: 5703)	Shell command executed: sh -c "pkill -9 ggtt \|\| busybox pkill -9 ggtt"
Source: /tmp/yakuza.i686.elf (PID: 5707)	Shell command executed: sh -c "pkill -9 1902a3u912u3u4 \|\| busybox pkill -9 1902a3u912u3u4"
Source: /tmp/yakuza.i686.elf (PID: 5710)	Shell command executed: sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"
Source: /tmp/yakuza.i686.elf (PID: 5715)	Shell command executed: sh -c "pkill -9 haetrghbr \|\| busybox pkill -9 haetrghbr"
Source: /tmp/yakuza.i686.elf (PID: 5718)	Shell command executed: sh -c "pkill -9 19ju3d \|\| busybox pkill -9 19ju3d"
Source: /tmp/yakuza.i686.elf (PID: 5723)	Shell command executed: sh -c "pkill -9 SORAojkf120 \|\| busybox pkill -9 SORAojkf120"

Source: /bin/sh (PID: 5437)	Pkill executable: /usr/bin/pkill -> pkill -9 902i13	Jump to behavior
Source: /bin/sh (PID: 5469)	Pkill executable: /usr/bin/pkill -> pkill -9 BzSxLxBxeY	Jump to behavior
Source: /bin/sh (PID: 5474)	Pkill executable: /usr/bin/pkill -> pkill -9 HOHO-LUGO7	Jump to behavior
Source: /bin/sh (PID: 5477)	Pkill executable: /usr/bin/pkill -> pkill -9 HOHO-U79OL	Jump to behavior
Source: /bin/sh (PID: 5480)	Pkill executable: /usr/bin/pkill -> pkill -9 JuYfouyf87	Jump to behavior
Source: /bin/sh (PID: 5485)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeR69xd	Jump to behavior
Source: /bin/sh (PID: 5494)	Pkill executable: /usr/bin/pkill -> pkill -9 SO190Ij1X	Jump to behavior
Source: /bin/sh (PID: 5499)	Pkill executable: /usr/bin/pkill -> pkill -9 LOLKIKEEEDDE	Jump to behavior
Source: /bin/sh (PID: 5502)	Pkill executable: /usr/bin/pkill -> pkill -9 ekjheory98e	Jump to behavior
Source: /bin/sh (PID: 5527)	Pkill executable: /usr/bin/pkill -> pkill -9 scansh4	Jump to behavior
Source: /bin/sh (PID: 5530)	Pkill executable: /usr/bin/pkill -> pkill -9 MDMA	Jump to behavior
Source: /bin/sh (PID: 5535)	Pkill executable: /usr/bin/pkill -> pkill -9 fdevalvex	Jump to behavior
Source: /bin/sh (PID: 5539)	Pkill executable: /usr/bin/pkill -> pkill -9 scanspc	Jump to behavior
Source: /bin/sh (PID: 5542)	Pkill executable: /usr/bin/pkill -> pkill -9 MELTEDNINJAREALZ	Jump to behavior
Source: /bin/sh (PID: 5547)	Pkill executable: /usr/bin/pkill -> pkill -9 flexsonskids	Jump to behavior
Source: /bin/sh (PID: 5550)	Pkill executable: /usr/bin/pkill -> pkill -9 scanx86
Source: /bin/sh (PID: 5555)	Pkill executable: /usr/bin/pkill -> pkill -9 MISAKI-U79OL
Source: /bin/sh (PID: 5558)	Pkill executable: /usr/bin/pkill -> pkill -9 foAxi102kxe
Source: /bin/sh (PID: 5561)	Pkill executable: /usr/bin/pkill -> pkill -9 swodjwodjwoj
Source: /bin/sh (PID: 5566)	Pkill executable: /usr/bin/pkill -> pkill -9 MmKiy7f87l
Source: /bin/sh (PID: 5569)	Pkill executable: /usr/bin/pkill -> pkill -9 freecookiex86
Source: /bin/sh (PID: 5574)	Pkill executable: /usr/bin/pkill -> pkill -9 sysgpu
Source: /bin/sh (PID: 5577)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeR69xd
Source: /bin/sh (PID: 5584)	Pkill executable: /usr/bin/pkill -> pkill -9 frgege
Source: /bin/sh (PID: 5587)	Pkill executable: /usr/bin/pkill -> pkill -9 sysupdater
Source: /bin/sh (PID: 5590)	Pkill executable: /usr/bin/pkill -> pkill -9 0DnAzepd
Source: /bin/sh (PID: 5596)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeRD0nks69
Source: /bin/sh (PID: 5599)	Pkill executable: /usr/bin/pkill -> pkill -9 frgreu
Source: /bin/sh (PID: 5604)	Pkill executable: /usr/bin/pkill -> pkill -9 telnetd
Source: /bin/sh (PID: 5607)	Pkill executable: /usr/bin/pkill -> pkill -9 0x766f6964
Source: /bin/sh (PID: 5612)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeRd0nks1337
Source: /bin/sh (PID: 5615)	Pkill executable: /usr/bin/pkill -> pkill -9 gaft
Source: /bin/sh (PID: 5620)	Pkill executable: /usr/bin/pkill -> pkill -9 urasgbsigboa
Source: /bin/sh (PID: 5623)	Pkill executable: /usr/bin/pkill -> pkill -9 120i3UI49
Source: /bin/sh (PID: 5626)	Pkill executable: /usr/bin/pkill -> pkill -9 OaF3
Source: /bin/sh (PID: 5631)	Pkill executable: /usr/bin/pkill -> pkill -9 geae
Source: /bin/sh (PID: 5634)	Pkill executable: /usr/bin/pkill -> pkill -9 vaiolmao
Source: /bin/sh (PID: 5639)	Pkill executable: /usr/bin/pkill -> pkill -9 123123a
Source: /bin/sh (PID: 5642)	Pkill executable: /usr/bin/pkill -> pkill -9 Ofurain0n4H34D
Source: /bin/sh (PID: 5647)	Pkill executable: /usr/bin/pkill -> pkill -9 ggTrex
Source: /bin/sh (PID: 5651)	Pkill executable: /usr/bin/pkill -> pkill -9 wasads
Source: /bin/sh (PID: 5654)	Pkill executable: /usr/bin/pkill -> pkill -9 1293194hjXD
Source: /bin/sh (PID: 5659)	Pkill executable: /usr/bin/pkill -> pkill -9 OthLaLosn
Source: /bin/sh (PID: 5662)	Pkill executable: /usr/bin/pkill -> pkill -9 ggt
Source: /bin/sh (PID: 5667)	Pkill executable: /usr/bin/pkill -> pkill -9 wget-log
Source: /bin/sh (PID: 5670)	Pkill executable: /usr/bin/pkill -> pkill -9 1337SoraLOADER
Source: /bin/sh (PID: 5675)	Pkill executable: /usr/bin/pkill -> pkill -9 SAIAKINA
Source: /bin/sh (PID: 5678)	Pkill executable: /usr/bin/pkill -> pkill -9 ggtq
Source: /bin/sh (PID: 5681)	Pkill executable: /usr/bin/pkill -> pkill -9 1378bfp919GRB1Q2
Source: /bin/sh (PID: 5686)	Pkill executable: /usr/bin/pkill -> pkill -9 SAIAKUSO
Source: /bin/sh (PID: 5689)	Pkill executable: /usr/bin/pkill -> pkill -9 ggtr
Source: /bin/sh (PID: 5696)	Pkill executable: /usr/bin/pkill -> pkill -9 14Fa
Source: /bin/sh (PID: 5699)	Pkill executable: /usr/bin/pkill -> pkill -9 SEXSLAVE1337
Source: /bin/sh (PID: 5704)	Pkill executable: /usr/bin/pkill -> pkill -9 ggtt
Source: /bin/sh (PID: 5708)	Pkill executable: /usr/bin/pkill -> pkill -9 1902a3u912u3u4
Source: /bin/sh (PID: 5711)	Pkill executable: /usr/bin/pkill -> pkill -9 SO190Ij1X
Source: /bin/sh (PID: 5716)	Pkill executable: /usr/bin/pkill -> pkill -9 haetrghbr
Source: /bin/sh (PID: 5719)	Pkill executable: /usr/bin/pkill -> pkill -9 19ju3d
Source: /bin/sh (PID: 5724)	Pkill executable: /usr/bin/pkill -> pkill -9 SORAojkf120

Source: /usr/bin/pkill (PID: 5437)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5469)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5474)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5477)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5480)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5485)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5494)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5499)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5502)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5527)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5530)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5535)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5539)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5542)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5547)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5550)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5555)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5558)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5561)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5566)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5569)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5574)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5577)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5584)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5587)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5590)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5596)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5599)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5604)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5607)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5612)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5615)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5620)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5623)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5626)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5631)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5634)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5639)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5642)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5647)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5651)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5654)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5659)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5662)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5667)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5670)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5675)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5678)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5681)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5686)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5689)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5696)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5699)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5704)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5708)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5711)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5716)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5719)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5724)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /usr/bin/busybox (PID: 5467)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5470)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5475)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5478)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5483)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5492)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5495)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5500)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5503)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5528)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5531)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5537)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5540)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5545)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5548)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5551)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5556)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5559)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5564)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5567)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5572)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5575)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5578)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5585)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5588)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5594)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5597)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5602)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5605)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5608)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5613)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5616)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5621)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5624)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5629)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5632)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5635)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5640)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5643)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5649)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5652)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5657)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5660)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5665)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5668)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5671)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5676)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5679)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5684)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5687)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5690)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5697)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5700)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5705)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5709)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5714)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5717)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5720)	Queries kernel information via 'uname':

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: yakuza.i686.elf, type: SAMPLE
Source: Yara match	File source: 5434.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5431.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5433.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U;) Presto/2.7.62 Version/11.01
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; U; de; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.62
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0) Gecko/20110517 Firefox/5.0 Fennec/5.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (compatible; Teleca Q7; Brew 3.1.5; U; en) 480X800 LGE VX11000

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: yakuza.i686.elf, type: SAMPLE
Source: Yara match	File source: 5434.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5431.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5433.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	1 Brute Force	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
yakuza.i686.elf	61%	ReversingLabs	Linux.Trojan.Tsunami
yakuza.i686.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high
pirati.privatedns.org	212.171.15.94	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://youtu.be/dQw4w9WgXcQ	yakuza.i686.elf	false	high
http://linux-it.abuser.eu/yak.sh;	yakuza.i686.elf	false	high
https://youtu.be/dQw4w9WgXcQNever	yakuza.i686.elf	false	high

World Map of Contacted IPs

⊘No contacted IP infos

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pirati.privatedns.org	yakuza.ppc.elf	Get hash	malicious	Mirai	Browse	212.171.15.94
daisy.ubuntu.com	arm6.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	45.200.149.186-boatnet.arm-2024-12-28T01_23_00.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	byte.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.24
	109.176.30.237-boatnet.mpsl-2024-12-27T20_20_43.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	byte.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	byte.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	byte.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	llklllklld.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	RpcSecurity.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.484480492175519
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	yakuza.i686.elf
File size:	123'163 bytes
MD5:	6bdc27df8c2053f9044bb4bd108deecd
SHA1:	9e73b6b3d89ef6e0fc3cbeeeada86244d6efebd6
SHA256:	0c1a58b756dd6aa169097046eb145b32f2b5d2c4c91c919d7c5dcdf8d83ed871
SHA512:	8efad684e24c3d7a303308475476a13f8806ccfb43015e7c3085366e7e4ba89f9724cc6e3843c6389359569331f4438ab390fd509b09c434a3417f776ccdf1e5
SSDEEP:	3072:mJoBZ/hI5Br7xCarXRVRd3zluh9Zw8yFhv69ny6JP/KTiFi:mYhI5BJ/n/3zCZw8sv69ny6JHKTiFi
TLSH:	9AC34CC7E703C7F3D4520EB607A7E76D4625B8268D1A8F98F31C7DB49B12D88B219264
File Content Preview:	.ELF....................h...4....}......4. ...(......................a...a...............a..........h...............Q.td............................U..S.......oq...h........[]...$.............U......=`....t..1....$......$.......u........t...$...........`.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048168
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	97564
Section Header Size:	40
Number of Section Headers:	16
Header String Table Index:	13

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x80480b0	0xb0	0x10bd4	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x8058c84	0x10c84	0x17	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x8058ca0	0x10ca0	0x5552	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x805e1f4	0x161f4	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x805f1f8	0x161f8	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x805f200	0x16200	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x805f208	0x16208	0x4	0x0	0x3	WA	0	0	4
.got.plt	PROGBITS	0x805f20c	0x1620c	0xc	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x805f220	0x16220	0xd40	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x805ff60	0x16f60	0x7ba8	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0x16f60	0xd4a	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x17caa	0x6f	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x17f9c	0x3840	0x10	0x0		15	296	4
.strtab	STRTAB	0x0	0x1b7dc	0x293f	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x161f8	0x161f8	6.6121	0x5	R E	0x1000	.init .text .fini .rodata .eh_frame
LOAD	0x161f8	0x805f1f8	0x805f1f8	0xd68	0x8910	4.7701	0x6	RW	0x1000	.ctors .dtors .jcr .got.plt .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8048094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80480b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x8058c84	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x8058ca0	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x805e1f4	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x805f1f8	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x805f200	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x805f208	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x805f20c	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x805f220	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x805ff60	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
C.73.5600	.symtab	0x805a920	36	OBJECT	<unknown>	DEFAULT	4
C.91.5818	.symtab	0x805af40	312	OBJECT	<unknown>	DEFAULT	4
ClearHistory	.symtab	0x804d8c8	44	FUNC	<unknown>	DEFAULT	2
HTTP	.symtab	0x804a0d7	273	FUNC	<unknown>	DEFAULT	2
Q	.symtab	0x80603c0	16384	OBJECT	<unknown>	DEFAULT	11
Send	.symtab	0x8048325	94	FUNC	<unknown>	DEFAULT	2
UserAgents	.symtab	0x805f580	144	OBJECT	<unknown>	DEFAULT	10
_352	.symtab	0x804ee29	5	FUNC	<unknown>	DEFAULT	2
_376	.symtab	0x804ed8d	122	FUNC	<unknown>	DEFAULT	2
_433	.symtab	0x804ee2e	54	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x805f20c	0	OBJECT	<unknown>	HIDDEN	9
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_NICK	.symtab	0x804ee64	170	FUNC	<unknown>	DEFAULT	2
_PING	.symtab	0x804ee07	34	FUNC	<unknown>	DEFAULT	2
_PRIVMSG	.symtab	0x804e2b4	2777	FUNC	<unknown>	DEFAULT	2
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x805f1fc	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x805f1f8	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x805ff1c	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x805daa0	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x805ff24	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x805dda0	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x805fcc0	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x805c800	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x805f204	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x805f200	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x805e1f4	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x805e1f4	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x805ff1c	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_b_data	.symtab	0x805daa0	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x805ff24	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_tolower_data	.symtab	0x805dda0	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x805fcc0	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_toupper_data	.symtab	0x805c800	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x805ff20	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_tolower	.symtab	0x805ff28	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_toupper	.symtab	0x805fcc4	4	OBJECT	<unknown>	HIDDEN	10
__GI___errno_location	.symtab	0x804ff88	6	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x8056628	220	FUNC	<unknown>	HIDDEN	2
__GI___fputc_unlocked	.symtab	0x8051a20	187	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x8051c64	29	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x8055bd4	6	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x804fb08	87	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x804fb60	63	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x8055a3c	75	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x8055428	63	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x805549f	64	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x8051c84	182	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x805582c	40	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x8054914	273	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x8053828	43	FUNC	<unknown>	HIDDEN	2
__GI_asprintf	.symtab	0x80501a4	30	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x8054ee0	20	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x8054ee0	20	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x8053854	43	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x80580b0	54	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x804fba0	46	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x8055854	50	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x804fbd0	46	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x8053880	43	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x8055888	50	FUNC	<unknown>	HIDDEN	2
__GI_endservent	.symtab	0x8056af3	92	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x8066434	4	OBJECT	<unknown>	HIDDEN	11
__GI_execl	.symtab	0x80550b8	105	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x80558bc	54	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x8055050	103	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x804ff90	271	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x804fb08	87	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x804fb60	63	FUNC	<unknown>	HIDDEN	2
__GI_fdopen	.symtab	0x8055ccc	50	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x8051864	333	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x8056628	220	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x8051628	98	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x80519b4	105	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x80500a0	24	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x804fc00	38	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x8050184	30	FUNC	<unknown>	HIDDEN	2
__GI_fputc	.symtab	0x805168c	146	FUNC	<unknown>	HIDDEN	2
__GI_fputs	.symtab	0x8051720	95	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x8051adc	49	FUNC	<unknown>	HIDDEN	2
__GI_freeaddrinfo	.symtab	0x8052918	35	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x8058100	27	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x8058180	231	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x8051b10	120	FUNC	<unknown>	HIDDEN	2
__GI_getaddrinfo	.symtab	0x805293b	651	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x8056628	220	FUNC	<unknown>	HIDDEN	2
__GI_getcwd	.symtab	0x804fc28	184	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x804fce0	37	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x80558f4	38	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x805591c	38	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x8055944	38	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyaddr_r	.symtab	0x80534b8	878	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x8053188	815	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x8057c14	818	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x804fd08	17	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x804fd1c	38	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x804fd6c	50	FUNC	<unknown>	HIDDEN	2
__GI_getservbyname_r	.symtab	0x8056ca6	224	FUNC	<unknown>	HIDDEN	2
__GI_getservbyport	.symtab	0x8056c72	52	FUNC	<unknown>	HIDDEN	2
__GI_getservbyport_r	.symtab	0x8056bc2	176	FUNC	<unknown>	HIDDEN	2
__GI_getservent_r	.symtab	0x80568f6	467	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x805596c	38	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x8066438	4	OBJECT	<unknown>	HIDDEN	11
__GI_if_freenameindex	.symtab	0x8057046	52	FUNC	<unknown>	HIDDEN	2
__GI_if_nameindex	.symtab	0x8056eac	410	FUNC	<unknown>	HIDDEN	2
__GI_if_nametoindex	.symtab	0x8056e37	117	FUNC	<unknown>	HIDDEN	2
__GI_in6addr_loopback	.symtab	0x805d7b8	16	OBJECT	<unknown>	HIDDEN	4
__GI_inet_addr	.symtab	0x8053160	37	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x805707c	148	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x805314b	21	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x80530fc	79	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x8052f29	465	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x8052c4e	458	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x8054d01	171	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x804fda0	63	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x8051e34	29	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x804fde0	50	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x80538e8	35	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x8058ae0	86	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x8056704	35	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x8051b88	39	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x8056728	39	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x8056770	33	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x8056794	176	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x8051bb0	21	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x80557a0	27	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x8055994	63	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x80559d4	50	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x8055a08	50	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x8055a3c	75	FUNC	<unknown>	HIDDEN	2
__GI_perror	.symtab	0x80500b8	50	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x8055aa0	46	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x804fe14	54	FUNC	<unknown>	HIDDEN	2
__GI_putc	.symtab	0x805168c	146	FUNC	<unknown>	HIDDEN	2
__GI_putc_unlocked	.symtab	0x8051a20	187	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x8057f70	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x8054a30	72	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x8054c09	94	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x8058478	99	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x8058b38	54	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x805390c	51	FUNC	<unknown>	HIDDEN	2
__GI_rewind	.symtab	0x805811c	98	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x8055ad0	78	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x804fe4c	63	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x8053940	51	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x8053974	67	FUNC	<unknown>	HIDDEN	2
__GI_setservent	.symtab	0x8056b4f	115	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x804fe8c	38	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x80539b8	59	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x8054b70	153	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x80556ab	218	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x8057f88	175	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x8055b20	85	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x8055124	393	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x80539f4	43	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x80501c4	31	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x8054c67	154	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x8051d54	54	FUNC	<unknown>	HIDDEN	2
__GI_strcasestr	.symtab	0x8051d8c	83	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x8056750	30	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x8058428	29	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x8058428	29	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x8051bc8	27	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x8051de0	54	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x8051be4	19	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x8058448	46	FUNC	<unknown>	HIDDEN	2
__GI_strncmp	.symtab	0x8051bf8	37	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x8051c20	38	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x8051c48	25	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x80568a0	39	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x80584dc	50	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x8051e18	25	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x8056844	89	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x8054ef4	26	FUNC	<unknown>	HIDDEN	2
__GI_strtoul	.symtab	0x8054f10	26	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x80552b0	325	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x8051e54	112	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x804feb4	46	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x8055bb4	29	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x804ff68	29	FUNC	<unknown>	HIDDEN	2
__GI_vasprintf	.symtab	0x80501e4	115	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x8055788	21	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x8050934	136	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x8050258	176	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x8055b78	59	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x804ff14	26	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x8055bdc	69	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x8055c44	133	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x8055c24	30	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x804ff30	54	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x805f208	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x805f208	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x8066428	4	OBJECT	<unknown>	HIDDEN	11
__atexit_lock	.symtab	0x805ff00	24	OBJECT	<unknown>	DEFAULT	10
__bsd_signal	.symtab	0x8057f88	175	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x805ff60	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x805546b	52	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x805ff20	4	OBJECT	<unknown>	DEFAULT	10
__ctype_tolower	.symtab	0x805ff28	4	OBJECT	<unknown>	DEFAULT	10
__ctype_toupper	.symtab	0x805fcc4	4	OBJECT	<unknown>	DEFAULT	10
__curbrk	.symtab	0x8066474	4	OBJECT	<unknown>	HIDDEN	11
__data_start	.symtab	0x805f228	0	NOTYPE	<unknown>	DEFAULT	10
__decode_answer	.symtab	0x80586dc	249	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x8057110	217	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x80585c0	171	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x80571ec	1876	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x8058c50	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80480c0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x805f220	0	OBJECT	<unknown>	HIDDEN	10
__encode_dotted	.symtab	0x8058b70	144	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x8058510	175	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x805866c	83	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x8066420	4	OBJECT	<unknown>	DEFAULT	11
__errno_location	.symtab	0x804ff88	6	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x8066418	4	OBJECT	<unknown>	HIDDEN	11
__fgetc_unlocked	.symtab	0x8056628	220	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x805f1f8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x805f1f8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fputc_unlocked	.symtab	0x8051a20	187	FUNC	<unknown>	DEFAULT	2
__get_hosts_byaddr_r	.symtab	0x8057bb0	97	FUNC	<unknown>	HIDDEN	2
__get_hosts_byname_r	.symtab	0x8057b84	44	FUNC	<unknown>	HIDDEN	2
__get_pc_thunk_bx	.symtab	0x80480b0	0	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x804fd08	17	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x8051c64	29	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x8055bd4	6	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x805f1f8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x805f1f8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__initbuf	.symtab	0x80568c8	46	FUNC	<unknown>	DEFAULT	2
__length_dotted	.symtab	0x8058c00	65	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x80586c0	28	FUNC	<unknown>	HIDDEN	2
__libc_accept	.symtab	0x8053828	43	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x804fbd0	46	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x8053880	43	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x8055a87	25	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x804fb08	87	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x804fb60	63	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x804fc00	38	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x804fd1c	38	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x8058ae0	86	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x8055a08	50	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x8055a3c	75	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x804fe14	54	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x8058b38	54	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x805390c	51	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x804fe4c	63	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x8053940	51	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x8053974	67	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x80556ab	218	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x806641c	4	OBJECT	<unknown>	DEFAULT	11
__libc_system	.symtab	0x8054dac	305	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x804ff14	26	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x804ff30	54	FUNC	<unknown>	DEFAULT	2
__malloc_consolidate	.symtab	0x80545ad	424	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x8053a20	38	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x805fe10	24	OBJECT	<unknown>	DEFAULT	10
__malloc_state	.symtab	0x80676e0	888	OBJECT	<unknown>	DEFAULT	11
__malloc_trim	.symtab	0x8054520	141	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x8067a68	12	OBJECT	<unknown>	HIDDEN	11
__nameservers	.symtab	0x8067a74	4	OBJECT	<unknown>	HIDDEN	11
__open_etc_hosts	.symtab	0x80587d8	49	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x8057940	579	FUNC	<unknown>	HIDDEN	2
__opensock	.symtab	0x8057f48	40	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x8066424	4	OBJECT	<unknown>	DEFAULT	11
__preinit_array_end	.symtab	0x805f1f8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x805f1f8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x8055467	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x8055467	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x8055467	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x8055467	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x8055467	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x805546a	1	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x8057f70	24	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x8058809	724	FUNC	<unknown>	HIDDEN	2
__register_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x805ff48	24	OBJECT	<unknown>	DEFAULT	10
__restore	.symtab	0x80556a3	0	NOTYPE	<unknown>	DEFAULT	2
__restore_rt	.symtab	0x805569c	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x806642c	4	OBJECT	<unknown>	HIDDEN	11
__searchdomain	.symtab	0x8067a58	16	OBJECT	<unknown>	HIDDEN	11
__searchdomains	.symtab	0x8067a78	4	OBJECT	<unknown>	HIDDEN	11
__sigaddset	.symtab	0x805805c	32	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x805807c	32	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x8058038	36	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x80557bc	50	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x805fcd4	4	OBJECT	<unknown>	DEFAULT	10
__stdio_READ	.symtab	0x8058268	79	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x8055d00	128	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x80582b8	164	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x8055d80	234	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x8050867	23	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4160	.symtab	0x805cb18	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x805835c	40	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x80583f4	51	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x8058384	110	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x8055e6c	167	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x8050908	43	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x805fcd8	4	OBJECT	<unknown>	DEFAULT	10
__syscall_error	.symtab	0x80580e8	21	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x80557f0	59	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x8055428	63	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x805549f	64	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x80554df	443	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x805ff18	4	OBJECT	<unknown>	HIDDEN	10
__vfork	.symtab	0x8055788	21	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x8051c84	182	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x80509bc	54	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x805809c	18	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x8067b00	4	OBJECT	<unknown>	DEFAULT	11
_dl_phnum	.symtab	0x8067b04	4	OBJECT	<unknown>	DEFAULT	11
_edata	.symtab	0x805ff60	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x8067b08	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x8066434	4	OBJECT	<unknown>	DEFAULT	11
_exit	.symtab	0x805582c	40	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x8058c84	3	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x8064400	8192	OBJECT	<unknown>	DEFAULT	11
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x80509f2	106	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x805607c	1449	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x8066438	4	OBJECT	<unknown>	DEFAULT	11
_init	.symtab	0x8048094	3	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x8055f14	86	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x8051014	111	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x8051205	975	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x8051084	66	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x80510c8	273	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x80511dc	41	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x805546a	1	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x805546a	1	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x8067a80	128	OBJECT	<unknown>	HIDDEN	11
_start	.symtab	0x8048168	34	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x80505c0	579	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x8050804	99	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x805fcdc	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_add_lock	.symtab	0x805fce0	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_dec_use	.symtab	0x8051780	228	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x80643e0	4	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_del_lock	.symtab	0x805fcf8	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_use_count	.symtab	0x80643dc	4	OBJECT	<unknown>	DEFAULT	11
_stdio_streams	.symtab	0x805fd20	240	OBJECT	<unknown>	DEFAULT	10
_stdio_term	.symtab	0x805087e	136	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x805fd10	4	OBJECT	<unknown>	DEFAULT	10
_stdlib_strto_l	.symtab	0x8054f2c	289	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x8055f6c	61	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x805cbe0	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x8055fac	207	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x8050a5c	1464	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x8054914	273	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
accept	.symtab	0x8053828	43	FUNC	<unknown>	DEFAULT	2
accept.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
actualparent	.symtab	0x8066594	4	OBJECT	<unknown>	DEFAULT	11
advance_telstate	.symtab	0x804c17e	81	FUNC	<unknown>	DEFAULT	2
advances	.symtab	0x805fad0	28	OBJECT	<unknown>	DEFAULT	10
advances2	.symtab	0x805fb60	44	OBJECT	<unknown>	DEFAULT	10
ak47scan	.symtab	0x804d5d8	182	FUNC	<unknown>	DEFAULT	2
ak47scantoggle	.symtab	0x804d68e	450	FUNC	<unknown>	DEFAULT	2
ak47telscan	.symtab	0x804c21d	5051	FUNC	<unknown>	DEFAULT	2
append	.symtab	0x804df29	51	FUNC	<unknown>	DEFAULT	2
asprintf	.symtab	0x80501a4	30	FUNC	<unknown>	DEFAULT	2
asprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x8054ee0	20	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x8054ee0	20	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x8051d3c	21	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x8066414	1	OBJECT	<unknown>	DEFAULT	11
been_there_done_that.3001	.symtab	0x8066430	1	OBJECT	<unknown>	DEFAULT	11
bind	.symtab	0x8053854	43	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
blacknurse	.symtab	0x80493e5	636	FUNC	<unknown>	DEFAULT	2
botkill	.symtab	0x804d850	120	FUNC	<unknown>	DEFAULT	2
brk	.symtab	0x80580b0	54	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x8057f88	175	FUNC	<unknown>	DEFAULT	2
buf.2827	.symtab	0x8066404	16	OBJECT	<unknown>	DEFAULT	11
c	.symtab	0x805fb9c	4	OBJECT	<unknown>	DEFAULT	10
capsaicin2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chan	.symtab	0x80676d0	4	OBJECT	<unknown>	DEFAULT	11
changeservers	.symtab	0x805ff84	4	OBJECT	<unknown>	DEFAULT	11
chdir	.symtab	0x804fba0	46	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x8055854	50	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x804fbd0	46	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.2429	.symtab	0x805ff60	1	OBJECT	<unknown>	DEFAULT	11
con	.symtab	0x804ef0e	701	FUNC	<unknown>	DEFAULT	2
connect	.symtab	0x8053880	43	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
contains_fail	.symtab	0x804bfc1	27	FUNC	<unknown>	DEFAULT	2
contains_response	.symtab	0x804bfdc	57	FUNC	<unknown>	DEFAULT	2
contains_string	.symtab	0x804bf32	116	FUNC	<unknown>	DEFAULT	2
contains_success	.symtab	0x804bfa6	27	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x8055a87	25	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x8048196	104	FUNC	<unknown>	DEFAULT	2
data_start	.symtab	0x805f228	0	NOTYPE	<unknown>	DEFAULT	10
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
disable	.symtab	0x8049016	296	FUNC	<unknown>	DEFAULT	2
disabled	.symtab	0x805ff88	1	OBJECT	<unknown>	DEFAULT	11
dispass	.symtab	0x8066480	256	OBJECT	<unknown>	DEFAULT	11
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dns	.symtab	0x804b22e	603	FUNC	<unknown>	DEFAULT	2
dns_format	.symtab	0x804ab5e	169	FUNC	<unknown>	DEFAULT	2
dns_hdr_create	.symtab	0x804ac07	104	FUNC	<unknown>	DEFAULT	2
dns_send	.symtab	0x804ac6f	1025	FUNC	<unknown>	DEFAULT	2
dnsflood	.symtab	0x804b070	446	FUNC	<unknown>	DEFAULT	2
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
download	.symtab	0x8048955	1110	FUNC	<unknown>	DEFAULT	2
dup2	.symtab	0x8055888	50	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
enable	.symtab	0x804913e	233	FUNC	<unknown>	DEFAULT	2
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
endservent	.symtab	0x8056af3	92	FUNC	<unknown>	DEFAULT	2
environ	.symtab	0x8066420	4	OBJECT	<unknown>	DEFAULT	11
errno	.symtab	0x8066434	4	OBJECT	<unknown>	DEFAULT	11
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execfile	.symtab	0x80665a0	256	OBJECT	<unknown>	DEFAULT	11
execl	.symtab	0x80550b8	105	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x80558bc	54	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x8055050	103	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x805e0e0	156	OBJECT	<unknown>	DEFAULT	4
fails	.symtab	0x805fb00	36	OBJECT	<unknown>	DEFAULT	10
fastflux	.symtab	0x804e0e4	464	FUNC	<unknown>	DEFAULT	2
fclose	.symtab	0x804ff90	271	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x804fb08	87	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x804fb60	63	FUNC	<unknown>	DEFAULT	2
fdopen	.symtab	0x8055ccc	50	FUNC	<unknown>	DEFAULT	2
fdopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
feof	.symtab	0x80515d4	84	FUNC	<unknown>	DEFAULT	2
feof.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fflush_unlocked	.symtab	0x8051864	333	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x8056628	220	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x8051628	98	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x80519b4	105	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
filter	.symtab	0x8048460	116	FUNC	<unknown>	DEFAULT	2
flooders	.symtab	0x805fbc0	176	OBJECT	<unknown>	DEFAULT	10
fmt	.symtab	0x805e0b0	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x80500a0	24	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x804fc00	38	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fprintf	.symtab	0x8050184	30	FUNC	<unknown>	DEFAULT	2
fprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputc	.symtab	0x805168c	146	FUNC	<unknown>	DEFAULT	2
fputc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputc_unlocked	.symtab	0x8051a20	187	FUNC	<unknown>	DEFAULT	2
fputc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs	.symtab	0x8051720	95	FUNC	<unknown>	DEFAULT	2
fputs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x8051adc	49	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8048110	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x8054755	412	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
freeaddrinfo	.symtab	0x8052918	35	FUNC	<unknown>	DEFAULT	2
fseek	.symtab	0x8058100	27	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x8058100	27	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x8058180	231	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x8051b10	120	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gaih	.symtab	0x805d73c	24	OBJECT	<unknown>	DEFAULT	4
gaih_inet	.symtab	0x8051f7f	2457	FUNC	<unknown>	DEFAULT	2
gaih_inet_serv	.symtab	0x8051eec	147	FUNC	<unknown>	DEFAULT	2
gaih_inet_typeproto	.symtab	0x805d760	35	OBJECT	<unknown>	DEFAULT	4
get	.symtab	0x8048dab	267	FUNC	<unknown>	DEFAULT	2
getBuild	.symtab	0x804818c	10	FUNC	<unknown>	DEFAULT	2
getDatIP	.symtab	0x804b9dd	1074	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x8049e0c	55	FUNC	<unknown>	DEFAULT	2
getPublicIP	.symtab	0x804e007	133	FUNC	<unknown>	DEFAULT	2
get_hosts_byaddr_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_telstate_host	.symtab	0x804c162	28	FUNC	<unknown>	DEFAULT	2
getaddrinfo	.symtab	0x805293b	651	FUNC	<unknown>	DEFAULT	2
getaddrinfo.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x8056628	220	FUNC	<unknown>	DEFAULT	2
getcwd	.symtab	0x804fc28	184	FUNC	<unknown>	DEFAULT	2
getcwd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x804fce0	37	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x80558f4	38	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x805591c	38	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x8055944	38	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyaddr_r	.symtab	0x80534b8	878	FUNC	<unknown>	DEFAULT	2
gethostbyaddr_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x8053188	815	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x8057c14	818	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getmyip	.symtab	0x804e08c	88	FUNC	<unknown>	DEFAULT	2
getpagesize	.symtab	0x804fd08	17	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x804fd1c	38	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x804fd44	38	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x804fd6c	50	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getservbyname	.symtab	0x8056d86	52	FUNC	<unknown>	DEFAULT	2
getservbyname_r	.symtab	0x8056ca6	224	FUNC	<unknown>	DEFAULT	2
getservbyport	.symtab	0x8056c72	52	FUNC	<unknown>	DEFAULT	2
getservbyport_r	.symtab	0x8056bc2	176	FUNC	<unknown>	DEFAULT	2
getservent	.symtab	0x8056ac9	42	FUNC	<unknown>	DEFAULT	2
getservent_r	.symtab	0x80568f6	467	FUNC	<unknown>	DEFAULT	2
getservice.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x80538ac	59	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x805596c	38	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x8066438	4	OBJECT	<unknown>	DEFAULT	11
head	.symtab	0x80676c0	4	OBJECT	<unknown>	DEFAULT	11
help	.symtab	0x804d952	1179	FUNC	<unknown>	DEFAULT	2
histClear	.symtab	0x804dfe0	39	FUNC	<unknown>	DEFAULT	2
hold	.symtab	0x804aa9e	192	FUNC	<unknown>	DEFAULT	2
host2ip	.symtab	0x8049227	143	FUNC	<unknown>	DEFAULT	2
htonl	.symtab	0x8051ed1	7	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x8051ec4	13	FUNC	<unknown>	DEFAULT	2
i.5507	.symtab	0x80603a0	4	OBJECT	<unknown>	DEFAULT	11
i.5549	.symtab	0x805fba0	4	OBJECT	<unknown>	DEFAULT	10
ident	.symtab	0x8066584	4	OBJECT	<unknown>	DEFAULT	11
identd	.symtab	0x804856c	648	FUNC	<unknown>	DEFAULT	2
if_freenameindex	.symtab	0x8057046	52	FUNC	<unknown>	DEFAULT	2
if_index.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
if_indextoname	.symtab	0x8056dbc	123	FUNC	<unknown>	DEFAULT	2
if_nameindex	.symtab	0x8056eac	410	FUNC	<unknown>	DEFAULT	2
if_nametoindex	.symtab	0x8056e37	117	FUNC	<unknown>	DEFAULT	2
in6_addr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
in6addr_any	.symtab	0x805d7a8	16	OBJECT	<unknown>	DEFAULT	4
in6addr_loopback	.symtab	0x805d7b8	16	OBJECT	<unknown>	DEFAULT	4
in_cksum	.symtab	0x8048838	124	FUNC	<unknown>	DEFAULT	2
index	.symtab	0x8056750	30	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x8053160	37	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x805707c	148	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x805314b	21	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x80530fc	79	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x8052f29	465	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x8052e18	273	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x8052c4e	458	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x8052bc8	134	FUNC	<unknown>	DEFAULT	2
infected	.symtab	0x805fb94	8	OBJECT	<unknown>	DEFAULT	10
init_rand	.symtab	0x80492b6	111	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x8054ad5	87	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x8054d01	171	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x804fda0	63	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x8051e34	29	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ismaster	.symtab	0x804df5c	132	FUNC	<unknown>	DEFAULT	2
junk	.symtab	0x804a5e4	192	FUNC	<unknown>	DEFAULT	2
key	.symtab	0x80676c8	4	OBJECT	<unknown>	DEFAULT	11
kill	.symtab	0x804fde0	50	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killall	.symtab	0x804dded	206	FUNC	<unknown>	DEFAULT	2
killd	.symtab	0x804debb	110	FUNC	<unknown>	DEFAULT	2
knownBots	.symtab	0x805f260	776	OBJECT	<unknown>	DEFAULT	10
legit	.symtab	0x805fb8c	8	OBJECT	<unknown>	DEFAULT	10
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/mmap.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
limiter	.symtab	0x8066588	4	OBJECT	<unknown>	DEFAULT	11
listFork	.symtab	0x8049a10	169	FUNC	<unknown>	DEFAULT	2
listen	.symtab	0x80538e8	35	FUNC	<unknown>	DEFAULT	2
listen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x8058ae0	86	FUNC	<unknown>	DEFAULT	2
main	.symtab	0x804f2aa	2141	FUNC	<unknown>	DEFAULT	2
makeFukdString	.symtab	0x804f1cb	144	FUNC	<unknown>	DEFAULT	2
makeRandomShit	.symtab	0x8049661	133	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x8053a46	1954	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x80548f1	34	FUNC	<unknown>	DEFAULT	2
masters	.symtab	0x805f250	12	OBJECT	<unknown>	DEFAULT	10
memchr	.symtab	0x8056704	35	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x8051b88	39	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x8056728	39	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x8056770	33	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x8056794	176	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x8051bb0	21	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mfork	.symtab	0x8048383	221	FUNC	<unknown>	DEFAULT	2
mmap	.symtab	0x80557a0	27	FUNC	<unknown>	DEFAULT	2
move	.symtab	0x804d8f4	94	FUNC	<unknown>	DEFAULT	2
mremap	.symtab	0x8055994	63	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
msgs	.symtab	0x805fc80	64	OBJECT	<unknown>	DEFAULT	10
munmap	.symtab	0x80559d4	50	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mygethostbyname	.symtab	0x80488b4	161	FUNC	<unknown>	DEFAULT	2
mylock	.symtab	0x80643c0	24	OBJECT	<unknown>	DEFAULT	11
mylock	.symtab	0x805fe28	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x805fe40	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x805ff2c	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x8066458	24	OBJECT	<unknown>	DEFAULT	11
nanosleep	.symtab	0x8055a08	50	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
negotiate	.symtab	0x804be0f	291	FUNC	<unknown>	DEFAULT	2
next_start.1278	.symtab	0x8066400	4	OBJECT	<unknown>	DEFAULT	11
nick	.symtab	0x806658c	4	OBJECT	<unknown>	DEFAULT	11
nickc	.symtab	0x8048ed8	153	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x8051ee5	7	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x8051ed8	13	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
nummasters	.symtab	0x805f24c	4	OBJECT	<unknown>	DEFAULT	10
numpids	.symtab	0x805ff94	4	OBJECT	<unknown>	DEFAULT	11
numservers	.symtab	0x805f240	4	OBJECT	<unknown>	DEFAULT	10
object.2482	.symtab	0x805ff64	24	OBJECT	<unknown>	DEFAULT	11
open	.symtab	0x8055a3c	75	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opensock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
p.2427	.symtab	0x805f224	0	OBJECT	<unknown>	DEFAULT	10
passwords	.symtab	0x805f880	592	OBJECT	<unknown>	DEFAULT	10
pclose	.symtab	0x8050308	190	FUNC	<unknown>	DEFAULT	2
perror	.symtab	0x80500b8	50	FUNC	<unknown>	DEFAULT	2
perror.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pid	.symtab	0x8066580	4	OBJECT	<unknown>	DEFAULT	11
pids	.symtab	0x80676d4	4	OBJECT	<unknown>	DEFAULT	11
pipe	.symtab	0x8055aa0	46	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
poll	.symtab	0x804fe14	54	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
popen	.symtab	0x80503c6	506	FUNC	<unknown>	DEFAULT	2
popen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
popen_list	.symtab	0x80643d8	4	OBJECT	<unknown>	DEFAULT	11
poww	.symtab	0x80487f4	68	FUNC	<unknown>	DEFAULT	2
pps	.symtab	0x80666a0	4	OBJECT	<unknown>	DEFAULT	11
prefix.4371	.symtab	0x805cb3d	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x804b6e4	722	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x804b489	66	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x804b5a5	319	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x804b4cb	218	FUNC	<unknown>	DEFAULT	2
putc	.symtab	0x805168c	146	FUNC	<unknown>	DEFAULT	2
putc_unlocked	.symtab	0x8051a20	187	FUNC	<unknown>	DEFAULT	2
puts	.symtab	0x80500ec	124	FUNC	<unknown>	DEFAULT	2
puts.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
qual_chars.4377	.symtab	0x805cb50	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x8057f70	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x8054a28	5	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x8049325	192	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x8054a30	72	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x805d800	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x8054c09	94	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randstring	.symtab	0x80484d4	152	FUNC	<unknown>	DEFAULT	2
randtbl	.symtab	0x805fe80	128	OBJECT	<unknown>	DEFAULT	10
rawmemchr	.symtab	0x8058478	99	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x8058b38	54	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_until_response	.symtab	0x804c0d7	139	FUNC	<unknown>	DEFAULT	2
read_with_timeout	.symtab	0x804c015	194	FUNC	<unknown>	DEFAULT	2
realloc	.symtab	0x80541e8	822	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realrand	.symtab	0x8048f71	73	FUNC	<unknown>	DEFAULT	2
recv	.symtab	0x805390c	51	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rekdevice	.symtab	0x805f25c	4	OBJECT	<unknown>	DEFAULT	10
reset_telstate	.symtab	0x804c1cf	34	FUNC	<unknown>	DEFAULT	2
rewind	.symtab	0x805811c	98	FUNC	<unknown>	DEFAULT	2
rewind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rnd	.symtab	0x80676cc	4	OBJECT	<unknown>	DEFAULT	11
rndnick	.symtab	0x8048fba	92	FUNC	<unknown>	DEFAULT	2
rseed	.symtab	0x80666c0	4096	OBJECT	<unknown>	DEFAULT	11
rsi	.symtab	0x8066598	4	OBJECT	<unknown>	DEFAULT	11
sbrk	.symtab	0x8055ad0	78	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x805ff80	4	OBJECT	<unknown>	DEFAULT	11
sclose	.symtab	0x804c1f1	44	FUNC	<unknown>	DEFAULT	2
select	.symtab	0x804fe4c	63	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x8053940	51	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendHOLD	.symtab	0x804a6a4	1018	FUNC	<unknown>	DEFAULT	2
sendHTTP	.symtab	0x8049f11	454	FUNC	<unknown>	DEFAULT	2
sendJUNK	.symtab	0x804a1e8	1020	FUNC	<unknown>	DEFAULT	2
sendSTD	.symtab	0x8049ab9	851	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x8053974	67	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
serv	.symtab	0x8066444	16	OBJECT	<unknown>	DEFAULT	11
serv_stayopen	.symtab	0x8066454	1	OBJECT	<unknown>	DEFAULT	11
servbuf	.symtab	0x806643c	4	OBJECT	<unknown>	DEFAULT	11
server	.symtab	0x80666a4	4	OBJECT	<unknown>	DEFAULT	11
servers	.symtab	0x805f244	8	OBJECT	<unknown>	DEFAULT	10
servf	.symtab	0x8066440	4	OBJECT	<unknown>	DEFAULT	11
setservent	.symtab	0x8056b4f	115	FUNC	<unknown>	DEFAULT	2
setsid	.symtab	0x804fe8c	38	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x80539b8	59	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x8054a78	93	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x8054b70	153	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x80556ab	218	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x8057f88	175	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x8055b20	85	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x8055124	393	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleeptime	.symtab	0x805fba4	4	OBJECT	<unknown>	DEFAULT	10
sock	.symtab	0x8066590	4	OBJECT	<unknown>	DEFAULT	11
socket	.symtab	0x80539f4	43	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x8049e43	206	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4376	.symtab	0x805cb64	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4370	.symtab	0x805cb49	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4373	.symtab	0x805cb8d	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4372	.symtab	0x805cba2	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4375	.symtab	0x805cb74	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4374	.symtab	0x805cb84	9	OBJECT	<unknown>	DEFAULT	4
spoofs	.symtab	0x805ff8c	4	OBJECT	<unknown>	DEFAULT	11
spoofsm	.symtab	0x805ff90	4	OBJECT	<unknown>	DEFAULT	11
sprintf	.symtab	0x80501c4	31	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x8054b2c	67	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x8054b2c	67	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x8054c67	154	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x805ff44	2	OBJECT	<unknown>	DEFAULT	10
static_ns	.symtab	0x8066470	4	OBJECT	<unknown>	DEFAULT	11
stderr	.symtab	0x805fcd0	4	OBJECT	<unknown>	DEFAULT	10
stdin	.symtab	0x805fcc8	4	OBJECT	<unknown>	DEFAULT	10
stdout	.symtab	0x805fccc	4	OBJECT	<unknown>	DEFAULT	10
strcasecmp	.symtab	0x8051d54	54	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcasestr	.symtab	0x8051d8c	83	FUNC	<unknown>	DEFAULT	2
strcasestr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x8056750	30	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x8058428	29	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x8058428	29	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x8051bc8	27	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x8051de0	54	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x8051c84	182	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x8051be4	19	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncat	.symtab	0x8058448	46	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncmp	.symtab	0x8051bf8	37	FUNC	<unknown>	DEFAULT	2
strncmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x8051c20	38	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x8051c48	25	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x80568a0	39	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x80584dc	50	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x8051e18	25	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x8056844	89	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x8054ef4	26	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoul	.symtab	0x8054f10	26	FUNC	<unknown>	DEFAULT	2
strtoul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strwildmatch	.symtab	0x80481fe	295	FUNC	<unknown>	DEFAULT	2
successes	.symtab	0x805fb40	32	OBJECT	<unknown>	DEFAULT	10
sysconf	.symtab	0x80552b0	325	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
system	.symtab	0x8054dac	305	FUNC	<unknown>	DEFAULT	2
system.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x804b9b6	39	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x8051e54	112	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tehport	.symtab	0x80676c4	4	OBJECT	<unknown>	DEFAULT	11
textBuffer.5000	.symtab	0x805ffa0	1024	OBJECT	<unknown>	DEFAULT	11
thanks	.symtab	0x805fba8	4	OBJECT	<unknown>	DEFAULT	10
time	.symtab	0x804feb4	46	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x8055bb4	29	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
touchMyself	.symtab	0x804f25b	79	FUNC	<unknown>	DEFAULT	2
toupper	.symtab	0x804ff68	29	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
type_codes	.symtab	0x805cbaa	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x805cbc2	12	OBJECT	<unknown>	DEFAULT	4
umask	.symtab	0x804fee4	48	FUNC	<unknown>	DEFAULT	2
umask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown	.symtab	0x80496e6	810	FUNC	<unknown>	DEFAULT	2
unknown.1330	.symtab	0x805cbce	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x805fe58	28	OBJECT	<unknown>	DEFAULT	10
user	.symtab	0x806659c	4	OBJECT	<unknown>	DEFAULT	11
usernames	.symtab	0x805f620	592	OBJECT	<unknown>	DEFAULT	10
usleep	.symtab	0x80553f8	48	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vasprintf	.symtab	0x80501e4	115	FUNC	<unknown>	DEFAULT	2
vasprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
version	.symtab	0x8048eb6	34	FUNC	<unknown>	DEFAULT	2
vfork	.symtab	0x8055788	21	FUNC	<unknown>	DEFAULT	2
vfprintf	.symtab	0x8050934	136	FUNC	<unknown>	DEFAULT	2
vfprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vsnprintf	.symtab	0x8050258	176	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vsprintf	.symtab	0x8050168	26	FUNC	<unknown>	DEFAULT	2
vsprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x8055b78	59	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x804ff14	26	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x8055bdc	69	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x8055c44	133	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x8055c24	30	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x804ff30	54	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3285	.symtab	0x805d797	17	OBJECT	<unknown>	DEFAULT	4

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 12:46:47.988398075 CET	59558	53	192.168.2.13	1.1.1.1
Dec 28, 2024 12:46:48.764683962 CET	53	59558	1.1.1.1	192.168.2.13
Dec 28, 2024 12:46:49.059799910 CET	38068	53	192.168.2.13	1.1.1.1
Dec 28, 2024 12:46:49.059843063 CET	39304	53	192.168.2.13	1.1.1.1
Dec 28, 2024 12:46:49.198599100 CET	53	39304	1.1.1.1	192.168.2.13
Dec 28, 2024 12:46:49.279371977 CET	53	38068	1.1.1.1	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 28, 2024 12:46:47.988398075 CET	192.168.2.13	1.1.1.1	0x6d4	Standard query (0)	pirati.privatedns.org	A (IP address)	IN (0x0001)	false
Dec 28, 2024 12:46:49.059799910 CET	192.168.2.13	1.1.1.1	0x511f	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 12:46:49.059843063 CET	192.168.2.13	1.1.1.1	0x4da3	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 28, 2024 12:46:48.764683962 CET	1.1.1.1	192.168.2.13	0x6d4	No error (0)	pirati.privatedns.org	212.171.15.94	A (IP address)	IN (0x0001)	false
Dec 28, 2024 12:46:49.279371977 CET	1.1.1.1	192.168.2.13	0x511f	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Dec 28, 2024 12:46:49.279371977 CET	1.1.1.1	192.168.2.13	0x511f	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: yakuza.i686.elf PID: 5431, Parent PID: 5357

General

Start time (UTC):	11:46:46
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	/tmp/yakuza.i686.elf
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Chronological Activities

Analysis Process: yakuza.i686.elf PID: 5432, Parent PID: 5431

General

Start time (UTC):	11:46:46
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Chronological Activities

Analysis Process: yakuza.i686.elf PID: 5433, Parent PID: 5432

General

Start time (UTC):	11:46:46
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: yakuza.i686.elf PID: 5434, Parent PID: 5432

General

Start time (UTC):	11:46:46
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Chronological Activities

Analysis Process: yakuza.i686.elf PID: 5435, Parent PID: 5432

General

Start time (UTC):	11:46:46
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Chronological Activities

Analysis Process: sh PID: 5435, Parent PID: 5432

General

Start time (UTC):	11:46:46
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 902i13 \|\| busybox pkill -9 902i13"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5437, Parent PID: 5435

General

Start time (UTC):	11:46:46
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5437, Parent PID: 5435

General

Start time (UTC):	11:46:46
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 902i13
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5467, Parent PID: 5435

General

Start time (UTC):	11:46:49
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5467, Parent PID: 5435

General

Start time (UTC):	11:46:49
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 902i13
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i686.elf PID: 5468, Parent PID: 5432

General

Start time (UTC):	11:46:51
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Chronological Activities

Analysis Process: sh PID: 5468, Parent PID: 5432

General

Start time (UTC):	11:46:51
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 BzSxLxBxeY \|\| busybox pkill -9 BzSxLxBxeY"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5469, Parent PID: 5468

General

Start time (UTC):	11:46:51
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5469, Parent PID: 5468

General

Start time (UTC):	11:46:51
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 BzSxLxBxeY
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5470, Parent PID: 5468

General

Start time (UTC):	11:46:52
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5470, Parent PID: 5468

General

Start time (UTC):	11:46:52
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 BzSxLxBxeY
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i686.elf PID: 5473, Parent PID: 5432

General

Start time (UTC):	11:46:53
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Chronological Activities

Analysis Process: sh PID: 5473, Parent PID: 5432

General

Start time (UTC):	11:46:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 HOHO-LUGO7 \|\| busybox pkill -9 HOHO-LUGO7"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5474, Parent PID: 5473

General

Start time (UTC):	11:46:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5474, Parent PID: 5473

General

Start time (UTC):	11:46:53
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 HOHO-LUGO7
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5475, Parent PID: 5473

General

Start time (UTC):	11:46:54
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5475, Parent PID: 5473

General

Start time (UTC):	11:46:54
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 HOHO-LUGO7
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i686.elf PID: 5476, Parent PID: 5432

General

Start time (UTC):	11:46:55
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Chronological Activities

Analysis Process: sh PID: 5476, Parent PID: 5432

General

Start time (UTC):	11:46:55
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 HOHO-U79OL \|\| busybox pkill -9 HOHO-U79OL"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5477, Parent PID: 5476

General

Start time (UTC):	11:46:55
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5477, Parent PID: 5476

General

Start time (UTC):	11:46:55
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 HOHO-U79OL
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5478, Parent PID: 5476

General

Start time (UTC):	11:46:56
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5478, Parent PID: 5476

General

Start time (UTC):	11:46:56
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 HOHO-U79OL
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i686.elf PID: 5479, Parent PID: 5432

General

Start time (UTC):	11:46:57
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Chronological Activities

Analysis Process: sh PID: 5479, Parent PID: 5432

General

Start time (UTC):	11:46:57
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 JuYfouyf87 \|\| busybox pkill -9 JuYfouyf87"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5480, Parent PID: 5479

General

Start time (UTC):	11:46:57
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5480, Parent PID: 5479

General

Start time (UTC):	11:46:57
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 JuYfouyf87
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5483, Parent PID: 5479

General

Start time (UTC):	11:46:58
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5483, Parent PID: 5479

General

Start time (UTC):	11:46:58
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 JuYfouyf87
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i686.elf PID: 5484, Parent PID: 5432

General

Start time (UTC):	11:46:59
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Chronological Activities

Analysis Process: sh PID: 5484, Parent PID: 5432

General

Start time (UTC):	11:46:59
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5485, Parent PID: 5484

General

Start time (UTC):	11:46:59
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5485, Parent PID: 5484

General

Start time (UTC):	11:46:59
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeR69xd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5492, Parent PID: 5484

General

Start time (UTC):	11:47:00
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5492, Parent PID: 5484

General

Start time (UTC):	11:47:00
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeR69xd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i686.elf PID: 5493, Parent PID: 5432

General

Start time (UTC):	11:47:01
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Chronological Activities

Analysis Process: sh PID: 5493, Parent PID: 5432

General

Start time (UTC):	11:47:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5494, Parent PID: 5493

General

Start time (UTC):	11:47:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5494, Parent PID: 5493

General

Start time (UTC):	11:47:01
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SO190Ij1X
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5495, Parent PID: 5493

General

Start time (UTC):	11:47:02
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5495, Parent PID: 5493

General

Start time (UTC):	11:47:02
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SO190Ij1X
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i686.elf PID: 5498, Parent PID: 5432

General

Start time (UTC):	11:47:03
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Chronological Activities

Analysis Process: sh PID: 5498, Parent PID: 5432

General

Start time (UTC):	11:47:03
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 LOLKIKEEEDDE \|\| busybox pkill -9 LOLKIKEEEDDE"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5499, Parent PID: 5498

General

Start time (UTC):	11:47:03
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5499, Parent PID: 5498

General

Start time (UTC):	11:47:03
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 LOLKIKEEEDDE
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5500, Parent PID: 5498

General

Start time (UTC):	11:47:04
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5500, Parent PID: 5498

General

Start time (UTC):	11:47:04
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 LOLKIKEEEDDE
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i686.elf PID: 5501, Parent PID: 5432

General

Start time (UTC):	11:47:05
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Chronological Activities

Analysis Process: sh PID: 5501, Parent PID: 5432

General

Start time (UTC):	11:47:06
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ekjheory98e \|\| busybox pkill -9 ekjheory98e"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5502, Parent PID: 5501

General

Start time (UTC):	11:47:06
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5502, Parent PID: 5501

General

Start time (UTC):	11:47:06
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ekjheory98e
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5503, Parent PID: 5501

General

Start time (UTC):	11:47:07
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5503, Parent PID: 5501

General

Start time (UTC):	11:47:07
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ekjheory98e
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i686.elf PID: 5526, Parent PID: 5432

General

Start time (UTC):	11:47:08
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Chronological Activities

Analysis Process: sh PID: 5526, Parent PID: 5432

General

Start time (UTC):	11:47:08
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scansh4 \|\| busybox pkill -9 scansh4"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5527, Parent PID: 5526

General

Start time (UTC):	11:47:08
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5527, Parent PID: 5526

General

Start time (UTC):	11:47:08
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 scansh4
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5528, Parent PID: 5526

General

Start time (UTC):	11:47:09
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5528, Parent PID: 5526

General

Start time (UTC):	11:47:09
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scansh4
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i686.elf PID: 5529, Parent PID: 5432

General

Start time (UTC):	11:47:10
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Chronological Activities

Analysis Process: sh PID: 5529, Parent PID: 5432

General

Start time (UTC):	11:47:10
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MDMA \|\| busybox pkill -9 MDMA"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5530, Parent PID: 5529

General

Start time (UTC):	11:47:10
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5530, Parent PID: 5529

General

Start time (UTC):	11:47:10
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MDMA
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5531, Parent PID: 5529

General

Start time (UTC):	11:47:11
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5531, Parent PID: 5529

General

Start time (UTC):	11:47:11
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MDMA
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i686.elf PID: 5534, Parent PID: 5432

General

Start time (UTC):	11:47:12
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Chronological Activities

Analysis Process: sh PID: 5534, Parent PID: 5432

General

Start time (UTC):	11:47:12
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 fdevalvex \|\| busybox pkill -9 fdevalvex"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5535, Parent PID: 5534

General

Start time (UTC):	11:47:12
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5535, Parent PID: 5534

General

Start time (UTC):	11:47:12
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 fdevalvex
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5537, Parent PID: 5534

General

Start time (UTC):	11:47:14
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5537, Parent PID: 5534

General

Start time (UTC):	11:47:14
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 fdevalvex
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i686.elf PID: 5538, Parent PID: 5432

General

Start time (UTC):	11:47:15
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Chronological Activities

Analysis Process: sh PID: 5538, Parent PID: 5432

General

Start time (UTC):	11:47:15
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scanspc \|\| busybox pkill -9 scanspc"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5539, Parent PID: 5538

General

Start time (UTC):	11:47:15
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5539, Parent PID: 5538

General

Start time (UTC):	11:47:15
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 scanspc
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5540, Parent PID: 5538

General

Start time (UTC):	11:47:16
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5540, Parent PID: 5538

General

Start time (UTC):	11:47:16
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scanspc
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i686.elf PID: 5541, Parent PID: 5432

General

Start time (UTC):	11:47:17
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Chronological Activities

Analysis Process: sh PID: 5541, Parent PID: 5432

General

Start time (UTC):	11:47:17
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MELTEDNINJAREALZ \|\| busybox pkill -9 MELTEDNINJAREALZ"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5542, Parent PID: 5541

General

Start time (UTC):	11:47:17
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5542, Parent PID: 5541

General

Start time (UTC):	11:47:17
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MELTEDNINJAREALZ
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5545, Parent PID: 5541

General

Start time (UTC):	11:47:18
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5545, Parent PID: 5541

General

Start time (UTC):	11:47:18
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MELTEDNINJAREALZ
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i686.elf PID: 5546, Parent PID: 5432

General

Start time (UTC):	11:47:19
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Chronological Activities

Analysis Process: sh PID: 5546, Parent PID: 5432

General

Start time (UTC):	11:47:19
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 flexsonskids \|\| busybox pkill -9 flexsonskids"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5547, Parent PID: 5546

General

Start time (UTC):	11:47:19
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5547, Parent PID: 5546

General

Start time (UTC):	11:47:19
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 flexsonskids
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5548, Parent PID: 5546

General

Start time (UTC):	11:47:20
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5548, Parent PID: 5546

General

Start time (UTC):	11:47:20
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 flexsonskids
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5549, Parent PID: 5432

General

Start time (UTC):	11:47:21
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5549, Parent PID: 5432

General

Start time (UTC):	11:47:21
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scanx86 \|\| busybox pkill -9 scanx86"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5550, Parent PID: 5549

General

Start time (UTC):	11:47:21
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5550, Parent PID: 5549

General

Start time (UTC):	11:47:21
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 scanx86
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5551, Parent PID: 5549

General

Start time (UTC):	11:47:22
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5551, Parent PID: 5549

General

Start time (UTC):	11:47:22
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scanx86
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5554, Parent PID: 5432

General

Start time (UTC):	11:47:23
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5554, Parent PID: 5432

General

Start time (UTC):	11:47:23
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MISAKI-U79OL \|\| busybox pkill -9 MISAKI-U79OL"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5555, Parent PID: 5554

General

Start time (UTC):	11:47:23
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5555, Parent PID: 5554

General

Start time (UTC):	11:47:23
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MISAKI-U79OL
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5556, Parent PID: 5554

General

Start time (UTC):	11:47:24
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5556, Parent PID: 5554

General

Start time (UTC):	11:47:24
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MISAKI-U79OL
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5557, Parent PID: 5432

General

Start time (UTC):	11:47:25
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5557, Parent PID: 5432

General

Start time (UTC):	11:47:25
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 foAxi102kxe \|\| busybox pkill -9 foAxi102kxe"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5558, Parent PID: 5557

General

Start time (UTC):	11:47:25
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5558, Parent PID: 5557

General

Start time (UTC):	11:47:25
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 foAxi102kxe
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5559, Parent PID: 5557

General

Start time (UTC):	11:47:26
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5559, Parent PID: 5557

General

Start time (UTC):	11:47:26
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 foAxi102kxe
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5560, Parent PID: 5432

General

Start time (UTC):	11:47:27
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5560, Parent PID: 5432

General

Start time (UTC):	11:47:27
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 swodjwodjwoj \|\| busybox pkill -9 swodjwodjwoj"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5561, Parent PID: 5560

General

Start time (UTC):	11:47:27
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5561, Parent PID: 5560

General

Start time (UTC):	11:47:27
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 swodjwodjwoj
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5564, Parent PID: 5560

General

Start time (UTC):	11:47:28
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5564, Parent PID: 5560

General

Start time (UTC):	11:47:28
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 swodjwodjwoj
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5565, Parent PID: 5432

General

Start time (UTC):	11:47:29
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5565, Parent PID: 5432

General

Start time (UTC):	11:47:29
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MmKiy7f87l \|\| busybox pkill -9 MmKiy7f87l"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5566, Parent PID: 5565

General

Start time (UTC):	11:47:29
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5566, Parent PID: 5565

General

Start time (UTC):	11:47:29
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MmKiy7f87l
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5567, Parent PID: 5565

General

Start time (UTC):	11:47:30
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5567, Parent PID: 5565

General

Start time (UTC):	11:47:30
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MmKiy7f87l
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5568, Parent PID: 5432

General

Start time (UTC):	11:47:31
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5568, Parent PID: 5432

General

Start time (UTC):	11:47:31
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 freecookiex86 \|\| busybox pkill -9 freecookiex86"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5569, Parent PID: 5568

General

Start time (UTC):	11:47:31
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5569, Parent PID: 5568

General

Start time (UTC):	11:47:31
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 freecookiex86
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5572, Parent PID: 5568

General

Start time (UTC):	11:47:33
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5572, Parent PID: 5568

General

Start time (UTC):	11:47:33
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 freecookiex86
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5573, Parent PID: 5432

General

Start time (UTC):	11:47:34
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5573, Parent PID: 5432

General

Start time (UTC):	11:47:34
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 sysgpu \|\| busybox pkill -9 sysgpu"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5574, Parent PID: 5573

General

Start time (UTC):	11:47:34
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5574, Parent PID: 5573

General

Start time (UTC):	11:47:34
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 sysgpu
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5575, Parent PID: 5573

General

Start time (UTC):	11:47:35
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5575, Parent PID: 5573

General

Start time (UTC):	11:47:35
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 sysgpu
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5576, Parent PID: 5432

General

Start time (UTC):	11:47:36
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5576, Parent PID: 5432

General

Start time (UTC):	11:47:36
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5577, Parent PID: 5576

General

Start time (UTC):	11:47:36
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5577, Parent PID: 5576

General

Start time (UTC):	11:47:36
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeR69xd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5578, Parent PID: 5576

General

Start time (UTC):	11:47:37
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5578, Parent PID: 5576

General

Start time (UTC):	11:47:37
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeR69xd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5583, Parent PID: 5432

General

Start time (UTC):	11:47:38
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5583, Parent PID: 5432

General

Start time (UTC):	11:47:38
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 frgege \|\| busybox pkill -9 frgege"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5584, Parent PID: 5583

General

Start time (UTC):	11:47:38
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5584, Parent PID: 5583

General

Start time (UTC):	11:47:38
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 frgege
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5585, Parent PID: 5583

General

Start time (UTC):	11:47:39
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5585, Parent PID: 5583

General

Start time (UTC):	11:47:39
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 frgege
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5586, Parent PID: 5432

General

Start time (UTC):	11:47:40
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5586, Parent PID: 5432

General

Start time (UTC):	11:47:40
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 sysupdater \|\| busybox pkill -9 sysupdater"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5587, Parent PID: 5586

General

Start time (UTC):	11:47:40
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5587, Parent PID: 5586

General

Start time (UTC):	11:47:40
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 sysupdater
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5588, Parent PID: 5586

General

Start time (UTC):	11:47:41
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5588, Parent PID: 5586

General

Start time (UTC):	11:47:41
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 sysupdater
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5589, Parent PID: 5432

General

Start time (UTC):	11:47:42
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5589, Parent PID: 5432

General

Start time (UTC):	11:47:42
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 0DnAzepd \|\| busybox pkill -9 0DnAzepd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5590, Parent PID: 5589

General

Start time (UTC):	11:47:42
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5590, Parent PID: 5589

General

Start time (UTC):	11:47:42
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 0DnAzepd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5594, Parent PID: 5589

General

Start time (UTC):	11:47:43
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5594, Parent PID: 5589

General

Start time (UTC):	11:47:43
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 0DnAzepd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5595, Parent PID: 5432

General

Start time (UTC):	11:47:44
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5595, Parent PID: 5432

General

Start time (UTC):	11:47:44
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeRD0nks69 \|\| busybox pkill -9 NiGGeRD0nks69"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5596, Parent PID: 5595

General

Start time (UTC):	11:47:44
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5596, Parent PID: 5595

General

Start time (UTC):	11:47:44
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeRD0nks69
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5597, Parent PID: 5595

General

Start time (UTC):	11:47:46
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5597, Parent PID: 5595

General

Start time (UTC):	11:47:46
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeRD0nks69
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5598, Parent PID: 5432

General

Start time (UTC):	11:47:47
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5598, Parent PID: 5432

General

Start time (UTC):	11:47:47
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 frgreu \|\| busybox pkill -9 frgreu"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5599, Parent PID: 5598

General

Start time (UTC):	11:47:47
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5599, Parent PID: 5598

General

Start time (UTC):	11:47:47
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 frgreu
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5602, Parent PID: 5598

General

Start time (UTC):	11:47:48
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5602, Parent PID: 5598

General

Start time (UTC):	11:47:48
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 frgreu
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5603, Parent PID: 5432

General

Start time (UTC):	11:47:49
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5603, Parent PID: 5432

General

Start time (UTC):	11:47:49
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 telnetd \|\| busybox pkill -9 telnetd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5604, Parent PID: 5603

General

Start time (UTC):	11:47:49
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5604, Parent PID: 5603

General

Start time (UTC):	11:47:49
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 telnetd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5605, Parent PID: 5603

General

Start time (UTC):	11:47:50
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5605, Parent PID: 5603

General

Start time (UTC):	11:47:50
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 telnetd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5606, Parent PID: 5432

General

Start time (UTC):	11:47:51
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5606, Parent PID: 5432

General

Start time (UTC):	11:47:51
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 0x766f6964 \|\| busybox pkill -9 0x766f6964"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5607, Parent PID: 5606

General

Start time (UTC):	11:47:51
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5607, Parent PID: 5606

General

Start time (UTC):	11:47:51
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 0x766f6964
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5608, Parent PID: 5606

General

Start time (UTC):	11:47:52
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5608, Parent PID: 5606

General

Start time (UTC):	11:47:52
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 0x766f6964
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5611, Parent PID: 5432

General

Start time (UTC):	11:47:53
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5611, Parent PID: 5432

General

Start time (UTC):	11:47:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeRd0nks1337 \|\| busybox pkill -9 NiGGeRd0nks1337"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5612, Parent PID: 5611

General

Start time (UTC):	11:47:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5612, Parent PID: 5611

General

Start time (UTC):	11:47:53
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeRd0nks1337
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5613, Parent PID: 5611

General

Start time (UTC):	11:47:54
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5613, Parent PID: 5611

General

Start time (UTC):	11:47:54
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeRd0nks1337
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5614, Parent PID: 5432

General

Start time (UTC):	11:47:55
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5614, Parent PID: 5432

General

Start time (UTC):	11:47:55
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 gaft \|\| busybox pkill -9 gaft"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5615, Parent PID: 5614

General

Start time (UTC):	11:47:55
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5615, Parent PID: 5614

General

Start time (UTC):	11:47:55
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 gaft
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5616, Parent PID: 5614

General

Start time (UTC):	11:47:56
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5616, Parent PID: 5614

General

Start time (UTC):	11:47:56
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 gaft
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5619, Parent PID: 5432

General

Start time (UTC):	11:47:57
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5619, Parent PID: 5432

General

Start time (UTC):	11:47:57
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 urasgbsigboa \|\| busybox pkill -9 urasgbsigboa"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5620, Parent PID: 5619

General

Start time (UTC):	11:47:57
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5620, Parent PID: 5619

General

Start time (UTC):	11:47:57
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 urasgbsigboa
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5621, Parent PID: 5619

General

Start time (UTC):	11:47:58
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5621, Parent PID: 5619

General

Start time (UTC):	11:47:58
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 urasgbsigboa
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5622, Parent PID: 5432

General

Start time (UTC):	11:47:59
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5622, Parent PID: 5432

General

Start time (UTC):	11:47:59
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 120i3UI49 \|\| busybox pkill -9 120i3UI49"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5623, Parent PID: 5622

General

Start time (UTC):	11:47:59
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5623, Parent PID: 5622

General

Start time (UTC):	11:47:59
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 120i3UI49
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5624, Parent PID: 5622

General

Start time (UTC):	11:48:00
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5624, Parent PID: 5622

General

Start time (UTC):	11:48:00
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 120i3UI49
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5625, Parent PID: 5432

General

Start time (UTC):	11:48:01
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5625, Parent PID: 5432

General

Start time (UTC):	11:48:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 OaF3 \|\| busybox pkill -9 OaF3"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5626, Parent PID: 5625

General

Start time (UTC):	11:48:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5626, Parent PID: 5625

General

Start time (UTC):	11:48:01
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 OaF3
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5629, Parent PID: 5625

General

Start time (UTC):	11:48:03
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5629, Parent PID: 5625

General

Start time (UTC):	11:48:03
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 OaF3
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5630, Parent PID: 5432

General

Start time (UTC):	11:48:04
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5630, Parent PID: 5432

General

Start time (UTC):	11:48:04
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 geae \|\| busybox pkill -9 geae"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5631, Parent PID: 5630

General

Start time (UTC):	11:48:04
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5631, Parent PID: 5630

General

Start time (UTC):	11:48:04
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 geae
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5632, Parent PID: 5630

General

Start time (UTC):	11:48:05
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5632, Parent PID: 5630

General

Start time (UTC):	11:48:05
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 geae
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5633, Parent PID: 5432

General

Start time (UTC):	11:48:06
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5633, Parent PID: 5432

General

Start time (UTC):	11:48:06
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 vaiolmao \|\| busybox pkill -9 vaiolmao"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5634, Parent PID: 5633

General

Start time (UTC):	11:48:06
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5634, Parent PID: 5633

General

Start time (UTC):	11:48:06
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 vaiolmao
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5635, Parent PID: 5633

General

Start time (UTC):	11:48:07
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5635, Parent PID: 5633

General

Start time (UTC):	11:48:07
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 vaiolmao
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5638, Parent PID: 5432

General

Start time (UTC):	11:48:08
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5638, Parent PID: 5432

General

Start time (UTC):	11:48:08
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 123123a \|\| busybox pkill -9 123123a"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5639, Parent PID: 5638

General

Start time (UTC):	11:48:08
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5639, Parent PID: 5638

General

Start time (UTC):	11:48:08
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 123123a
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5640, Parent PID: 5638

General

Start time (UTC):	11:48:09
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5640, Parent PID: 5638

General

Start time (UTC):	11:48:09
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 123123a
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5641, Parent PID: 5432

General

Start time (UTC):	11:48:10
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5641, Parent PID: 5432

General

Start time (UTC):	11:48:10
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 Ofurain0n4H34D \|\| busybox pkill -9 Ofurain0n4H34D"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5642, Parent PID: 5641

General

Start time (UTC):	11:48:10
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5642, Parent PID: 5641

General

Start time (UTC):	11:48:10
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 Ofurain0n4H34D
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5643, Parent PID: 5641

General

Start time (UTC):	11:48:11
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5643, Parent PID: 5641

General

Start time (UTC):	11:48:11
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 Ofurain0n4H34D
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5646, Parent PID: 5432

General

Start time (UTC):	11:48:12
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5646, Parent PID: 5432

General

Start time (UTC):	11:48:12
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggTrex \|\| busybox pkill -9 ggTrex"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5647, Parent PID: 5646

General

Start time (UTC):	11:48:12
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5647, Parent PID: 5646

General

Start time (UTC):	11:48:12
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggTrex
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5649, Parent PID: 5646

General

Start time (UTC):	11:48:13
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5649, Parent PID: 5646

General

Start time (UTC):	11:48:13
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggTrex
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5650, Parent PID: 5432

General

Start time (UTC):	11:48:14
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5650, Parent PID: 5432

General

Start time (UTC):	11:48:14
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 wasads \|\| busybox pkill -9 wasads"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5651, Parent PID: 5650

General

Start time (UTC):	11:48:14
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5651, Parent PID: 5650

General

Start time (UTC):	11:48:14
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 wasads
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5652, Parent PID: 5650

General

Start time (UTC):	11:48:15
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5652, Parent PID: 5650

General

Start time (UTC):	11:48:15
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 wasads
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5653, Parent PID: 5432

General

Start time (UTC):	11:48:16
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5653, Parent PID: 5432

General

Start time (UTC):	11:48:16
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1293194hjXD \|\| busybox pkill -9 1293194hjXD"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5654, Parent PID: 5653

General

Start time (UTC):	11:48:16
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5654, Parent PID: 5653

General

Start time (UTC):	11:48:16
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1293194hjXD
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5657, Parent PID: 5653

General

Start time (UTC):	11:48:18
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5657, Parent PID: 5653

General

Start time (UTC):	11:48:18
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1293194hjXD
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5658, Parent PID: 5432

General

Start time (UTC):	11:48:19
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5658, Parent PID: 5432

General

Start time (UTC):	11:48:19
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 OthLaLosn \|\| busybox pkill -9 OthLaLosn"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5659, Parent PID: 5658

General

Start time (UTC):	11:48:19
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5659, Parent PID: 5658

General

Start time (UTC):	11:48:19
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 OthLaLosn
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5660, Parent PID: 5658

General

Start time (UTC):	11:48:20
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5660, Parent PID: 5658

General

Start time (UTC):	11:48:20
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 OthLaLosn
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5661, Parent PID: 5432

General

Start time (UTC):	11:48:21
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5661, Parent PID: 5432

General

Start time (UTC):	11:48:21
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggt \|\| busybox pkill -9 ggt"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5662, Parent PID: 5661

General

Start time (UTC):	11:48:21
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5662, Parent PID: 5661

General

Start time (UTC):	11:48:21
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggt
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5665, Parent PID: 5661

General

Start time (UTC):	11:48:22
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5665, Parent PID: 5661

General

Start time (UTC):	11:48:22
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggt
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5666, Parent PID: 5432

General

Start time (UTC):	11:48:23
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5666, Parent PID: 5432

General

Start time (UTC):	11:48:23
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 wget-log \|\| busybox pkill -9 wget-log"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5667, Parent PID: 5666

General

Start time (UTC):	11:48:23
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5667, Parent PID: 5666

General

Start time (UTC):	11:48:23
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 wget-log
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5668, Parent PID: 5666

General

Start time (UTC):	11:48:24
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5668, Parent PID: 5666

General

Start time (UTC):	11:48:24
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 wget-log
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5669, Parent PID: 5432

General

Start time (UTC):	11:48:25
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5669, Parent PID: 5432

General

Start time (UTC):	11:48:25
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1337SoraLOADER \|\| busybox pkill -9 1337SoraLOADER"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5670, Parent PID: 5669

General

Start time (UTC):	11:48:25
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5670, Parent PID: 5669

General

Start time (UTC):	11:48:25
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1337SoraLOADER
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5671, Parent PID: 5669

General

Start time (UTC):	11:48:26
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5671, Parent PID: 5669

General

Start time (UTC):	11:48:26
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1337SoraLOADER
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5674, Parent PID: 5432

General

Start time (UTC):	11:48:27
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5674, Parent PID: 5432

General

Start time (UTC):	11:48:27
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SAIAKINA \|\| busybox pkill -9 SAIAKINA"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5675, Parent PID: 5674

General

Start time (UTC):	11:48:27
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5675, Parent PID: 5674

General

Start time (UTC):	11:48:27
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SAIAKINA
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5676, Parent PID: 5674

General

Start time (UTC):	11:48:28
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5676, Parent PID: 5674

General

Start time (UTC):	11:48:28
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SAIAKINA
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5677, Parent PID: 5432

General

Start time (UTC):	11:48:29
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5677, Parent PID: 5432

General

Start time (UTC):	11:48:29
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggtq \|\| busybox pkill -9 ggtq"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5678, Parent PID: 5677

General

Start time (UTC):	11:48:29
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5678, Parent PID: 5677

General

Start time (UTC):	11:48:29
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggtq
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5679, Parent PID: 5677

General

Start time (UTC):	11:48:30
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5679, Parent PID: 5677

General

Start time (UTC):	11:48:30
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggtq
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5680, Parent PID: 5432

General

Start time (UTC):	11:48:31
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5680, Parent PID: 5432

General

Start time (UTC):	11:48:31
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1378bfp919GRB1Q2 \|\| busybox pkill -9 1378bfp919GRB1Q2"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5681, Parent PID: 5680

General

Start time (UTC):	11:48:31
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5681, Parent PID: 5680

General

Start time (UTC):	11:48:31
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1378bfp919GRB1Q2
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5684, Parent PID: 5680

General

Start time (UTC):	11:48:32
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5684, Parent PID: 5680

General

Start time (UTC):	11:48:32
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1378bfp919GRB1Q2
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5685, Parent PID: 5432

General

Start time (UTC):	11:48:33
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5685, Parent PID: 5432

General

Start time (UTC):	11:48:33
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SAIAKUSO \|\| busybox pkill -9 SAIAKUSO"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5686, Parent PID: 5685

General

Start time (UTC):	11:48:33
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5686, Parent PID: 5685

General

Start time (UTC):	11:48:33
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SAIAKUSO
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5687, Parent PID: 5685

General

Start time (UTC):	11:48:35
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5687, Parent PID: 5685

General

Start time (UTC):	11:48:35
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SAIAKUSO
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5688, Parent PID: 5432

General

Start time (UTC):	11:48:36
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5688, Parent PID: 5432

General

Start time (UTC):	11:48:36
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggtr \|\| busybox pkill -9 ggtr"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5689, Parent PID: 5688

General

Start time (UTC):	11:48:36
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5689, Parent PID: 5688

General

Start time (UTC):	11:48:36
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggtr
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5690, Parent PID: 5688

General

Start time (UTC):	11:48:37
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5690, Parent PID: 5688

General

Start time (UTC):	11:48:37
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggtr
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5695, Parent PID: 5432

General

Start time (UTC):	11:48:38
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5695, Parent PID: 5432

General

Start time (UTC):	11:48:38
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 14Fa \|\| busybox pkill -9 14Fa"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5696, Parent PID: 5695

General

Start time (UTC):	11:48:38
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5696, Parent PID: 5695

General

Start time (UTC):	11:48:38
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 14Fa
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5697, Parent PID: 5695

General

Start time (UTC):	11:48:39
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5697, Parent PID: 5695

General

Start time (UTC):	11:48:39
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 14Fa
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5698, Parent PID: 5432

General

Start time (UTC):	11:48:40
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5698, Parent PID: 5432

General

Start time (UTC):	11:48:40
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SEXSLAVE1337 \|\| busybox pkill -9 SEXSLAVE1337"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5699, Parent PID: 5698

General

Start time (UTC):	11:48:40
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5699, Parent PID: 5698

General

Start time (UTC):	11:48:40
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SEXSLAVE1337
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5700, Parent PID: 5698

General

Start time (UTC):	11:48:41
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5700, Parent PID: 5698

General

Start time (UTC):	11:48:41
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SEXSLAVE1337
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5703, Parent PID: 5432

General

Start time (UTC):	11:48:42
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5703, Parent PID: 5432

General

Start time (UTC):	11:48:42
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggtt \|\| busybox pkill -9 ggtt"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5704, Parent PID: 5703

General

Start time (UTC):	11:48:42
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5704, Parent PID: 5703

General

Start time (UTC):	11:48:42
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggtt
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5705, Parent PID: 5703

General

Start time (UTC):	11:48:43
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5705, Parent PID: 5703

General

Start time (UTC):	11:48:43
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggtt
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5707, Parent PID: 5432

General

Start time (UTC):	11:48:44
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5707, Parent PID: 5432

General

Start time (UTC):	11:48:44
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1902a3u912u3u4 \|\| busybox pkill -9 1902a3u912u3u4"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5708, Parent PID: 5707

General

Start time (UTC):	11:48:44
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5708, Parent PID: 5707

General

Start time (UTC):	11:48:44
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1902a3u912u3u4
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5709, Parent PID: 5707

General

Start time (UTC):	11:48:45
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5709, Parent PID: 5707

General

Start time (UTC):	11:48:45
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1902a3u912u3u4
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5710, Parent PID: 5432

General

Start time (UTC):	11:48:46
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5710, Parent PID: 5432

General

Start time (UTC):	11:48:46
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5711, Parent PID: 5710

General

Start time (UTC):	11:48:46
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5711, Parent PID: 5710

General

Start time (UTC):	11:48:46
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SO190Ij1X
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5714, Parent PID: 5710

General

Start time (UTC):	11:48:48
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5714, Parent PID: 5710

General

Start time (UTC):	11:48:48
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SO190Ij1X
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5715, Parent PID: 5432

General

Start time (UTC):	11:48:49
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5715, Parent PID: 5432

General

Start time (UTC):	11:48:49
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 haetrghbr \|\| busybox pkill -9 haetrghbr"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5716, Parent PID: 5715

General

Start time (UTC):	11:48:49
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5716, Parent PID: 5715

General

Start time (UTC):	11:48:49
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 haetrghbr
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5717, Parent PID: 5715

General

Start time (UTC):	11:48:50
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5717, Parent PID: 5715

General

Start time (UTC):	11:48:50
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 haetrghbr
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5718, Parent PID: 5432

General

Start time (UTC):	11:48:51
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5718, Parent PID: 5432

General

Start time (UTC):	11:48:51
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 19ju3d \|\| busybox pkill -9 19ju3d"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5719, Parent PID: 5718

General

Start time (UTC):	11:48:51
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5719, Parent PID: 5718

General

Start time (UTC):	11:48:51
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 19ju3d
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5720, Parent PID: 5718

General

Start time (UTC):	11:48:52
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5720, Parent PID: 5718

General

Start time (UTC):	11:48:52
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 19ju3d
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i686.elf PID: 5723, Parent PID: 5432

General

Start time (UTC):	11:48:53
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i686.elf
Arguments:	-
File size:	123163 bytes
MD5 hash:	6bdc27df8c2053f9044bb4bd108deecd

Analysis Process: sh PID: 5723, Parent PID: 5432

General

Start time (UTC):	11:48:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SORAojkf120 \|\| busybox pkill -9 SORAojkf120"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5724, Parent PID: 5723

General

Start time (UTC):	11:48:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5724, Parent PID: 5723

General

Start time (UTC):	11:48:53
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SORAojkf120
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.
Tactics:	Credential Access
Data Sources:	Application Log: Application Log Content, Command: Command Execution, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report yakuza.i686.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: yakuza.i686.elf PID: 5431, Parent PID: 5357

General

Chronological Activities

Analysis Process: yakuza.i686.elf PID: 5432, Parent PID: 5431

General

Chronological Activities

Analysis Process: yakuza.i686.elf PID: 5433, Parent PID: 5432

General

Analysis Process: yakuza.i686.elf PID: 5434, Parent PID: 5432

General

Chronological Activities

Analysis Process: yakuza.i686.elf PID: 5435, Parent PID: 5432

General

Chronological Activities

Analysis Process: sh PID: 5435, Parent PID: 5432

General

Chronological Activities

Linux Analysis Report
yakuza.i686.elf