Edit tour

Linux Analysis Report
yakuza.sparc.elf

Overview

General Information

Sample name:	yakuza.sparc.elf
Analysis ID:	1581661
MD5:	754a74cfe79bd7c15d239cbf196e21bc
SHA1:	dff3324dcd977c8584a65f3a7ebd8c4d278e051f
SHA256:	fd6e4e475534357b76a302cada4d5ab98810cb9ae025b1d4ac3ed5b650cff29c
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "kill" or "pkill" command typically used to terminate processes

Reads CPU information from /sys indicative of miner or evasive malware

Reads the 'hosts' file potentially containing internal network hosts

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample contains strings indicative of password brute-forcing capabilities

Sample contains strings that are user agent strings indicative of HTTP manipulation

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581661
Start date and time:	2024-12-28 13:56:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	yakuza.sparc.elf
Detection:	MAL
Classification:	mal64.troj.linELF@0/0@1/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.

Runtime Messages

Command:	/tmp/yakuza.sparc.elf
PID:	6235
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	CAPSAICIN
Standard Error:

Process Tree

system is lnxubuntu20

yakuza.sparc.elf (PID: 6235, Parent: 6160, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/yakuza.sparc.elf

yakuza.sparc.elf New Fork (PID: 6237, Parent: 6235)

yakuza.sparc.elf New Fork (PID: 6239, Parent: 6237)

yakuza.sparc.elf New Fork (PID: 6240, Parent: 6237)

yakuza.sparc.elf New Fork (PID: 6246, Parent: 6237)

sh (PID: 6246, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 902i13 || busybox pkill -9 902i13"

sh New Fork (PID: 6249, Parent: 6246)

pkill (PID: 6249, Parent: 6246, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 902i13

sh New Fork (PID: 6264, Parent: 6246)

busybox (PID: 6264, Parent: 6246, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 902i13

yakuza.sparc.elf New Fork (PID: 6265, Parent: 6237)

sh (PID: 6265, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 BzSxLxBxeY || busybox pkill -9 BzSxLxBxeY"

sh New Fork (PID: 6270, Parent: 6265)

pkill (PID: 6270, Parent: 6265, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 BzSxLxBxeY

sh New Fork (PID: 6283, Parent: 6265)

busybox (PID: 6283, Parent: 6265, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 BzSxLxBxeY

yakuza.sparc.elf New Fork (PID: 6284, Parent: 6237)

sh (PID: 6284, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 HOHO-LUGO7 || busybox pkill -9 HOHO-LUGO7"

sh New Fork (PID: 6289, Parent: 6284)

pkill (PID: 6289, Parent: 6284, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 HOHO-LUGO7

sh New Fork (PID: 6290, Parent: 6284)

busybox (PID: 6290, Parent: 6284, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 HOHO-LUGO7

yakuza.sparc.elf New Fork (PID: 6291, Parent: 6237)

sh (PID: 6291, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 HOHO-U79OL || busybox pkill -9 HOHO-U79OL"

sh New Fork (PID: 6293, Parent: 6291)

pkill (PID: 6293, Parent: 6291, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 HOHO-U79OL

sh New Fork (PID: 6294, Parent: 6291)

busybox (PID: 6294, Parent: 6291, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 HOHO-U79OL

yakuza.sparc.elf New Fork (PID: 6295, Parent: 6237)

sh (PID: 6295, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 JuYfouyf87 || busybox pkill -9 JuYfouyf87"

sh New Fork (PID: 6300, Parent: 6295)

pkill (PID: 6300, Parent: 6295, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 JuYfouyf87

sh New Fork (PID: 6303, Parent: 6295)

busybox (PID: 6303, Parent: 6295, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 JuYfouyf87

yakuza.sparc.elf New Fork (PID: 6304, Parent: 6237)

sh (PID: 6304, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"

sh New Fork (PID: 6309, Parent: 6304)

pkill (PID: 6309, Parent: 6304, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeR69xd

sh New Fork (PID: 6311, Parent: 6304)

busybox (PID: 6311, Parent: 6304, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeR69xd

yakuza.sparc.elf New Fork (PID: 6312, Parent: 6237)

sh (PID: 6312, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SO190Ij1X || busybox pkill -9 SO190Ij1X"

sh New Fork (PID: 6318, Parent: 6312)

pkill (PID: 6318, Parent: 6312, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SO190Ij1X

sh New Fork (PID: 6321, Parent: 6312)

busybox (PID: 6321, Parent: 6312, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SO190Ij1X

yakuza.sparc.elf New Fork (PID: 6322, Parent: 6237)

sh (PID: 6322, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 LOLKIKEEEDDE || busybox pkill -9 LOLKIKEEEDDE"

sh New Fork (PID: 6327, Parent: 6322)

pkill (PID: 6327, Parent: 6322, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 LOLKIKEEEDDE

sh New Fork (PID: 6328, Parent: 6322)

busybox (PID: 6328, Parent: 6322, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 LOLKIKEEEDDE

yakuza.sparc.elf New Fork (PID: 6329, Parent: 6237)

sh (PID: 6329, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ekjheory98e || busybox pkill -9 ekjheory98e"

sh New Fork (PID: 6334, Parent: 6329)

pkill (PID: 6334, Parent: 6329, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ekjheory98e

sh New Fork (PID: 6335, Parent: 6329)

busybox (PID: 6335, Parent: 6329, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ekjheory98e

yakuza.sparc.elf New Fork (PID: 6336, Parent: 6237)

sh (PID: 6336, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scansh4 || busybox pkill -9 scansh4"

sh New Fork (PID: 6338, Parent: 6336)

pkill (PID: 6338, Parent: 6336, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scansh4

sh New Fork (PID: 6339, Parent: 6336)

busybox (PID: 6339, Parent: 6336, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scansh4

yakuza.sparc.elf New Fork (PID: 6340, Parent: 6237)

sh (PID: 6340, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MDMA || busybox pkill -9 MDMA"

sh New Fork (PID: 6345, Parent: 6340)

pkill (PID: 6345, Parent: 6340, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MDMA

sh New Fork (PID: 6370, Parent: 6340)

busybox (PID: 6370, Parent: 6340, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MDMA

yakuza.sparc.elf New Fork (PID: 6371, Parent: 6237)

sh (PID: 6371, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 fdevalvex || busybox pkill -9 fdevalvex"

sh New Fork (PID: 6376, Parent: 6371)

pkill (PID: 6376, Parent: 6371, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 fdevalvex

sh New Fork (PID: 6377, Parent: 6371)

busybox (PID: 6377, Parent: 6371, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 fdevalvex

yakuza.sparc.elf New Fork (PID: 6378, Parent: 6237)

sh (PID: 6378, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scanspc || busybox pkill -9 scanspc"

sh New Fork (PID: 6383, Parent: 6378)

pkill (PID: 6383, Parent: 6378, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scanspc

sh New Fork (PID: 6386, Parent: 6378)

busybox (PID: 6386, Parent: 6378, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scanspc

yakuza.sparc.elf New Fork (PID: 6387, Parent: 6237)

sh (PID: 6387, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MELTEDNINJAREALZ || busybox pkill -9 MELTEDNINJAREALZ"

sh New Fork (PID: 6392, Parent: 6387)

pkill (PID: 6392, Parent: 6387, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MELTEDNINJAREALZ

sh New Fork (PID: 6393, Parent: 6387)

busybox (PID: 6393, Parent: 6387, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MELTEDNINJAREALZ

yakuza.sparc.elf New Fork (PID: 6394, Parent: 6237)

sh (PID: 6394, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 flexsonskids || busybox pkill -9 flexsonskids"

sh New Fork (PID: 6399, Parent: 6394)

pkill (PID: 6399, Parent: 6394, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 flexsonskids

sh New Fork (PID: 6400, Parent: 6394)

busybox (PID: 6400, Parent: 6394, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 flexsonskids

yakuza.sparc.elf New Fork (PID: 6401, Parent: 6237)

sh (PID: 6401, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scanx86 || busybox pkill -9 scanx86"

sh New Fork (PID: 6407, Parent: 6401)

pkill (PID: 6407, Parent: 6401, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scanx86

sh New Fork (PID: 6408, Parent: 6401)

busybox (PID: 6408, Parent: 6401, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scanx86

yakuza.sparc.elf New Fork (PID: 6411, Parent: 6237)

sh (PID: 6411, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MISAKI-U79OL || busybox pkill -9 MISAKI-U79OL"

sh New Fork (PID: 6413, Parent: 6411)

pkill (PID: 6413, Parent: 6411, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MISAKI-U79OL

sh New Fork (PID: 6414, Parent: 6411)

busybox (PID: 6414, Parent: 6411, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MISAKI-U79OL

yakuza.sparc.elf New Fork (PID: 6415, Parent: 6237)

sh (PID: 6415, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 foAxi102kxe || busybox pkill -9 foAxi102kxe"

sh New Fork (PID: 6420, Parent: 6415)

pkill (PID: 6420, Parent: 6415, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 foAxi102kxe

sh New Fork (PID: 6421, Parent: 6415)

busybox (PID: 6421, Parent: 6415, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 foAxi102kxe

yakuza.sparc.elf New Fork (PID: 6422, Parent: 6237)

sh (PID: 6422, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 swodjwodjwoj || busybox pkill -9 swodjwodjwoj"

sh New Fork (PID: 6425, Parent: 6422)

pkill (PID: 6425, Parent: 6422, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 swodjwodjwoj

sh New Fork (PID: 6430, Parent: 6422)

busybox (PID: 6430, Parent: 6422, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 swodjwodjwoj

yakuza.sparc.elf New Fork (PID: 6431, Parent: 6237)

sh (PID: 6431, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MmKiy7f87l || busybox pkill -9 MmKiy7f87l"

sh New Fork (PID: 6436, Parent: 6431)

pkill (PID: 6436, Parent: 6431, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MmKiy7f87l

sh New Fork (PID: 6437, Parent: 6431)

busybox (PID: 6437, Parent: 6431, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MmKiy7f87l

yakuza.sparc.elf New Fork (PID: 6438, Parent: 6237)

sh (PID: 6438, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 freecookiex86 || busybox pkill -9 freecookiex86"

sh New Fork (PID: 6443, Parent: 6438)

pkill (PID: 6443, Parent: 6438, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 freecookiex86

sh New Fork (PID: 6444, Parent: 6438)

busybox (PID: 6444, Parent: 6438, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 freecookiex86

yakuza.sparc.elf New Fork (PID: 6445, Parent: 6237)

sh (PID: 6445, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 sysgpu || busybox pkill -9 sysgpu"

sh New Fork (PID: 6450, Parent: 6445)

pkill (PID: 6450, Parent: 6445, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 sysgpu

sh New Fork (PID: 6453, Parent: 6445)

busybox (PID: 6453, Parent: 6445, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 sysgpu

yakuza.sparc.elf New Fork (PID: 6454, Parent: 6237)

sh (PID: 6454, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"

sh New Fork (PID: 6459, Parent: 6454)

pkill (PID: 6459, Parent: 6454, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeR69xd

sh New Fork (PID: 6461, Parent: 6454)

busybox (PID: 6461, Parent: 6454, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeR69xd

yakuza.sparc.elf New Fork (PID: 6462, Parent: 6237)

sh (PID: 6462, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 frgege || busybox pkill -9 frgege"

sh New Fork (PID: 6468, Parent: 6462)

pkill (PID: 6468, Parent: 6462, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 frgege

sh New Fork (PID: 6469, Parent: 6462)

busybox (PID: 6469, Parent: 6462, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 frgege

yakuza.sparc.elf New Fork (PID: 6470, Parent: 6237)

sh (PID: 6470, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 sysupdater || busybox pkill -9 sysupdater"

sh New Fork (PID: 6475, Parent: 6470)

pkill (PID: 6475, Parent: 6470, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 sysupdater

sh New Fork (PID: 6478, Parent: 6470)

busybox (PID: 6478, Parent: 6470, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 sysupdater

yakuza.sparc.elf New Fork (PID: 6479, Parent: 6237)

sh (PID: 6479, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 0DnAzepd || busybox pkill -9 0DnAzepd"

sh New Fork (PID: 6481, Parent: 6479)

pkill (PID: 6481, Parent: 6479, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 0DnAzepd

sh New Fork (PID: 6482, Parent: 6479)

busybox (PID: 6482, Parent: 6479, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 0DnAzepd

yakuza.sparc.elf New Fork (PID: 6483, Parent: 6237)

sh (PID: 6483, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeRD0nks69 || busybox pkill -9 NiGGeRD0nks69"

sh New Fork (PID: 6488, Parent: 6483)

pkill (PID: 6488, Parent: 6483, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeRD0nks69

sh New Fork (PID: 6489, Parent: 6483)

busybox (PID: 6489, Parent: 6483, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeRD0nks69

yakuza.sparc.elf New Fork (PID: 6490, Parent: 6237)

sh (PID: 6490, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 frgreu || busybox pkill -9 frgreu"

sh New Fork (PID: 6495, Parent: 6490)

pkill (PID: 6495, Parent: 6490, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 frgreu

sh New Fork (PID: 6500, Parent: 6490)

busybox (PID: 6500, Parent: 6490, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 frgreu

yakuza.sparc.elf New Fork (PID: 6501, Parent: 6237)

sh (PID: 6501, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 telnetd || busybox pkill -9 telnetd"

sh New Fork (PID: 6503, Parent: 6501)

pkill (PID: 6503, Parent: 6501, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 telnetd

sh New Fork (PID: 6504, Parent: 6501)

busybox (PID: 6504, Parent: 6501, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 telnetd

yakuza.sparc.elf New Fork (PID: 6505, Parent: 6237)

sh (PID: 6505, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 0x766f6964 || busybox pkill -9 0x766f6964"

sh New Fork (PID: 6510, Parent: 6505)

pkill (PID: 6510, Parent: 6505, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 0x766f6964

sh New Fork (PID: 6513, Parent: 6505)

busybox (PID: 6513, Parent: 6505, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 0x766f6964

yakuza.sparc.elf New Fork (PID: 6514, Parent: 6237)

sh (PID: 6514, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeRd0nks1337 || busybox pkill -9 NiGGeRd0nks1337"

sh New Fork (PID: 6516, Parent: 6514)

pkill (PID: 6516, Parent: 6514, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeRd0nks1337

sh New Fork (PID: 6517, Parent: 6514)

busybox (PID: 6517, Parent: 6514, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeRd0nks1337

yakuza.sparc.elf New Fork (PID: 6518, Parent: 6237)

sh (PID: 6518, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 gaft || busybox pkill -9 gaft"

sh New Fork (PID: 6523, Parent: 6518)

pkill (PID: 6523, Parent: 6518, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 gaft

sh New Fork (PID: 6524, Parent: 6518)

busybox (PID: 6524, Parent: 6518, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 gaft

yakuza.sparc.elf New Fork (PID: 6525, Parent: 6237)

sh (PID: 6525, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 urasgbsigboa || busybox pkill -9 urasgbsigboa"

sh New Fork (PID: 6531, Parent: 6525)

pkill (PID: 6531, Parent: 6525, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 urasgbsigboa

sh New Fork (PID: 6534, Parent: 6525)

busybox (PID: 6534, Parent: 6525, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 urasgbsigboa

yakuza.sparc.elf New Fork (PID: 6535, Parent: 6237)

sh (PID: 6535, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 120i3UI49 || busybox pkill -9 120i3UI49"

sh New Fork (PID: 6540, Parent: 6535)

pkill (PID: 6540, Parent: 6535, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 120i3UI49

sh New Fork (PID: 6541, Parent: 6535)

busybox (PID: 6541, Parent: 6535, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 120i3UI49

yakuza.sparc.elf New Fork (PID: 6542, Parent: 6237)

sh (PID: 6542, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 OaF3 || busybox pkill -9 OaF3"

sh New Fork (PID: 6547, Parent: 6542)

pkill (PID: 6547, Parent: 6542, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 OaF3

sh New Fork (PID: 6548, Parent: 6542)

busybox (PID: 6548, Parent: 6542, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 OaF3

yakuza.sparc.elf New Fork (PID: 6549, Parent: 6237)

sh (PID: 6549, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 geae || busybox pkill -9 geae"

sh New Fork (PID: 6554, Parent: 6549)

pkill (PID: 6554, Parent: 6549, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 geae

sh New Fork (PID: 6557, Parent: 6549)

busybox (PID: 6557, Parent: 6549, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 geae

yakuza.sparc.elf New Fork (PID: 6558, Parent: 6237)

sh (PID: 6558, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 vaiolmao || busybox pkill -9 vaiolmao"

sh New Fork (PID: 6563, Parent: 6558)

pkill (PID: 6563, Parent: 6558, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 vaiolmao

sh New Fork (PID: 6564, Parent: 6558)

busybox (PID: 6564, Parent: 6558, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 vaiolmao

yakuza.sparc.elf New Fork (PID: 6565, Parent: 6237)

sh (PID: 6565, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 123123a || busybox pkill -9 123123a"

sh New Fork (PID: 6570, Parent: 6565)

pkill (PID: 6570, Parent: 6565, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 123123a

sh New Fork (PID: 6571, Parent: 6565)

busybox (PID: 6571, Parent: 6565, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 123123a

yakuza.sparc.elf New Fork (PID: 6572, Parent: 6237)

sh (PID: 6572, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 Ofurain0n4H34D || busybox pkill -9 Ofurain0n4H34D"

sh New Fork (PID: 6577, Parent: 6572)

pkill (PID: 6577, Parent: 6572, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 Ofurain0n4H34D

sh New Fork (PID: 6580, Parent: 6572)

busybox (PID: 6580, Parent: 6572, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 Ofurain0n4H34D

yakuza.sparc.elf New Fork (PID: 6581, Parent: 6237)

sh (PID: 6581, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggTrex || busybox pkill -9 ggTrex"

sh New Fork (PID: 6586, Parent: 6581)

pkill (PID: 6586, Parent: 6581, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggTrex

sh New Fork (PID: 6588, Parent: 6581)

busybox (PID: 6588, Parent: 6581, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggTrex

yakuza.sparc.elf New Fork (PID: 6589, Parent: 6237)

sh (PID: 6589, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 wasads || busybox pkill -9 wasads"

sh New Fork (PID: 6595, Parent: 6589)

pkill (PID: 6595, Parent: 6589, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 wasads

sh New Fork (PID: 6596, Parent: 6589)

busybox (PID: 6596, Parent: 6589, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 wasads

yakuza.sparc.elf New Fork (PID: 6597, Parent: 6237)

sh (PID: 6597, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1293194hjXD || busybox pkill -9 1293194hjXD"

sh New Fork (PID: 6602, Parent: 6597)

pkill (PID: 6602, Parent: 6597, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1293194hjXD

sh New Fork (PID: 6605, Parent: 6597)

busybox (PID: 6605, Parent: 6597, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1293194hjXD

yakuza.sparc.elf New Fork (PID: 6606, Parent: 6237)

sh (PID: 6606, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 OthLaLosn || busybox pkill -9 OthLaLosn"

sh New Fork (PID: 6608, Parent: 6606)

pkill (PID: 6608, Parent: 6606, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 OthLaLosn

sh New Fork (PID: 6609, Parent: 6606)

busybox (PID: 6609, Parent: 6606, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 OthLaLosn

yakuza.sparc.elf New Fork (PID: 6610, Parent: 6237)

sh (PID: 6610, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggt || busybox pkill -9 ggt"

sh New Fork (PID: 6615, Parent: 6610)

pkill (PID: 6615, Parent: 6610, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggt

sh New Fork (PID: 6616, Parent: 6610)

busybox (PID: 6616, Parent: 6610, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggt

yakuza.sparc.elf New Fork (PID: 6617, Parent: 6237)

sh (PID: 6617, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 wget-log || busybox pkill -9 wget-log"

sh New Fork (PID: 6619, Parent: 6617)

pkill (PID: 6619, Parent: 6617, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 wget-log

sh New Fork (PID: 6622, Parent: 6617)

busybox (PID: 6622, Parent: 6617, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 wget-log

yakuza.sparc.elf New Fork (PID: 6623, Parent: 6237)

sh (PID: 6623, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1337SoraLOADER || busybox pkill -9 1337SoraLOADER"

sh New Fork (PID: 6628, Parent: 6623)

pkill (PID: 6628, Parent: 6623, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1337SoraLOADER

sh New Fork (PID: 6629, Parent: 6623)

busybox (PID: 6629, Parent: 6623, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1337SoraLOADER

yakuza.sparc.elf New Fork (PID: 6630, Parent: 6237)

sh (PID: 6630, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SAIAKINA || busybox pkill -9 SAIAKINA"

sh New Fork (PID: 6632, Parent: 6630)

pkill (PID: 6632, Parent: 6630, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SAIAKINA

sh New Fork (PID: 6635, Parent: 6630)

busybox (PID: 6635, Parent: 6630, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SAIAKINA

yakuza.sparc.elf New Fork (PID: 6636, Parent: 6237)

sh (PID: 6636, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggtq || busybox pkill -9 ggtq"

sh New Fork (PID: 6641, Parent: 6636)

pkill (PID: 6641, Parent: 6636, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggtq

sh New Fork (PID: 6642, Parent: 6636)

busybox (PID: 6642, Parent: 6636, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggtq

yakuza.sparc.elf New Fork (PID: 6643, Parent: 6237)

sh (PID: 6643, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1378bfp919GRB1Q2 || busybox pkill -9 1378bfp919GRB1Q2"

sh New Fork (PID: 6648, Parent: 6643)

pkill (PID: 6648, Parent: 6643, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1378bfp919GRB1Q2

sh New Fork (PID: 6649, Parent: 6643)

busybox (PID: 6649, Parent: 6643, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1378bfp919GRB1Q2

yakuza.sparc.elf New Fork (PID: 6650, Parent: 6237)

sh (PID: 6650, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SAIAKUSO || busybox pkill -9 SAIAKUSO"

sh New Fork (PID: 6656, Parent: 6650)

pkill (PID: 6656, Parent: 6650, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SAIAKUSO

sh New Fork (PID: 6657, Parent: 6650)

busybox (PID: 6657, Parent: 6650, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SAIAKUSO

yakuza.sparc.elf New Fork (PID: 6658, Parent: 6237)

sh (PID: 6658, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggtr || busybox pkill -9 ggtr"

sh New Fork (PID: 6663, Parent: 6658)

pkill (PID: 6663, Parent: 6658, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggtr

sh New Fork (PID: 6666, Parent: 6658)

busybox (PID: 6666, Parent: 6658, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggtr

yakuza.sparc.elf New Fork (PID: 6667, Parent: 6237)

sh (PID: 6667, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 14Fa || busybox pkill -9 14Fa"

sh New Fork (PID: 6672, Parent: 6667)

pkill (PID: 6672, Parent: 6667, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 14Fa

sh New Fork (PID: 6673, Parent: 6667)

busybox (PID: 6673, Parent: 6667, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 14Fa

yakuza.sparc.elf New Fork (PID: 6674, Parent: 6237)

sh (PID: 6674, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SEXSLAVE1337 || busybox pkill -9 SEXSLAVE1337"

sh New Fork (PID: 6676, Parent: 6674)

pkill (PID: 6676, Parent: 6674, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SEXSLAVE1337

sh New Fork (PID: 6679, Parent: 6674)

busybox (PID: 6679, Parent: 6674, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SEXSLAVE1337

yakuza.sparc.elf New Fork (PID: 6680, Parent: 6237)

sh (PID: 6680, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggtt || busybox pkill -9 ggtt"

sh New Fork (PID: 6682, Parent: 6680)

pkill (PID: 6682, Parent: 6680, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggtt

sh New Fork (PID: 6683, Parent: 6680)

busybox (PID: 6683, Parent: 6680, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggtt

yakuza.sparc.elf New Fork (PID: 6684, Parent: 6237)

sh (PID: 6684, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1902a3u912u3u4 || busybox pkill -9 1902a3u912u3u4"

sh New Fork (PID: 6689, Parent: 6684)

pkill (PID: 6689, Parent: 6684, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1902a3u912u3u4

sh New Fork (PID: 6690, Parent: 6684)

busybox (PID: 6690, Parent: 6684, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1902a3u912u3u4

yakuza.sparc.elf New Fork (PID: 6691, Parent: 6237)

sh (PID: 6691, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SO190Ij1X || busybox pkill -9 SO190Ij1X"

sh New Fork (PID: 6693, Parent: 6691)

pkill (PID: 6693, Parent: 6691, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SO190Ij1X

sh New Fork (PID: 6695, Parent: 6691)

busybox (PID: 6695, Parent: 6691, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SO190Ij1X

yakuza.sparc.elf New Fork (PID: 6696, Parent: 6237)

sh (PID: 6696, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 haetrghbr || busybox pkill -9 haetrghbr"

sh New Fork (PID: 6701, Parent: 6696)

pkill (PID: 6701, Parent: 6696, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 haetrghbr

sh New Fork (PID: 6704, Parent: 6696)

busybox (PID: 6704, Parent: 6696, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 haetrghbr

yakuza.sparc.elf New Fork (PID: 6705, Parent: 6237)

sh (PID: 6705, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 19ju3d || busybox pkill -9 19ju3d"

sh New Fork (PID: 6710, Parent: 6705)

pkill (PID: 6710, Parent: 6705, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 19ju3d

sh New Fork (PID: 6712, Parent: 6705)

busybox (PID: 6712, Parent: 6705, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 19ju3d

yakuza.sparc.elf New Fork (PID: 6713, Parent: 6237)

sh (PID: 6713, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SORAojkf120 || busybox pkill -9 SORAojkf120"

sh New Fork (PID: 6719, Parent: 6713)

pkill (PID: 6719, Parent: 6713, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SORAojkf120

sh New Fork (PID: 6722, Parent: 6713)

busybox (PID: 6722, Parent: 6713, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SORAojkf120

yakuza.sparc.elf New Fork (PID: 6723, Parent: 6237)

sh (PID: 6723, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 hehahejeje92 || busybox pkill -9 hehahejeje92"

sh New Fork (PID: 6728, Parent: 6723)

pkill (PID: 6728, Parent: 6723, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 hehahejeje92

sh New Fork (PID: 6729, Parent: 6723)

busybox (PID: 6729, Parent: 6723, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 hehahejeje92

yakuza.sparc.elf New Fork (PID: 6730, Parent: 6237)

sh (PID: 6730, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 2U2JDJA901F91 || busybox pkill -9 2U2JDJA901F91"

sh New Fork (PID: 6735, Parent: 6730)

pkill (PID: 6735, Parent: 6730, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 2U2JDJA901F91

sh New Fork (PID: 6736, Parent: 6730)

busybox (PID: 6736, Parent: 6730, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 2U2JDJA901F91

yakuza.sparc.elf New Fork (PID: 6737, Parent: 6237)

sh (PID: 6737, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SlaVLav12 || busybox pkill -9 SlaVLav12"

sh New Fork (PID: 6742, Parent: 6737)

pkill (PID: 6742, Parent: 6737, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SlaVLav12

sh New Fork (PID: 6747, Parent: 6737)

busybox (PID: 6747, Parent: 6737, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SlaVLav12

yakuza.sparc.elf New Fork (PID: 6748, Parent: 6237)

sh (PID: 6748, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 helpmedaddthhhhh || busybox pkill -9 helpmedaddthhhhh"

sh New Fork (PID: 6750, Parent: 6748)

pkill (PID: 6750, Parent: 6748, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 helpmedaddthhhhh

sh New Fork (PID: 6751, Parent: 6748)

busybox (PID: 6751, Parent: 6748, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 helpmedaddthhhhh

yakuza.sparc.elf New Fork (PID: 6752, Parent: 6237)

sh (PID: 6752, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 2wgg9qphbq || busybox pkill -9 2wgg9qphbq"

sh New Fork (PID: 6757, Parent: 6752)

pkill (PID: 6757, Parent: 6752, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 2wgg9qphbq

sh New Fork (PID: 6758, Parent: 6752)

busybox (PID: 6758, Parent: 6752, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 2wgg9qphbq

yakuza.sparc.elf New Fork (PID: 6759, Parent: 6237)

sh (PID: 6759, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 Slav3Th3seD3vices || busybox pkill -9 Slav3Th3seD3vices"

sh New Fork (PID: 6764, Parent: 6759)

pkill (PID: 6764, Parent: 6759, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 Slav3Th3seD3vices

sh New Fork (PID: 6767, Parent: 6759)

busybox (PID: 6767, Parent: 6759, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 Slav3Th3seD3vices

yakuza.sparc.elf New Fork (PID: 6768, Parent: 6237)

sh (PID: 6768, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 hzSmYZjYMQ || busybox pkill -9 hzSmYZjYMQ"

sh New Fork (PID: 6772, Parent: 6768)

pkill (PID: 6772, Parent: 6768, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 hzSmYZjYMQ

sh New Fork (PID: 6774, Parent: 6768)

busybox (PID: 6774, Parent: 6768, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 hzSmYZjYMQ

yakuza.sparc.elf New Fork (PID: 6775, Parent: 6237)

sh (PID: 6775, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 5Gbf || busybox pkill -9 5Gbf"

sh New Fork (PID: 6777, Parent: 6775)

pkill (PID: 6777, Parent: 6775, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 5Gbf

sh New Fork (PID: 6778, Parent: 6775)

busybox (PID: 6778, Parent: 6775, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 5Gbf

yakuza.sparc.elf New Fork (PID: 6779, Parent: 6237)

sh (PID: 6779, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SoRAxD123LOL || busybox pkill -9 SoRAxD123LOL"

sh New Fork (PID: 6785, Parent: 6779)

pkill (PID: 6785, Parent: 6779, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SoRAxD123LOL

sh New Fork (PID: 6788, Parent: 6779)

busybox (PID: 6788, Parent: 6779, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SoRAxD123LOL

yakuza.sparc.elf New Fork (PID: 6789, Parent: 6237)

sh (PID: 6789, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 iaGv || busybox pkill -9 iaGv"

sh New Fork (PID: 6791, Parent: 6789)

pkill (PID: 6791, Parent: 6789, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 iaGv

sh New Fork (PID: 6792, Parent: 6789)

busybox (PID: 6792, Parent: 6789, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 iaGv

yakuza.sparc.elf New Fork (PID: 6793, Parent: 6237)

sh (PID: 6793, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 5aA3 || busybox pkill -9 5aA3"

sh New Fork (PID: 6798, Parent: 6793)

pkill (PID: 6798, Parent: 6793, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 5aA3

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
yakuza.sparc.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
yakuza.sparc.elf	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x1a7f9:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x1aedd:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20

Memory Dumps

Source	Rule	Description	Author	Strings
6235.1.00007f4208011000.00007f420802f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6235.1.00007f4208011000.00007f420802f000.r-x.sdmp	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x1a7f9:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x1aedd:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
6240.1.00007f4208011000.00007f420802f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6240.1.00007f4208011000.00007f420802f000.r-x.sdmp	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x1a7f9:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x1aedd:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
Process Memory Space: yakuza.sparc.elf PID: 6235	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x9ce8:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x9e1d:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0xa3f8:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
Process Memory Space: yakuza.sparc.elf PID: 6240	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x9277:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x93ac:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x9987:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
Click to see the 1 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: yakuza.sparc.elf

ReversingLabs: Detection: 44%

Source: /usr/bin/pkill (PID: 6249)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6270)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6289)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6293)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6300)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6309)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6318)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6327)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6334)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6338)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6345)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6376)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6383)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6392)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6399)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6407)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6413)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6420)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6425)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6436)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6443)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6450)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6459)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6468)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6475)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6481)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6488)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6495)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6503)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6510)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6516)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6523)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6531)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6540)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6547)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6554)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6563)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6570)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6577)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6586)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6595)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6602)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6608)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6615)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6619)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6628)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6632)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6641)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6648)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6656)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6663)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6672)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6676)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6682)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6689)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6693)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6701)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6710)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6719)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6728)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6735)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6742)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6750)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6757)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6764)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6772)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6777)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6785)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6791)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6798)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/yakuza.sparc.elf (PID: 6240)

Reads hosts file: /etc/hosts

Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: pirati.privatedns.org

Source: yakuza.sparc.elf	String found in binary or memory: http://linux-it.abuser.eu/yak.sh;
Source: yakuza.sparc.elf	String found in binary or memory: https://youtu.be/dQw4w9WgXcQ
Source: yakuza.sparc.elf	String found in binary or memory: https://youtu.be/dQw4w9WgXcQNever

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: yakuza.sparc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: 6235.1.00007f4208011000.00007f420802f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: 6240.1.00007f4208011000.00007f420802f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: Process Memory Space: yakuza.sparc.elf PID: 6235, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: Process Memory Space: yakuza.sparc.elf PID: 6240, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown

Source: yakuza.sparc.elf	ELF static info symbol of initial sample: passwords
Source: yakuza.sparc.elf	ELF static info symbol of initial sample: usernames

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: pkill -9 %s \|\| busybox pkill -9 %s
Source: Initial sample	String containing 'busybox' found: pkill -9 %s \|\| busybox pkill -9 %shistory -c;history -wcd /root;rm -f .bash_historycd /var/tmp; rm -f *NOTICE %s :MOVE <server>

Source: Initial sample	String containing potential weak password found: guest
Source: Initial sample	String containing potential weak password found: default
Source: Initial sample	String containing potential weak password found: admin
Source: Initial sample	String containing potential weak password found: supervisor
Source: Initial sample	String containing potential weak password found: service
Source: Initial sample	String containing potential weak password found: administrator
Source: Initial sample	String containing potential weak password found: support
Source: Initial sample	String containing potential weak password found: 123456
Source: Initial sample	String containing potential weak password found: password
Source: Initial sample	String containing potential weak password found: 12345

Source: yakuza.sparc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: 6235.1.00007f4208011000.00007f420802f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: 6240.1.00007f4208011000.00007f420802f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: Process Memory Space: yakuza.sparc.elf PID: 6235, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: Process Memory Space: yakuza.sparc.elf PID: 6240, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16

Source: classification engine

Classification label: mal64.troj.linELF@0/0@1/0

Source: yakuza.sparc.elf	ELF static info symbol of initial sample: libc/string/sparc/memchr.S
Source: yakuza.sparc.elf	ELF static info symbol of initial sample: libc/string/sparc/memcpy.S
Source: yakuza.sparc.elf	ELF static info symbol of initial sample: libc/string/sparc/memset.S
Source: yakuza.sparc.elf	ELF static info symbol of initial sample: libc/string/sparc/strchr.S
Source: yakuza.sparc.elf	ELF static info symbol of initial sample: libc/string/sparc/strcmp.S
Source: yakuza.sparc.elf	ELF static info symbol of initial sample: libc/string/sparc/strcpy.S
Source: yakuza.sparc.elf	ELF static info symbol of initial sample: libc/string/sparc/strlen.S
Source: yakuza.sparc.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/crt1.S
Source: yakuza.sparc.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/crti.S
Source: yakuza.sparc.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/crtn.S
Source: yakuza.sparc.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/fork.S
Source: yakuza.sparc.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/rem.S
Source: yakuza.sparc.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/udiv.S
Source: yakuza.sparc.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/umul.S
Source: yakuza.sparc.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/urem.S
Source: yakuza.sparc.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/sparc/vfork.S

Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/1582/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/1582/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/3088/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/3088/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/230/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/230/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/110/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/110/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/231/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/231/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/111/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/111/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/232/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/232/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/1579/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/1579/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/112/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/112/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/233/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/233/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/1699/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/1699/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/113/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/113/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/234/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/234/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/1335/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/1335/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/1698/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/1698/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/114/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/114/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/235/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/235/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/1334/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/1334/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/1576/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/1576/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/2302/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/2302/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/115/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/115/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/236/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/236/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/116/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/116/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/237/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/237/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/117/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/117/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/118/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/118/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/910/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/910/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/119/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/119/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/912/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/912/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/10/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/10/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/2307/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/2307/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/11/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/11/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/918/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/918/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/12/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/12/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/6240/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/6240/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/13/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/13/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/14/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/14/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/15/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/15/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/16/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/16/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/17/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/17/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/18/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/18/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/1594/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/1594/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/120/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/120/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/121/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/121/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/1349/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/1349/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/1/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/1/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/122/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/122/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/243/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/243/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/123/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/123/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/2/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/2/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/124/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/124/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/3/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/3/cmdline
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/4/status
Source: /usr/bin/pkill (PID: 6791)	File opened: /proc/4/cmdline

Source: /tmp/yakuza.sparc.elf (PID: 6246)	Shell command executed: sh -c "pkill -9 902i13 \|\| busybox pkill -9 902i13"	Jump to behavior
Source: /tmp/yakuza.sparc.elf (PID: 6265)	Shell command executed: sh -c "pkill -9 BzSxLxBxeY \|\| busybox pkill -9 BzSxLxBxeY"	Jump to behavior
Source: /tmp/yakuza.sparc.elf (PID: 6284)	Shell command executed: sh -c "pkill -9 HOHO-LUGO7 \|\| busybox pkill -9 HOHO-LUGO7"	Jump to behavior
Source: /tmp/yakuza.sparc.elf (PID: 6291)	Shell command executed: sh -c "pkill -9 HOHO-U79OL \|\| busybox pkill -9 HOHO-U79OL"	Jump to behavior
Source: /tmp/yakuza.sparc.elf (PID: 6295)	Shell command executed: sh -c "pkill -9 JuYfouyf87 \|\| busybox pkill -9 JuYfouyf87"	Jump to behavior
Source: /tmp/yakuza.sparc.elf (PID: 6304)	Shell command executed: sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"	Jump to behavior
Source: /tmp/yakuza.sparc.elf (PID: 6312)	Shell command executed: sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"	Jump to behavior
Source: /tmp/yakuza.sparc.elf (PID: 6322)	Shell command executed: sh -c "pkill -9 LOLKIKEEEDDE \|\| busybox pkill -9 LOLKIKEEEDDE"	Jump to behavior
Source: /tmp/yakuza.sparc.elf (PID: 6329)	Shell command executed: sh -c "pkill -9 ekjheory98e \|\| busybox pkill -9 ekjheory98e"	Jump to behavior
Source: /tmp/yakuza.sparc.elf (PID: 6336)	Shell command executed: sh -c "pkill -9 scansh4 \|\| busybox pkill -9 scansh4"	Jump to behavior
Source: /tmp/yakuza.sparc.elf (PID: 6340)	Shell command executed: sh -c "pkill -9 MDMA \|\| busybox pkill -9 MDMA"	Jump to behavior
Source: /tmp/yakuza.sparc.elf (PID: 6371)	Shell command executed: sh -c "pkill -9 fdevalvex \|\| busybox pkill -9 fdevalvex"	Jump to behavior
Source: /tmp/yakuza.sparc.elf (PID: 6378)	Shell command executed: sh -c "pkill -9 scanspc \|\| busybox pkill -9 scanspc"	Jump to behavior
Source: /tmp/yakuza.sparc.elf (PID: 6387)	Shell command executed: sh -c "pkill -9 MELTEDNINJAREALZ \|\| busybox pkill -9 MELTEDNINJAREALZ"	Jump to behavior
Source: /tmp/yakuza.sparc.elf (PID: 6394)	Shell command executed: sh -c "pkill -9 flexsonskids \|\| busybox pkill -9 flexsonskids"	Jump to behavior
Source: /tmp/yakuza.sparc.elf (PID: 6401)	Shell command executed: sh -c "pkill -9 scanx86 \|\| busybox pkill -9 scanx86"	Jump to behavior
Source: /tmp/yakuza.sparc.elf (PID: 6411)	Shell command executed: sh -c "pkill -9 MISAKI-U79OL \|\| busybox pkill -9 MISAKI-U79OL"
Source: /tmp/yakuza.sparc.elf (PID: 6415)	Shell command executed: sh -c "pkill -9 foAxi102kxe \|\| busybox pkill -9 foAxi102kxe"
Source: /tmp/yakuza.sparc.elf (PID: 6422)	Shell command executed: sh -c "pkill -9 swodjwodjwoj \|\| busybox pkill -9 swodjwodjwoj"
Source: /tmp/yakuza.sparc.elf (PID: 6431)	Shell command executed: sh -c "pkill -9 MmKiy7f87l \|\| busybox pkill -9 MmKiy7f87l"
Source: /tmp/yakuza.sparc.elf (PID: 6438)	Shell command executed: sh -c "pkill -9 freecookiex86 \|\| busybox pkill -9 freecookiex86"
Source: /tmp/yakuza.sparc.elf (PID: 6445)	Shell command executed: sh -c "pkill -9 sysgpu \|\| busybox pkill -9 sysgpu"
Source: /tmp/yakuza.sparc.elf (PID: 6454)	Shell command executed: sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
Source: /tmp/yakuza.sparc.elf (PID: 6462)	Shell command executed: sh -c "pkill -9 frgege \|\| busybox pkill -9 frgege"
Source: /tmp/yakuza.sparc.elf (PID: 6470)	Shell command executed: sh -c "pkill -9 sysupdater \|\| busybox pkill -9 sysupdater"
Source: /tmp/yakuza.sparc.elf (PID: 6479)	Shell command executed: sh -c "pkill -9 0DnAzepd \|\| busybox pkill -9 0DnAzepd"
Source: /tmp/yakuza.sparc.elf (PID: 6483)	Shell command executed: sh -c "pkill -9 NiGGeRD0nks69 \|\| busybox pkill -9 NiGGeRD0nks69"
Source: /tmp/yakuza.sparc.elf (PID: 6490)	Shell command executed: sh -c "pkill -9 frgreu \|\| busybox pkill -9 frgreu"
Source: /tmp/yakuza.sparc.elf (PID: 6501)	Shell command executed: sh -c "pkill -9 telnetd \|\| busybox pkill -9 telnetd"
Source: /tmp/yakuza.sparc.elf (PID: 6505)	Shell command executed: sh -c "pkill -9 0x766f6964 \|\| busybox pkill -9 0x766f6964"
Source: /tmp/yakuza.sparc.elf (PID: 6514)	Shell command executed: sh -c "pkill -9 NiGGeRd0nks1337 \|\| busybox pkill -9 NiGGeRd0nks1337"
Source: /tmp/yakuza.sparc.elf (PID: 6518)	Shell command executed: sh -c "pkill -9 gaft \|\| busybox pkill -9 gaft"
Source: /tmp/yakuza.sparc.elf (PID: 6525)	Shell command executed: sh -c "pkill -9 urasgbsigboa \|\| busybox pkill -9 urasgbsigboa"
Source: /tmp/yakuza.sparc.elf (PID: 6535)	Shell command executed: sh -c "pkill -9 120i3UI49 \|\| busybox pkill -9 120i3UI49"
Source: /tmp/yakuza.sparc.elf (PID: 6542)	Shell command executed: sh -c "pkill -9 OaF3 \|\| busybox pkill -9 OaF3"
Source: /tmp/yakuza.sparc.elf (PID: 6549)	Shell command executed: sh -c "pkill -9 geae \|\| busybox pkill -9 geae"
Source: /tmp/yakuza.sparc.elf (PID: 6558)	Shell command executed: sh -c "pkill -9 vaiolmao \|\| busybox pkill -9 vaiolmao"
Source: /tmp/yakuza.sparc.elf (PID: 6565)	Shell command executed: sh -c "pkill -9 123123a \|\| busybox pkill -9 123123a"
Source: /tmp/yakuza.sparc.elf (PID: 6572)	Shell command executed: sh -c "pkill -9 Ofurain0n4H34D \|\| busybox pkill -9 Ofurain0n4H34D"
Source: /tmp/yakuza.sparc.elf (PID: 6581)	Shell command executed: sh -c "pkill -9 ggTrex \|\| busybox pkill -9 ggTrex"
Source: /tmp/yakuza.sparc.elf (PID: 6589)	Shell command executed: sh -c "pkill -9 wasads \|\| busybox pkill -9 wasads"
Source: /tmp/yakuza.sparc.elf (PID: 6597)	Shell command executed: sh -c "pkill -9 1293194hjXD \|\| busybox pkill -9 1293194hjXD"
Source: /tmp/yakuza.sparc.elf (PID: 6606)	Shell command executed: sh -c "pkill -9 OthLaLosn \|\| busybox pkill -9 OthLaLosn"
Source: /tmp/yakuza.sparc.elf (PID: 6610)	Shell command executed: sh -c "pkill -9 ggt \|\| busybox pkill -9 ggt"
Source: /tmp/yakuza.sparc.elf (PID: 6617)	Shell command executed: sh -c "pkill -9 wget-log \|\| busybox pkill -9 wget-log"
Source: /tmp/yakuza.sparc.elf (PID: 6623)	Shell command executed: sh -c "pkill -9 1337SoraLOADER \|\| busybox pkill -9 1337SoraLOADER"
Source: /tmp/yakuza.sparc.elf (PID: 6630)	Shell command executed: sh -c "pkill -9 SAIAKINA \|\| busybox pkill -9 SAIAKINA"
Source: /tmp/yakuza.sparc.elf (PID: 6636)	Shell command executed: sh -c "pkill -9 ggtq \|\| busybox pkill -9 ggtq"
Source: /tmp/yakuza.sparc.elf (PID: 6643)	Shell command executed: sh -c "pkill -9 1378bfp919GRB1Q2 \|\| busybox pkill -9 1378bfp919GRB1Q2"
Source: /tmp/yakuza.sparc.elf (PID: 6650)	Shell command executed: sh -c "pkill -9 SAIAKUSO \|\| busybox pkill -9 SAIAKUSO"
Source: /tmp/yakuza.sparc.elf (PID: 6658)	Shell command executed: sh -c "pkill -9 ggtr \|\| busybox pkill -9 ggtr"
Source: /tmp/yakuza.sparc.elf (PID: 6667)	Shell command executed: sh -c "pkill -9 14Fa \|\| busybox pkill -9 14Fa"
Source: /tmp/yakuza.sparc.elf (PID: 6674)	Shell command executed: sh -c "pkill -9 SEXSLAVE1337 \|\| busybox pkill -9 SEXSLAVE1337"
Source: /tmp/yakuza.sparc.elf (PID: 6680)	Shell command executed: sh -c "pkill -9 ggtt \|\| busybox pkill -9 ggtt"
Source: /tmp/yakuza.sparc.elf (PID: 6684)	Shell command executed: sh -c "pkill -9 1902a3u912u3u4 \|\| busybox pkill -9 1902a3u912u3u4"
Source: /tmp/yakuza.sparc.elf (PID: 6691)	Shell command executed: sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"
Source: /tmp/yakuza.sparc.elf (PID: 6696)	Shell command executed: sh -c "pkill -9 haetrghbr \|\| busybox pkill -9 haetrghbr"
Source: /tmp/yakuza.sparc.elf (PID: 6705)	Shell command executed: sh -c "pkill -9 19ju3d \|\| busybox pkill -9 19ju3d"
Source: /tmp/yakuza.sparc.elf (PID: 6713)	Shell command executed: sh -c "pkill -9 SORAojkf120 \|\| busybox pkill -9 SORAojkf120"
Source: /tmp/yakuza.sparc.elf (PID: 6723)	Shell command executed: sh -c "pkill -9 hehahejeje92 \|\| busybox pkill -9 hehahejeje92"
Source: /tmp/yakuza.sparc.elf (PID: 6730)	Shell command executed: sh -c "pkill -9 2U2JDJA901F91 \|\| busybox pkill -9 2U2JDJA901F91"
Source: /tmp/yakuza.sparc.elf (PID: 6737)	Shell command executed: sh -c "pkill -9 SlaVLav12 \|\| busybox pkill -9 SlaVLav12"
Source: /tmp/yakuza.sparc.elf (PID: 6748)	Shell command executed: sh -c "pkill -9 helpmedaddthhhhh \|\| busybox pkill -9 helpmedaddthhhhh"
Source: /tmp/yakuza.sparc.elf (PID: 6752)	Shell command executed: sh -c "pkill -9 2wgg9qphbq \|\| busybox pkill -9 2wgg9qphbq"
Source: /tmp/yakuza.sparc.elf (PID: 6759)	Shell command executed: sh -c "pkill -9 Slav3Th3seD3vices \|\| busybox pkill -9 Slav3Th3seD3vices"
Source: /tmp/yakuza.sparc.elf (PID: 6768)	Shell command executed: sh -c "pkill -9 hzSmYZjYMQ \|\| busybox pkill -9 hzSmYZjYMQ"
Source: /tmp/yakuza.sparc.elf (PID: 6775)	Shell command executed: sh -c "pkill -9 5Gbf \|\| busybox pkill -9 5Gbf"
Source: /tmp/yakuza.sparc.elf (PID: 6779)	Shell command executed: sh -c "pkill -9 SoRAxD123LOL \|\| busybox pkill -9 SoRAxD123LOL"
Source: /tmp/yakuza.sparc.elf (PID: 6789)	Shell command executed: sh -c "pkill -9 iaGv \|\| busybox pkill -9 iaGv"
Source: /tmp/yakuza.sparc.elf (PID: 6793)	Shell command executed: sh -c "pkill -9 5aA3 \|\| busybox pkill -9 5aA3"

Source: /bin/sh (PID: 6249)	Pkill executable: /usr/bin/pkill -> pkill -9 902i13	Jump to behavior
Source: /bin/sh (PID: 6270)	Pkill executable: /usr/bin/pkill -> pkill -9 BzSxLxBxeY	Jump to behavior
Source: /bin/sh (PID: 6289)	Pkill executable: /usr/bin/pkill -> pkill -9 HOHO-LUGO7	Jump to behavior
Source: /bin/sh (PID: 6293)	Pkill executable: /usr/bin/pkill -> pkill -9 HOHO-U79OL	Jump to behavior
Source: /bin/sh (PID: 6300)	Pkill executable: /usr/bin/pkill -> pkill -9 JuYfouyf87	Jump to behavior
Source: /bin/sh (PID: 6309)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeR69xd	Jump to behavior
Source: /bin/sh (PID: 6318)	Pkill executable: /usr/bin/pkill -> pkill -9 SO190Ij1X	Jump to behavior
Source: /bin/sh (PID: 6327)	Pkill executable: /usr/bin/pkill -> pkill -9 LOLKIKEEEDDE	Jump to behavior
Source: /bin/sh (PID: 6334)	Pkill executable: /usr/bin/pkill -> pkill -9 ekjheory98e	Jump to behavior
Source: /bin/sh (PID: 6338)	Pkill executable: /usr/bin/pkill -> pkill -9 scansh4	Jump to behavior
Source: /bin/sh (PID: 6345)	Pkill executable: /usr/bin/pkill -> pkill -9 MDMA	Jump to behavior
Source: /bin/sh (PID: 6376)	Pkill executable: /usr/bin/pkill -> pkill -9 fdevalvex	Jump to behavior
Source: /bin/sh (PID: 6383)	Pkill executable: /usr/bin/pkill -> pkill -9 scanspc	Jump to behavior
Source: /bin/sh (PID: 6392)	Pkill executable: /usr/bin/pkill -> pkill -9 MELTEDNINJAREALZ	Jump to behavior
Source: /bin/sh (PID: 6399)	Pkill executable: /usr/bin/pkill -> pkill -9 flexsonskids	Jump to behavior
Source: /bin/sh (PID: 6407)	Pkill executable: /usr/bin/pkill -> pkill -9 scanx86	Jump to behavior
Source: /bin/sh (PID: 6413)	Pkill executable: /usr/bin/pkill -> pkill -9 MISAKI-U79OL
Source: /bin/sh (PID: 6420)	Pkill executable: /usr/bin/pkill -> pkill -9 foAxi102kxe
Source: /bin/sh (PID: 6425)	Pkill executable: /usr/bin/pkill -> pkill -9 swodjwodjwoj
Source: /bin/sh (PID: 6436)	Pkill executable: /usr/bin/pkill -> pkill -9 MmKiy7f87l
Source: /bin/sh (PID: 6443)	Pkill executable: /usr/bin/pkill -> pkill -9 freecookiex86
Source: /bin/sh (PID: 6450)	Pkill executable: /usr/bin/pkill -> pkill -9 sysgpu
Source: /bin/sh (PID: 6459)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeR69xd
Source: /bin/sh (PID: 6468)	Pkill executable: /usr/bin/pkill -> pkill -9 frgege
Source: /bin/sh (PID: 6475)	Pkill executable: /usr/bin/pkill -> pkill -9 sysupdater
Source: /bin/sh (PID: 6481)	Pkill executable: /usr/bin/pkill -> pkill -9 0DnAzepd
Source: /bin/sh (PID: 6488)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeRD0nks69
Source: /bin/sh (PID: 6495)	Pkill executable: /usr/bin/pkill -> pkill -9 frgreu
Source: /bin/sh (PID: 6503)	Pkill executable: /usr/bin/pkill -> pkill -9 telnetd
Source: /bin/sh (PID: 6510)	Pkill executable: /usr/bin/pkill -> pkill -9 0x766f6964
Source: /bin/sh (PID: 6516)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeRd0nks1337
Source: /bin/sh (PID: 6523)	Pkill executable: /usr/bin/pkill -> pkill -9 gaft
Source: /bin/sh (PID: 6531)	Pkill executable: /usr/bin/pkill -> pkill -9 urasgbsigboa
Source: /bin/sh (PID: 6540)	Pkill executable: /usr/bin/pkill -> pkill -9 120i3UI49
Source: /bin/sh (PID: 6547)	Pkill executable: /usr/bin/pkill -> pkill -9 OaF3
Source: /bin/sh (PID: 6554)	Pkill executable: /usr/bin/pkill -> pkill -9 geae
Source: /bin/sh (PID: 6563)	Pkill executable: /usr/bin/pkill -> pkill -9 vaiolmao
Source: /bin/sh (PID: 6570)	Pkill executable: /usr/bin/pkill -> pkill -9 123123a
Source: /bin/sh (PID: 6577)	Pkill executable: /usr/bin/pkill -> pkill -9 Ofurain0n4H34D
Source: /bin/sh (PID: 6586)	Pkill executable: /usr/bin/pkill -> pkill -9 ggTrex
Source: /bin/sh (PID: 6595)	Pkill executable: /usr/bin/pkill -> pkill -9 wasads
Source: /bin/sh (PID: 6602)	Pkill executable: /usr/bin/pkill -> pkill -9 1293194hjXD
Source: /bin/sh (PID: 6608)	Pkill executable: /usr/bin/pkill -> pkill -9 OthLaLosn
Source: /bin/sh (PID: 6615)	Pkill executable: /usr/bin/pkill -> pkill -9 ggt
Source: /bin/sh (PID: 6619)	Pkill executable: /usr/bin/pkill -> pkill -9 wget-log
Source: /bin/sh (PID: 6628)	Pkill executable: /usr/bin/pkill -> pkill -9 1337SoraLOADER
Source: /bin/sh (PID: 6632)	Pkill executable: /usr/bin/pkill -> pkill -9 SAIAKINA
Source: /bin/sh (PID: 6641)	Pkill executable: /usr/bin/pkill -> pkill -9 ggtq
Source: /bin/sh (PID: 6648)	Pkill executable: /usr/bin/pkill -> pkill -9 1378bfp919GRB1Q2
Source: /bin/sh (PID: 6656)	Pkill executable: /usr/bin/pkill -> pkill -9 SAIAKUSO
Source: /bin/sh (PID: 6663)	Pkill executable: /usr/bin/pkill -> pkill -9 ggtr
Source: /bin/sh (PID: 6672)	Pkill executable: /usr/bin/pkill -> pkill -9 14Fa
Source: /bin/sh (PID: 6676)	Pkill executable: /usr/bin/pkill -> pkill -9 SEXSLAVE1337
Source: /bin/sh (PID: 6682)	Pkill executable: /usr/bin/pkill -> pkill -9 ggtt
Source: /bin/sh (PID: 6689)	Pkill executable: /usr/bin/pkill -> pkill -9 1902a3u912u3u4
Source: /bin/sh (PID: 6693)	Pkill executable: /usr/bin/pkill -> pkill -9 SO190Ij1X
Source: /bin/sh (PID: 6701)	Pkill executable: /usr/bin/pkill -> pkill -9 haetrghbr
Source: /bin/sh (PID: 6710)	Pkill executable: /usr/bin/pkill -> pkill -9 19ju3d
Source: /bin/sh (PID: 6719)	Pkill executable: /usr/bin/pkill -> pkill -9 SORAojkf120
Source: /bin/sh (PID: 6728)	Pkill executable: /usr/bin/pkill -> pkill -9 hehahejeje92
Source: /bin/sh (PID: 6735)	Pkill executable: /usr/bin/pkill -> pkill -9 2U2JDJA901F91
Source: /bin/sh (PID: 6742)	Pkill executable: /usr/bin/pkill -> pkill -9 SlaVLav12
Source: /bin/sh (PID: 6750)	Pkill executable: /usr/bin/pkill -> pkill -9 helpmedaddthhhhh
Source: /bin/sh (PID: 6757)	Pkill executable: /usr/bin/pkill -> pkill -9 2wgg9qphbq
Source: /bin/sh (PID: 6764)	Pkill executable: /usr/bin/pkill -> pkill -9 Slav3Th3seD3vices
Source: /bin/sh (PID: 6772)	Pkill executable: /usr/bin/pkill -> pkill -9 hzSmYZjYMQ
Source: /bin/sh (PID: 6777)	Pkill executable: /usr/bin/pkill -> pkill -9 5Gbf
Source: /bin/sh (PID: 6785)	Pkill executable: /usr/bin/pkill -> pkill -9 SoRAxD123LOL
Source: /bin/sh (PID: 6791)	Pkill executable: /usr/bin/pkill -> pkill -9 iaGv
Source: /bin/sh (PID: 6798)	Pkill executable: /usr/bin/pkill -> pkill -9 5aA3

Source: /usr/bin/pkill (PID: 6249)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6270)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6289)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6293)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6300)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6309)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6318)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6327)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6334)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6338)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6345)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6376)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6383)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6392)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6399)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6407)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6413)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6420)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6425)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6436)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6443)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6450)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6459)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6468)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6475)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6481)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6488)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6495)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6503)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6510)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6516)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6523)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6531)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6540)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6547)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6554)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6563)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6570)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6577)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6586)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6595)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6602)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6608)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6615)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6619)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6628)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6632)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6641)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6648)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6656)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6663)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6672)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6676)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6682)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6689)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6693)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6701)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6710)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6719)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6728)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6735)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6742)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6750)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6757)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6764)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6772)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6777)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6785)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6791)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6798)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/yakuza.sparc.elf (PID: 6235)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6264)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6283)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6290)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6294)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6303)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6311)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6321)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6328)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6335)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6339)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6370)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6377)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6386)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6393)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6400)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6408)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6414)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6421)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6430)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6437)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6444)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6453)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6461)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6469)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6478)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6482)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6489)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6500)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6504)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6513)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6517)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6524)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6534)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6541)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6548)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6557)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6564)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6571)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6580)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6588)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6596)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6605)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6609)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6616)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6622)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6629)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6635)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6642)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6649)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6657)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6666)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6673)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6679)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6683)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6690)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6695)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6704)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6712)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6722)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6729)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6736)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6747)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6751)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6758)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6767)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6774)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6778)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6788)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6792)	Queries kernel information via 'uname':

Source: yakuza.sparc.elf, 6235.1.0000562f0bb2b000.0000562f0bb90000.rw-.sdmp, yakuza.sparc.elf, 6240.1.0000562f0bb2b000.0000562f0bb90000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: yakuza.sparc.elf, 6235.1.0000562f0bb2b000.0000562f0bb90000.rw-.sdmp, yakuza.sparc.elf, 6240.1.0000562f0bb2b000.0000562f0bb90000.rw-.sdmp	Binary or memory string: /V!/etc/qemu-binfmt/sparc
Source: yakuza.sparc.elf, 6235.1.00007ffd38ac9000.00007ffd38aea000.rw-.sdmp, yakuza.sparc.elf, 6240.1.00007ffd38ac9000.00007ffd38aea000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/yakuza.sparc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/yakuza.sparc.elf
Source: yakuza.sparc.elf, 6235.1.00007ffd38ac9000.00007ffd38aea000.rw-.sdmp, yakuza.sparc.elf, 6240.1.00007ffd38ac9000.00007ffd38aea000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: yakuza.sparc.elf, type: SAMPLE
Source: Yara match	File source: 6235.1.00007f4208011000.00007f420802f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6240.1.00007f4208011000.00007f420802f000.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U;) Presto/2.7.62 Version/11.01
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; U; de; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.62
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0) Gecko/20110517 Firefox/5.0 Fennec/5.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (compatible; Teleca Q7; Brew 3.1.5; U; en) 480X800 LGE VX11000

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: yakuza.sparc.elf, type: SAMPLE
Source: Yara match	File source: 6235.1.00007f4208011000.00007f420802f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6240.1.00007f4208011000.00007f420802f000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	1 Brute Force	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
yakuza.sparc.elf	45%	ReversingLabs	Linux.Backdoor.Bushido

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pirati.privatedns.org	79.12.214.240	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://youtu.be/dQw4w9WgXcQ	yakuza.sparc.elf	false	high
http://linux-it.abuser.eu/yak.sh;	yakuza.sparc.elf	false	high
https://youtu.be/dQw4w9WgXcQNever	yakuza.sparc.elf	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	yakuza.arm4.elf	Get hash	malicious	Mirai	Browse
	yakuza.mipsel.elf	Get hash	malicious	Mirai	Browse
	yakuza.arm7.elf	Get hash	malicious	Mirai	Browse
	yakuza.ppc.elf	Get hash	malicious	Mirai	Browse
	most-mips.elf	Get hash	malicious	Mirai	Browse
	most-mpsl.elf	Get hash	malicious	Mirai	Browse
	arm4.elf	Get hash	malicious	Gafgyt	Browse
	mpsl.elf	Get hash	malicious	Gafgyt	Browse
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse
	CONSTANT_STRATEGY.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	yakuza.arm4.elf	Get hash	malicious	Mirai	Browse
	yakuza.mipsel.elf	Get hash	malicious	Mirai	Browse
	yakuza.arm7.elf	Get hash	malicious	Mirai	Browse
	yakuza.ppc.elf	Get hash	malicious	Mirai	Browse
	most-mips.elf	Get hash	malicious	Mirai	Browse
	most-mpsl.elf	Get hash	malicious	Mirai	Browse
	arm4.elf	Get hash	malicious	Gafgyt	Browse
	mpsl.elf	Get hash	malicious	Gafgyt	Browse
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse
	CONSTANT_STRATEGY.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pirati.privatedns.org	yakuza.arm4.elf	Get hash	malicious	Mirai	Browse	79.12.214.240
	yakuza.mipsel.elf	Get hash	malicious	Mirai	Browse	79.12.214.240
	yakuza.arm7.elf	Get hash	malicious	Mirai	Browse	212.171.15.94
	yakuza.i686.elf	Get hash	malicious	Mirai	Browse	212.171.15.94
	yakuza.ppc.elf	Get hash	malicious	Mirai	Browse	212.171.15.94

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	yakuza.arm4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	yakuza.mipsel.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	yakuza.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	yakuza.ppc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	most-mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	most-mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	arm4.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	x86_64.elf	Get hash	malicious	Gafgyt	Browse	185.125.190.26
	mpsl.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
CANONICAL-ASGB	yakuza.arm4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	yakuza.mipsel.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	yakuza.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	yakuza.ppc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	most-mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	most-mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	arm4.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	x86_64.elf	Get hash	malicious	Gafgyt	Browse	185.125.190.26
	mpsl.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
INIT7CH	yakuza.arm4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	yakuza.mipsel.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	yakuza.arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	yakuza.ppc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	most-mips.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	most-mpsl.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	arm4.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	mpsl.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	CONSTANT_STRATEGY.elf	Get hash	malicious	Unknown	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.040103453119081
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	yakuza.sparc.elf
File size:	155'331 bytes
MD5:	754a74cfe79bd7c15d239cbf196e21bc
SHA1:	dff3324dcd977c8584a65f3a7ebd8c4d278e051f
SHA256:	fd6e4e475534357b76a302cada4d5ab98810cb9ae025b1d4ac3ed5b650cff29c
SHA512:	27af1110931c14046256da65562234c3f850e68b916cb696d6bb8a7f6deaf2c887d35e17e589b0466d49199e6a22b7718225bb538c0dcf4d35c6cdded7f665da
SSDEEP:	3072:Tn2DjacxvKM9F0pUZFFAY9ejVylRyL2GvOWfDl49/1TZGI:TQmMKM9FEUCKQEy6GvOWfDl4J1TZGI
TLSH:	A7E3193B27231E33C1D1287102E70331B6BED799386957DBB9C46CAC2F1AA8435567E9
File Content Preview:	.ELF...........................4...8.....4. ...(.......................<...<...............<...<...<................dt.Q................................@..(....@.^.................#.....`...`.....!.....#T..@.....".........`......$#T..#T..@...........`....

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	Sparc
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x101a4
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	128824
Section Header Size:	40
Number of Section Headers:	24
Header String Table Index:	21

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x10094	0x94	0x1c	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x100b0	0xb0	0x17b20	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x27bd0	0x17bd0	0x14	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x27be8	0x17be8	0x5b50	0x0	0x2	A	0	0	8
.eh_frame	PROGBITS	0x2d738	0x1d738	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x3d73c	0x1d73c	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x3d744	0x1d744	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x3d74c	0x1d74c	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x3d750	0x1d750	0xd84	0x0	0x3	WA	0	0	8
.bss	NOBITS	0x3e4d8	0x1e4d4	0x7808	0x0	0x3	WA	0	0	8
.comment	PROGBITS	0x0	0x1e4d4	0xca8	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1f17c	0x20	0x0	0x0		0	0	1
.debug_pubnames	PROGBITS	0x0	0x1f19c	0x1f	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1f1bb	0x16e	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1f329	0xfb	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1f424	0x7c	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1f4a0	0x28	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x1f4c8	0x10b	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x1f5d3	0x6e	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x1f641	0x18	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1f659	0xdc	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1faf8	0x3950	0x10	0x0		23	309	4
.strtab	STRTAB	0x0	0x23448	0x2a7b	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0x1d73c	0x1d73c	6.0754	0x5	R E	0x10000	.init .text .fini .rodata .eh_frame
LOAD	0x1d73c	0x3d73c	0x3d73c	0xd98	0x85a4	4.1299	0x6	RW	0x10000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x10094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x100b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x27bd0	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x27be8	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x2d738	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x3d73c	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x3d744	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x3d74c	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x3d750	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x3e4d8	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
.rem	.symtab	0x1ae84	44	FUNC	<unknown>	DEFAULT	2
.udiv	.symtab	0x1ae64	20	FUNC	<unknown>	DEFAULT	2
.umul	.symtab	0x1ae78	12	FUNC	<unknown>	DEFAULT	2
.urem	.symtab	0x1ae44	32	FUNC	<unknown>	DEFAULT	2
C.72.5511	.symtab	0x29db0	36	OBJECT	<unknown>	DEFAULT	4
C.90.5732	.symtab	0x2a4c4	312	OBJECT	<unknown>	DEFAULT	4
ClearHistory	.symtab	0x17e98	64	FUNC	<unknown>	DEFAULT	2
HTTP	.symtab	0x12f70	372	FUNC	<unknown>	DEFAULT	2
Q	.symtab	0x3e914	16384	OBJECT	<unknown>	DEFAULT	10
Send	.symtab	0x10528	132	FUNC	<unknown>	DEFAULT	2
UserAgents	.symtab	0x3da84	144	OBJECT	<unknown>	DEFAULT	9
_352	.symtab	0x199c0	28	FUNC	<unknown>	DEFAULT	2
_376	.symtab	0x198d0	188	FUNC	<unknown>	DEFAULT	2
_433	.symtab	0x199dc	100	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_NICK	.symtab	0x19a40	324	FUNC	<unknown>	DEFAULT	2
_PING	.symtab	0x1998c	52	FUNC	<unknown>	DEFAULT	2
_PRIVMSG	.symtab	0x18aa8	3624	FUNC	<unknown>	DEFAULT	2
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x3d740	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x3d73c	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x3e478	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x2cfe2	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x3e480	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x2d2e2	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x3e150	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x2bee0	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x3d748	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x3d744	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x2d738	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x2d738	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x3e478	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x2cfe2	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x3e480	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x2d2e2	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x3e150	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x2bee0	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x3e47c	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x3e484	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x3e154	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x1b4e8	12	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x2488c	328	FUNC	<unknown>	HIDDEN	2
__GI___fputc_unlocked	.symtab	0x1d5a8	292	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x1faac	32	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x23ab4	12	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x1aeb0	136	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x1af38	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x2388c	120	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x23200	132	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x232d8	104	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x1facc	284	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x23628	64	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x26b0c	316	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x21ae0	76	FUNC	<unknown>	HIDDEN	2
__GI_asprintf	.symtab	0x1b778	48	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x22920	24	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x22920	24	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x21b2c	36	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x26c64	60	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x1af9c	68	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x23668	72	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x1afe0	68	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x21b50	76	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x236b0	72	FUNC	<unknown>	HIDDEN	2
__GI_endservent	.symtab	0x25338	100	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x4498c	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x22b8c	152	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x236f8	76	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x22b0c	128	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x1b4f4	324	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x1aeb0	136	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x1af38	100	FUNC	<unknown>	HIDDEN	2
__GI_fdopen	.symtab	0x23be0	52	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x1d344	420	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x2488c	328	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x1d0ac	100	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1d4e8	192	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x1b638	24	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x1ae10	52	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x1b748	48	FUNC	<unknown>	HIDDEN	2
__GI_fputc	.symtab	0x1d110	192	FUNC	<unknown>	HIDDEN	2
__GI_fputs	.symtab	0x1d1d0	96	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x1d6cc	60	FUNC	<unknown>	HIDDEN	2
__GI_freeaddrinfo	.symtab	0x209d8	40	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x26cf0	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x26d80	272	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x1d708	176	FUNC	<unknown>	HIDDEN	2
__GI_getaddrinfo	.symtab	0x20a00	784	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x2488c	328	FUNC	<unknown>	HIDDEN	2
__GI_getcwd	.symtab	0x1b024	264	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1b12c	40	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x23744	64	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x23784	64	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x237c4	64	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyaddr_r	.symtab	0x217d0	784	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x21508	712	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x265fc	768	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x1b154	32	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x1b174	64	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x1b1f4	72	FUNC	<unknown>	HIDDEN	2
__GI_getservbyname_r	.symtab	0x25520	252	FUNC	<unknown>	HIDDEN	2
__GI_getservbyport	.symtab	0x254e0	64	FUNC	<unknown>	HIDDEN	2
__GI_getservbyport_r	.symtab	0x25420	192	FUNC	<unknown>	HIDDEN	2
__GI_getservent_r	.symtab	0x250e4	540	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x23804	64	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x44990	4	OBJECT	<unknown>	HIDDEN	10
__GI_if_freenameindex	.symtab	0x25938	64	FUNC	<unknown>	HIDDEN	2
__GI_if_nameindex	.symtab	0x25790	424	FUNC	<unknown>	HIDDEN	2
__GI_if_nametoindex	.symtab	0x256f4	156	FUNC	<unknown>	HIDDEN	2
__GI_in6addr_loopback	.symtab	0x2cf64	16	OBJECT	<unknown>	HIDDEN	4
__GI_inet_addr	.symtab	0x214e0	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x25978	220	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x214bc	36	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x2144c	112	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x211a0	684	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x20ddc	544	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x226fc	228	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x1b23c	100	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1fd10	32	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x1b2a0	72	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x21bf0	28	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x279e0	112	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x24a54	280	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x1dde4	4212	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1d800	1508	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x24eac	32	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x24ecc	272	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x1ee8c	416	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x23844	72	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x2388c	120	FUNC	<unknown>	HIDDEN	2
__GI_perror	.symtab	0x1b650	80	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x2391c	68	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x1b2e8	76	FUNC	<unknown>	HIDDEN	2
__GI_putc	.symtab	0x1d110	192	FUNC	<unknown>	HIDDEN	2
__GI_putc_unlocked	.symtab	0x1d5a8	292	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x279c8	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x222fc	80	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x2257c	156	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x270f8	204	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x27a50	76	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x21c0c	32	FUNC	<unknown>	HIDDEN	2
__GI_rewind	.symtab	0x26d14	108	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x23960	84	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x1b334	84	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x21c2c	32	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x21c4c	88	FUNC	<unknown>	HIDDEN	2
__GI_setservent	.symtab	0x2539c	132	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x1b388	64	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x21ca4	44	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x22458	292	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x26930	160	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x269d0	188	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x239b4	140	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x22c24	428	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x21cd0	76	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x1b7a8	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x22618	228	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x1fbe8	92	FUNC	<unknown>	HIDDEN	2
__GI_strcasestr	.symtab	0x1fc44	124	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x24be0	524	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x1f0c0	648	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x1f0c0	648	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x1f3b0	804	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x1fcc0	56	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x1f73c	120	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x271c4	224	FUNC	<unknown>	HIDDEN	2
__GI_strncmp	.symtab	0x1f7b4	260	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x1f8b8	248	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x1f9b0	252	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x25058	80	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x24dec	192	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x272a4	112	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x1fcf8	24	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x24fdc	124	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x22938	20	FUNC	<unknown>	HIDDEN	2
__GI_strtoul	.symtab	0x2294c	20	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x23028	400	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1fd30	112	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x1b3c8	72	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x23a90	36	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x1b4c4	36	FUNC	<unknown>	HIDDEN	2
__GI_vasprintf	.symtab	0x1b7dc	116	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x235ac	52	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x1c034	148	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x1b850	156	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x23a40	80	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x1b464	20	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x23ac0	72	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x23b24	188	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x23b08	28	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x1b478	76	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x3d74c	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x3d74c	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x44980	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x3e45c	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x269d0	188	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x3e4d4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x23294	68	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x3e47c	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x3e484	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x3e154	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x449d0	4	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x3d758	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x2759c	240	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x25a54	196	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x27430	208	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x25b18	1852	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x27b88	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x100b0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x3d750	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x27a9c	164	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x27314	284	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x27500	120	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x44978	4	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x1b4e8	12	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x44970	4	OBJECT	<unknown>	HIDDEN	10
__fgetc_unlocked	.symtab	0x2488c	328	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x3d73c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x3d73c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fputc_unlocked	.symtab	0x1d5a8	292	FUNC	<unknown>	DEFAULT	2
__get_hosts_byaddr_r	.symtab	0x26574	136	FUNC	<unknown>	HIDDEN	2
__get_hosts_byname_r	.symtab	0x2653c	56	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x1b154	32	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x1faac	32	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x23ab4	12	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_alloc	.symtab	0x2205c	160	FUNC	<unknown>	DEFAULT	2
__heap_alloc_at	.symtab	0x220fc	156	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x221e0	268	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x22198	48	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x221c8	24	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x3d73c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x3d73c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__initbuf	.symtab	0x250a8	60	FUNC	<unknown>	DEFAULT	2
__length_dotted	.symtab	0x27b40	72	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x27578	36	FUNC	<unknown>	HIDDEN	2
__libc_accept	.symtab	0x21ae0	76	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x1afe0	68	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x21b50	76	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x23904	24	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x1aeb0	136	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x1af38	100	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x1ae10	52	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x1b174	64	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x279e0	112	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x23844	72	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x2388c	120	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x1b2e8	76	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x27a50	76	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x21c0c	32	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x1b334	84	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x21c2c	32	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x21c4c	88	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x26930	160	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x44974	4	OBJECT	<unknown>	DEFAULT	10
__libc_system	.symtab	0x227e0	320	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x1b464	20	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x1b478	76	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x3e298	4	OBJECT	<unknown>	DEFAULT	9
__malloc_heap_lock	.symtab	0x44958	24	OBJECT	<unknown>	DEFAULT	10
__malloc_sbrk_lock	.symtab	0x45c18	24	OBJECT	<unknown>	DEFAULT	10
__muldi3	.symtab	0x1ad3c	212	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x45c40	12	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x45c4c	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x2768c	56	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x26254	744	FUNC	<unknown>	HIDDEN	2
__opensock	.symtab	0x268fc	52	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x4497c	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x3d73c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x3d73c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x23284	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x23284	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x23284	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x23284	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x23284	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x2328c	8	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x279c8	24	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x276c4	772	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x3e4a4	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x44984	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x45c30	16	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x45c50	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x26ab4	44	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x26ae0	44	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x26a8c	40	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x235e0	72	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x3e164	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x26e90	104	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x23c14	196	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x26ef8	252	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x23cd8	320	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x1bf30	28	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3860	.symtab	0x2c204	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x26ff4	56	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x270c4	52	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x2702c	152	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x23e18	252	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x1bffc	56	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x3e168	4	OBJECT	<unknown>	DEFAULT	9
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x26ca0	80	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x23200	132	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x232d8	104	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x23340	620	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__ubp_memchr	.symtab	0x24a54	280	FUNC	<unknown>	DEFAULT	2
__uclibc_progname	.symtab	0x3e474	4	OBJECT	<unknown>	HIDDEN	9
__vfork	.symtab	0x235ac	52	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x1facc	284	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x1c0c8	60	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x26c48	28	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x45cd4	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x45cd8	4	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x3e4d4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x45ce0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x4498c	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x23628	64	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x27bd0	8	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x42940	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x1c104	128	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x24118	1908	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x44990	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x10094	8	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x23f14	144	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x1c800	164	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x1cb08	1352	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x1c8a4	60	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x1c8e0	480	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x1cac0	72	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x2328c	8	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x2328c	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x45c54	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x101a4	56	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x1bbf4	732	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x1bed0	96	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x3e16c	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x3e170	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x1d230	276	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x4293c	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x3e188	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x42938	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x3e1a4	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x1bf4c	176	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x3e1a0	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x22960	428	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x23fa4	60	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x2c368	2934	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x23fe0	312	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x1c184	1660	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x26b0c	316	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
accept	.symtab	0x21ae0	76	FUNC	<unknown>	DEFAULT	2
accept.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
actualparent	.symtab	0x44aec	4	OBJECT	<unknown>	DEFAULT	10
advance_telstate	.symtab	0x15fa4	116	FUNC	<unknown>	DEFAULT	2
advances	.symtab	0x3dfb4	28	OBJECT	<unknown>	DEFAULT	9
advances2	.symtab	0x3e014	44	OBJECT	<unknown>	DEFAULT	9
ak47scan	.symtab	0x17a88	296	FUNC	<unknown>	DEFAULT	2
ak47scantoggle	.symtab	0x17bb0	556	FUNC	<unknown>	DEFAULT	2
ak47telscan	.symtab	0x16094	6644	FUNC	<unknown>	DEFAULT	2
append	.symtab	0x185f4	68	FUNC	<unknown>	DEFAULT	2
asprintf	.symtab	0x1b778	48	FUNC	<unknown>	DEFAULT	2
asprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x22920	24	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x22920	24	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x1d7f4	12	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x449cc	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.2818	.symtab	0x44988	4	OBJECT	<unknown>	DEFAULT	10
bind	.symtab	0x21b2c	36	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
blacknurse	.symtab	0x11f5c	868	FUNC	<unknown>	DEFAULT	2
botkill	.symtab	0x17ddc	188	FUNC	<unknown>	DEFAULT	2
brk	.symtab	0x26c64	60	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x269d0	188	FUNC	<unknown>	DEFAULT	2
buf.2628	.symtab	0x44948	16	OBJECT	<unknown>	DEFAULT	10
bzero	.symtab	0x1ee58	52	FUNC	<unknown>	DEFAULT	2
c	.symtab	0x3e050	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x27bc4	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x1012c	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x10198	0	FUNC	<unknown>	DEFAULT	2
capsaicin2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chan	.symtab	0x45c10	4	OBJECT	<unknown>	DEFAULT	10
changeservers	.symtab	0x3e4fc	4	OBJECT	<unknown>	DEFAULT	10
chdir	.symtab	0x1af9c	68	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x23668	72	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x1afe0	68	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.2248	.symtab	0x3e4d8	1	OBJECT	<unknown>	DEFAULT	10
con	.symtab	0x19b84	1076	FUNC	<unknown>	DEFAULT	2
connect	.symtab	0x21b50	76	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
contains_fail	.symtab	0x15ce0	48	FUNC	<unknown>	DEFAULT	2
contains_response	.symtab	0x15d10	104	FUNC	<unknown>	DEFAULT	2
contains_string	.symtab	0x15bdc	212	FUNC	<unknown>	DEFAULT	2
contains_success	.symtab	0x15cb0	48	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x23904	24	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x10218	240	FUNC	<unknown>	DEFAULT	2
data_start	.symtab	0x3d758	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
disable	.symtab	0x11938	408	FUNC	<unknown>	DEFAULT	2
disabled	.symtab	0x3e500	1	OBJECT	<unknown>	DEFAULT	10
dispass	.symtab	0x449d8	256	OBJECT	<unknown>	DEFAULT	10
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dns	.symtab	0x14890	824	FUNC	<unknown>	DEFAULT	2
dns_format	.symtab	0x13f0c	316	FUNC	<unknown>	DEFAULT	2
dns_hdr_create	.symtab	0x14048	136	FUNC	<unknown>	DEFAULT	2
dns_send	.symtab	0x140d0	1396	FUNC	<unknown>	DEFAULT	2
dnsflood	.symtab	0x14644	588	FUNC	<unknown>	DEFAULT	2
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
download	.symtab	0x10f60	1604	FUNC	<unknown>	DEFAULT	2
dup2	.symtab	0x236b0	72	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
enable	.symtab	0x11ad0	352	FUNC	<unknown>	DEFAULT	2
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
endservent	.symtab	0x25338	100	FUNC	<unknown>	DEFAULT	2
environ	.symtab	0x44978	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x4498c	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
estridx	.symtab	0x2c2d8	126	OBJECT	<unknown>	DEFAULT	4
execfile	.symtab	0x44af8	256	OBJECT	<unknown>	DEFAULT	10
execl	.symtab	0x22b8c	152	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x236f8	76	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x22b0c	128	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x2d640	72	OBJECT	<unknown>	DEFAULT	4
fails	.symtab	0x3dfd0	36	OBJECT	<unknown>	DEFAULT	9
fastflux	.symtab	0x1887c	556	FUNC	<unknown>	DEFAULT	2
fclose	.symtab	0x1b4f4	324	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x1aeb0	136	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x1af38	100	FUNC	<unknown>	DEFAULT	2
fdopen	.symtab	0x23be0	52	FUNC	<unknown>	DEFAULT	2
fdopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
feof	.symtab	0x1d050	92	FUNC	<unknown>	DEFAULT	2
feof.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fflush_unlocked	.symtab	0x1d344	420	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x2488c	328	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x1d0ac	100	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x1d4e8	192	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
filter	.symtab	0x10758	176	FUNC	<unknown>	DEFAULT	2
flooders	.symtab	0x3e060	176	OBJECT	<unknown>	DEFAULT	9
fmt	.symtab	0x2d628	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x1b638	24	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x1ae10	52	FUNC	<unknown>	DEFAULT	2
fprintf	.symtab	0x1b748	48	FUNC	<unknown>	DEFAULT	2
fprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputc	.symtab	0x1d110	192	FUNC	<unknown>	DEFAULT	2
fputc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputc_unlocked	.symtab	0x1d5a8	292	FUNC	<unknown>	DEFAULT	2
fputc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs	.symtab	0x1d1d0	96	FUNC	<unknown>	DEFAULT	2
fputs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x1d6cc	60	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x10138	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x21e5c	232	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
freeaddrinfo	.symtab	0x209d8	40	FUNC	<unknown>	DEFAULT	2
fseek	.symtab	0x26cf0	36	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x26cf0	36	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x26d80	272	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x1d708	176	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gaih	.symtab	0x2cee0	24	OBJECT	<unknown>	DEFAULT	4
gaih_inet	.symtab	0x1fe70	2920	FUNC	<unknown>	DEFAULT	2
gaih_inet_serv	.symtab	0x1fdc8	168	FUNC	<unknown>	DEFAULT	2
gaih_inet_typeproto	.symtab	0x2cef8	35	OBJECT	<unknown>	DEFAULT	4
get	.symtab	0x115a4	376	FUNC	<unknown>	DEFAULT	2
getBuild	.symtab	0x101fc	28	FUNC	<unknown>	DEFAULT	2
getDatIP	.symtab	0x154d4	1332	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x12c24	100	FUNC	<unknown>	DEFAULT	2
getPublicIP	.symtab	0x18744	176	FUNC	<unknown>	DEFAULT	2
get_hosts_byaddr_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_telstate_host	.symtab	0x15f64	64	FUNC	<unknown>	DEFAULT	2
getaddrinfo	.symtab	0x20a00	784	FUNC	<unknown>	DEFAULT	2
getaddrinfo.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x2488c	328	FUNC	<unknown>	DEFAULT	2
getcwd	.symtab	0x1b024	264	FUNC	<unknown>	DEFAULT	2
getcwd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x1b12c	40	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x23744	64	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x23784	64	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x237c4	64	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyaddr_r	.symtab	0x217d0	784	FUNC	<unknown>	DEFAULT	2
gethostbyaddr_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x21508	712	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x265fc	768	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getmyip	.symtab	0x187f4	136	FUNC	<unknown>	DEFAULT	2
getpagesize	.symtab	0x1b154	32	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x1b174	64	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x1b1b4	64	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x1b1f4	72	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getservbyname	.symtab	0x2561c	64	FUNC	<unknown>	DEFAULT	2
getservbyname_r	.symtab	0x25520	252	FUNC	<unknown>	DEFAULT	2
getservbyport	.symtab	0x254e0	64	FUNC	<unknown>	DEFAULT	2
getservbyport_r	.symtab	0x25420	192	FUNC	<unknown>	DEFAULT	2
getservent	.symtab	0x25300	56	FUNC	<unknown>	DEFAULT	2
getservent_r	.symtab	0x250e4	540	FUNC	<unknown>	DEFAULT	2
getservice.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x21b9c	84	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x23804	64	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x44990	4	OBJECT	<unknown>	DEFAULT	10
head	.symtab	0x45c00	4	OBJECT	<unknown>	DEFAULT	10
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_alloc_at.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
help	.symtab	0x17f74	1152	FUNC	<unknown>	DEFAULT	2
histClear	.symtab	0x18704	64	FUNC	<unknown>	DEFAULT	2
hold	.symtab	0x13de4	296	FUNC	<unknown>	DEFAULT	2
host2ip	.symtab	0x11c30	228	FUNC	<unknown>	DEFAULT	2
htonl	.symtab	0x1fdb4	8	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x1fdbc	12	FUNC	<unknown>	DEFAULT	2
i.5418	.symtab	0x3e910	4	OBJECT	<unknown>	DEFAULT	10
i.5460	.symtab	0x3e054	4	OBJECT	<unknown>	DEFAULT	9
ident	.symtab	0x44adc	4	OBJECT	<unknown>	DEFAULT	10
identd	.symtab	0x10920	932	FUNC	<unknown>	DEFAULT	2
if_freenameindex	.symtab	0x25938	64	FUNC	<unknown>	DEFAULT	2
if_index.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
if_indextoname	.symtab	0x2565c	152	FUNC	<unknown>	DEFAULT	2
if_nameindex	.symtab	0x25790	424	FUNC	<unknown>	DEFAULT	2
if_nametoindex	.symtab	0x256f4	156	FUNC	<unknown>	DEFAULT	2
in6_addr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
in6addr_any	.symtab	0x2cf54	16	OBJECT	<unknown>	DEFAULT	4
in6addr_loopback	.symtab	0x2cf64	16	OBJECT	<unknown>	DEFAULT	4
in_cksum	.symtab	0x10d58	264	FUNC	<unknown>	DEFAULT	2
index	.symtab	0x24be0	524	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x214e0	40	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x25978	220	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x214bc	36	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x2144c	112	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x211a0	684	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x20ffc	420	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x20ddc	544	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x20d10	204	FUNC	<unknown>	DEFAULT	2
infected	.symtab	0x3e048	8	OBJECT	<unknown>	DEFAULT	9
init_rand	.symtab	0x11d14	228	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initial_fa	.symtab	0x3e2a0	264	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x223ac	96	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x226fc	228	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x1b23c	100	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x1fd10	32	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ismaster	.symtab	0x18638	204	FUNC	<unknown>	DEFAULT	2
junk	.symtab	0x136b0	296	FUNC	<unknown>	DEFAULT	2
key	.symtab	0x45c08	4	OBJECT	<unknown>	DEFAULT	10
kill	.symtab	0x1b2a0	72	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killall	.symtab	0x183f4	352	FUNC	<unknown>	DEFAULT	2
killd	.symtab	0x18554	160	FUNC	<unknown>	DEFAULT	2
knownBots	.symtab	0x3d77c	776	OBJECT	<unknown>	DEFAULT	9
legit	.symtab	0x3e040	8	OBJECT	<unknown>	DEFAULT	9
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/memchr.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/strchr.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/strcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/sparc/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/fork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/rem.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/udiv.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/umul.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/urem.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/sparc/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libgcc2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
limiter	.symtab	0x44ae0	4	OBJECT	<unknown>	DEFAULT	10
listFork	.symtab	0x12744	340	FUNC	<unknown>	DEFAULT	2
listen	.symtab	0x21bf0	28	FUNC	<unknown>	DEFAULT	2
listen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x279e0	112	FUNC	<unknown>	DEFAULT	2
main	.symtab	0x1a0d0	3180	FUNC	<unknown>	DEFAULT	2
makeFukdString	.symtab	0x19fb8	156	FUNC	<unknown>	DEFAULT	2
makeRandomShit	.symtab	0x122c0	156	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x21d1c	320	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
masters	.symtab	0x3d76c	12	OBJECT	<unknown>	DEFAULT	9
memchr	.symtab	0x24a54	280	FUNC	<unknown>	DEFAULT	2
memcpy	.symtab	0x1dde4	4212	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x1d800	1508	FUNC	<unknown>	DEFAULT	2
mempcpy	.symtab	0x24eac	32	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x24ecc	272	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x1ee8c	416	FUNC	<unknown>	DEFAULT	2
mfork	.symtab	0x105ac	428	FUNC	<unknown>	DEFAULT	2
move	.symtab	0x17ed8	156	FUNC	<unknown>	DEFAULT	2
msgs	.symtab	0x3e110	64	OBJECT	<unknown>	DEFAULT	9
mygethostbyname	.symtab	0x10e60	256	FUNC	<unknown>	DEFAULT	2
mylock	.symtab	0x42918	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x3e3a8	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x3e488	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x449b0	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x3e4bc	24	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x23844	72	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
negotiate	.symtab	0x15a08	468	FUNC	<unknown>	DEFAULT	2
next_start.1092	.symtab	0x44940	4	OBJECT	<unknown>	DEFAULT	10
nick	.symtab	0x44ae4	4	OBJECT	<unknown>	DEFAULT	10
nickc	.symtab	0x11754	212	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x1fda0	8	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x1fda8	12	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
nummasters	.symtab	0x3d768	4	OBJECT	<unknown>	DEFAULT	9
numpids	.symtab	0x3e50c	4	OBJECT	<unknown>	DEFAULT	10
numservers	.symtab	0x3d75c	4	OBJECT	<unknown>	DEFAULT	9
object.2329	.symtab	0x3e4dc	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x2388c	120	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opensock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
p.2246	.symtab	0x3d754	0	OBJECT	<unknown>	DEFAULT	9
passwords	.symtab	0x3dd64	592	OBJECT	<unknown>	DEFAULT	9
pclose	.symtab	0x1b8ec	252	FUNC	<unknown>	DEFAULT	2
perror	.symtab	0x1b650	80	FUNC	<unknown>	DEFAULT	2
perror.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pid	.symtab	0x44ad8	4	OBJECT	<unknown>	DEFAULT	10
pids	.symtab	0x45c14	4	OBJECT	<unknown>	DEFAULT	10
pipe	.symtab	0x2391c	68	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
poll	.symtab	0x1b2e8	76	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
popen	.symtab	0x1b9e8	524	FUNC	<unknown>	DEFAULT	2
popen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
popen_list	.symtab	0x42930	4	OBJECT	<unknown>	DEFAULT	10
poww	.symtab	0x10cc4	148	FUNC	<unknown>	DEFAULT	2
pps	.symtab	0x44bf8	4	OBJECT	<unknown>	DEFAULT	10
prefix.4072	.symtab	0x2c230	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x15008	1144	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x14bc8	108	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x14df0	536	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x14c34	444	FUNC	<unknown>	DEFAULT	2
putc	.symtab	0x1d110	192	FUNC	<unknown>	DEFAULT	2
putc_unlocked	.symtab	0x1d5a8	292	FUNC	<unknown>	DEFAULT	2
puts	.symtab	0x1b6a0	140	FUNC	<unknown>	DEFAULT	2
puts.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
qual_chars.4078	.symtab	0x2c248	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x279c8	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x222ec	16	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x11df8	356	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x222fc	80	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x2cfac	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x2257c	156	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randstring	.symtab	0x10808	280	FUNC	<unknown>	DEFAULT	2
randtbl	.symtab	0x3e3dc	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x270f8	204	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x27a50	76	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_until_response	.symtab	0x15e98	204	FUNC	<unknown>	DEFAULT	2
read_with_timeout	.symtab	0x15d78	288	FUNC	<unknown>	DEFAULT	2
realloc	.symtab	0x21f44	280	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realrand	.symtab	0x11828	132	FUNC	<unknown>	DEFAULT	2
recv	.symtab	0x21c0c	32	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rekdevice	.symtab	0x3d778	4	OBJECT	<unknown>	DEFAULT	9
reset_telstate	.symtab	0x16018	48	FUNC	<unknown>	DEFAULT	2
rewind	.symtab	0x26d14	108	FUNC	<unknown>	DEFAULT	2
rewind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rindex	.symtab	0x24dec	192	FUNC	<unknown>	DEFAULT	2
rnd	.symtab	0x45c0c	4	OBJECT	<unknown>	DEFAULT	10
rndnick	.symtab	0x118ac	140	FUNC	<unknown>	DEFAULT	2
rseed	.symtab	0x44c00	4096	OBJECT	<unknown>	DEFAULT	10
rsi	.symtab	0x44af0	4	OBJECT	<unknown>	DEFAULT	10
sbrk	.symtab	0x23960	84	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x3e4f8	4	OBJECT	<unknown>	DEFAULT	10
sclose	.symtab	0x16048	76	FUNC	<unknown>	DEFAULT	2
select	.symtab	0x1b334	84	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x21c2c	32	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendHOLD	.symtab	0x137d8	1548	FUNC	<unknown>	DEFAULT	2
sendHTTP	.symtab	0x12d94	476	FUNC	<unknown>	DEFAULT	2
sendJUNK	.symtab	0x130e4	1484	FUNC	<unknown>	DEFAULT	2
sendSTD	.symtab	0x12898	908	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x21c4c	88	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
serv	.symtab	0x4499c	16	OBJECT	<unknown>	DEFAULT	10
serv_stayopen	.symtab	0x449ac	4	OBJECT	<unknown>	DEFAULT	10
servbuf	.symtab	0x44994	4	OBJECT	<unknown>	DEFAULT	10
server	.symtab	0x44bfc	4	OBJECT	<unknown>	DEFAULT	10
servers	.symtab	0x3d760	8	OBJECT	<unknown>	DEFAULT	9
servf	.symtab	0x44998	4	OBJECT	<unknown>	DEFAULT	10
setservent	.symtab	0x2539c	132	FUNC	<unknown>	DEFAULT	2
setsid	.symtab	0x1b388	64	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x21ca4	44	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x2234c	96	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x22458	292	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x26930	160	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x269d0	188	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x239b4	140	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x22c24	428	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleeptime	.symtab	0x3e058	4	OBJECT	<unknown>	DEFAULT	9
sock	.symtab	0x44ae8	4	OBJECT	<unknown>	DEFAULT	10
socket	.symtab	0x21cd0	76	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x12c88	268	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4077	.symtab	0x2c25c	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4071	.symtab	0x2c240	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4074	.symtab	0x2c290	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4073	.symtab	0x2c2a8	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4076	.symtab	0x2c26c	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4075	.symtab	0x2c280	9	OBJECT	<unknown>	DEFAULT	4
spoofs	.symtab	0x3e504	4	OBJECT	<unknown>	DEFAULT	10
spoofsm	.symtab	0x3e508	4	OBJECT	<unknown>	DEFAULT	10
sprintf	.symtab	0x1b7a8	52	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x2240c	76	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x2240c	76	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x22618	228	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x3e4a0	2	OBJECT	<unknown>	DEFAULT	9
static_ns	.symtab	0x449c8	4	OBJECT	<unknown>	DEFAULT	10
stderr	.symtab	0x3e160	4	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x3e158	4	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x3e15c	4	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x1fbe8	92	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcasestr	.symtab	0x1fc44	124	FUNC	<unknown>	DEFAULT	2
strcasestr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x24be0	524	FUNC	<unknown>	DEFAULT	2
strcmp	.symtab	0x1f0c0	648	FUNC	<unknown>	DEFAULT	2
strcoll	.symtab	0x1f0c0	648	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x1f3b0	804	FUNC	<unknown>	DEFAULT	2
strdup	.symtab	0x1fcc0	56	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x1facc	284	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x1f73c	120	FUNC	<unknown>	DEFAULT	2
strncat	.symtab	0x271c4	224	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncmp	.symtab	0x1f7b4	260	FUNC	<unknown>	DEFAULT	2
strncmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x1f8b8	248	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x1f9b0	252	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x25058	80	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strrchr	.symtab	0x24dec	192	FUNC	<unknown>	DEFAULT	2
strspn	.symtab	0x272a4	112	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x1fcf8	24	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x24fdc	124	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x22938	20	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoul	.symtab	0x2294c	20	FUNC	<unknown>	DEFAULT	2
strtoul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strwildmatch	.symtab	0x10308	544	FUNC	<unknown>	DEFAULT	2
successes	.symtab	0x3dff4	32	OBJECT	<unknown>	DEFAULT	9
sysconf	.symtab	0x23028	400	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
system	.symtab	0x227e0	320	FUNC	<unknown>	DEFAULT	2
system.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x15480	84	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x1fd30	112	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tehport	.symtab	0x45c04	4	OBJECT	<unknown>	DEFAULT	10
textBuffer.4900	.symtab	0x3e510	1024	OBJECT	<unknown>	DEFAULT	10
thanks	.symtab	0x3e05c	4	OBJECT	<unknown>	DEFAULT	9
time	.symtab	0x1b3c8	72	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x23a90	36	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
touchMyself	.symtab	0x1a054	124	FUNC	<unknown>	DEFAULT	2
toupper	.symtab	0x1b4c4	36	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
type_codes	.symtab	0x2c2b0	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x2c2c8	12	OBJECT	<unknown>	DEFAULT	4
umask	.symtab	0x1b410	84	FUNC	<unknown>	DEFAULT	2
umask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown	.symtab	0x1235c	1000	FUNC	<unknown>	DEFAULT	2
unknown.1115	.symtab	0x2c358	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x3e3c0	28	OBJECT	<unknown>	DEFAULT	9
user	.symtab	0x44af4	4	OBJECT	<unknown>	DEFAULT	10
usernames	.symtab	0x3db14	592	OBJECT	<unknown>	DEFAULT	9
usleep	.symtab	0x231b8	72	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vasprintf	.symtab	0x1b7dc	116	FUNC	<unknown>	DEFAULT	2
vasprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
version	.symtab	0x1171c	56	FUNC	<unknown>	DEFAULT	2
vfork	.symtab	0x235ac	52	FUNC	<unknown>	DEFAULT	2
vfprintf	.symtab	0x1c034	148	FUNC	<unknown>	DEFAULT	2
vfprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vsnprintf	.symtab	0x1b850	156	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vsprintf	.symtab	0x1b72c	28	FUNC	<unknown>	DEFAULT	2
vsprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x23a40	80	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x1b464	20	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x23ac0	72	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x23b24	188	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x23b08	28	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x1b478	76	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3071	.symtab	0x2cf38	17	OBJECT	<unknown>	DEFAULT	4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 13:56:52.867162943 CET	43928	443	192.168.2.23	91.189.91.42
Dec 28, 2024 13:56:58.239662886 CET	42836	443	192.168.2.23	91.189.91.43
Dec 28, 2024 13:56:59.523219109 CET	42516	80	192.168.2.23	109.202.202.202
Dec 28, 2024 13:57:13.855261087 CET	43928	443	192.168.2.23	91.189.91.42
Dec 28, 2024 13:57:24.092066050 CET	42836	443	192.168.2.23	91.189.91.43
Dec 28, 2024 13:57:30.235239983 CET	42516	80	192.168.2.23	109.202.202.202
Dec 28, 2024 13:57:54.807805061 CET	43928	443	192.168.2.23	91.189.91.42
Dec 28, 2024 13:58:15.287293911 CET	42836	443	192.168.2.23	91.189.91.43

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 13:56:50.484992027 CET	33207	53	192.168.2.23	1.1.1.1
Dec 28, 2024 13:56:50.833292007 CET	53	33207	1.1.1.1	192.168.2.23

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 28, 2024 13:56:50.484992027 CET	192.168.2.23	1.1.1.1	0xc9ff	Standard query (0)	pirati.privatedns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 28, 2024 13:56:50.833292007 CET	1.1.1.1	192.168.2.23	0xc9ff	No error (0)	pirati.privatedns.org		79.12.214.240	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: yakuza.sparc.elf PID: 6235, Parent PID: 6160

General

Start time (UTC):	12:56:49
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	/tmp/yakuza.sparc.elf
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: yakuza.sparc.elf PID: 6237, Parent PID: 6235

General

Start time (UTC):	12:56:49
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: yakuza.sparc.elf PID: 6239, Parent PID: 6237

General

Start time (UTC):	12:56:49
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: yakuza.sparc.elf PID: 6240, Parent PID: 6237

General

Start time (UTC):	12:56:49
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: yakuza.sparc.elf PID: 6246, Parent PID: 6237

General

Start time (UTC):	12:56:49
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: sh PID: 6246, Parent PID: 6237

General

Start time (UTC):	12:56:49
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 902i13 \|\| busybox pkill -9 902i13"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6249, Parent PID: 6246

General

Start time (UTC):	12:56:49
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6249, Parent PID: 6246

General

Start time (UTC):	12:56:49
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 902i13
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6264, Parent PID: 6246

General

Start time (UTC):	12:56:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6264, Parent PID: 6246

General

Start time (UTC):	12:56:53
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 902i13
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.sparc.elf PID: 6265, Parent PID: 6237

General

Start time (UTC):	12:56:53
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: sh PID: 6265, Parent PID: 6237

General

Start time (UTC):	12:56:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 BzSxLxBxeY \|\| busybox pkill -9 BzSxLxBxeY"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6270, Parent PID: 6265

General

Start time (UTC):	12:56:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6270, Parent PID: 6265

General

Start time (UTC):	12:56:53
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 BzSxLxBxeY
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6283, Parent PID: 6265

General

Start time (UTC):	12:56:56
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6283, Parent PID: 6265

General

Start time (UTC):	12:56:56
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 BzSxLxBxeY
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.sparc.elf PID: 6284, Parent PID: 6237

General

Start time (UTC):	12:56:56
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: sh PID: 6284, Parent PID: 6237

General

Start time (UTC):	12:56:56
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 HOHO-LUGO7 \|\| busybox pkill -9 HOHO-LUGO7"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6289, Parent PID: 6284

General

Start time (UTC):	12:56:56
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6289, Parent PID: 6284

General

Start time (UTC):	12:56:56
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 HOHO-LUGO7
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6290, Parent PID: 6284

General

Start time (UTC):	12:56:57
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6290, Parent PID: 6284

General

Start time (UTC):	12:56:57
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 HOHO-LUGO7
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.sparc.elf PID: 6291, Parent PID: 6237

General

Start time (UTC):	12:56:58
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: sh PID: 6291, Parent PID: 6237

General

Start time (UTC):	12:56:58
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 HOHO-U79OL \|\| busybox pkill -9 HOHO-U79OL"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6293, Parent PID: 6291

General

Start time (UTC):	12:56:58
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6293, Parent PID: 6291

General

Start time (UTC):	12:56:58
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 HOHO-U79OL
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6294, Parent PID: 6291

General

Start time (UTC):	12:56:59
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6294, Parent PID: 6291

General

Start time (UTC):	12:56:59
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 HOHO-U79OL
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.sparc.elf PID: 6295, Parent PID: 6237

General

Start time (UTC):	12:56:59
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: sh PID: 6295, Parent PID: 6237

General

Start time (UTC):	12:56:59
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 JuYfouyf87 \|\| busybox pkill -9 JuYfouyf87"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6300, Parent PID: 6295

General

Start time (UTC):	12:56:59
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6300, Parent PID: 6295

General

Start time (UTC):	12:56:59
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 JuYfouyf87
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6303, Parent PID: 6295

General

Start time (UTC):	12:57:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6303, Parent PID: 6295

General

Start time (UTC):	12:57:01
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 JuYfouyf87
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.sparc.elf PID: 6304, Parent PID: 6237

General

Start time (UTC):	12:57:01
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: sh PID: 6304, Parent PID: 6237

General

Start time (UTC):	12:57:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6309, Parent PID: 6304

General

Start time (UTC):	12:57:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6309, Parent PID: 6304

General

Start time (UTC):	12:57:01
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeR69xd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6311, Parent PID: 6304

General

Start time (UTC):	12:57:03
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6311, Parent PID: 6304

General

Start time (UTC):	12:57:03
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeR69xd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.sparc.elf PID: 6312, Parent PID: 6237

General

Start time (UTC):	12:57:03
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: sh PID: 6312, Parent PID: 6237

General

Start time (UTC):	12:57:03
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6318, Parent PID: 6312

General

Start time (UTC):	12:57:03
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6318, Parent PID: 6312

General

Start time (UTC):	12:57:03
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SO190Ij1X
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6321, Parent PID: 6312

General

Start time (UTC):	12:57:05
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6321, Parent PID: 6312

General

Start time (UTC):	12:57:05
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SO190Ij1X
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.sparc.elf PID: 6322, Parent PID: 6237

General

Start time (UTC):	12:57:05
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: sh PID: 6322, Parent PID: 6237

General

Start time (UTC):	12:57:05
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 LOLKIKEEEDDE \|\| busybox pkill -9 LOLKIKEEEDDE"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6327, Parent PID: 6322

General

Start time (UTC):	12:57:05
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6327, Parent PID: 6322

General

Start time (UTC):	12:57:05
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 LOLKIKEEEDDE
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6328, Parent PID: 6322

General

Start time (UTC):	12:57:06
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6328, Parent PID: 6322

General

Start time (UTC):	12:57:06
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 LOLKIKEEEDDE
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.sparc.elf PID: 6329, Parent PID: 6237

General

Start time (UTC):	12:57:06
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: sh PID: 6329, Parent PID: 6237

General

Start time (UTC):	12:57:06
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ekjheory98e \|\| busybox pkill -9 ekjheory98e"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6334, Parent PID: 6329

General

Start time (UTC):	12:57:06
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6334, Parent PID: 6329

General

Start time (UTC):	12:57:06
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ekjheory98e
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6335, Parent PID: 6329

General

Start time (UTC):	12:57:08
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6335, Parent PID: 6329

General

Start time (UTC):	12:57:08
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ekjheory98e
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.sparc.elf PID: 6336, Parent PID: 6237

General

Start time (UTC):	12:57:08
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: sh PID: 6336, Parent PID: 6237

General

Start time (UTC):	12:57:08
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scansh4 \|\| busybox pkill -9 scansh4"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6338, Parent PID: 6336

General

Start time (UTC):	12:57:08
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6338, Parent PID: 6336

General

Start time (UTC):	12:57:08
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 scansh4
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6339, Parent PID: 6336

General

Start time (UTC):	12:57:09
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6339, Parent PID: 6336

General

Start time (UTC):	12:57:09
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scansh4
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.sparc.elf PID: 6340, Parent PID: 6237

General

Start time (UTC):	12:57:10
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: sh PID: 6340, Parent PID: 6237

General

Start time (UTC):	12:57:10
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MDMA \|\| busybox pkill -9 MDMA"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6345, Parent PID: 6340

General

Start time (UTC):	12:57:10
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6345, Parent PID: 6340

General

Start time (UTC):	12:57:10
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MDMA
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6370, Parent PID: 6340

General

Start time (UTC):	12:57:11
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6370, Parent PID: 6340

General

Start time (UTC):	12:57:11
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MDMA
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.sparc.elf PID: 6371, Parent PID: 6237

General

Start time (UTC):	12:57:11
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: sh PID: 6371, Parent PID: 6237

General

Start time (UTC):	12:57:11
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 fdevalvex \|\| busybox pkill -9 fdevalvex"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6376, Parent PID: 6371

General

Start time (UTC):	12:57:11
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6376, Parent PID: 6371

General

Start time (UTC):	12:57:11
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 fdevalvex
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6377, Parent PID: 6371

General

Start time (UTC):	12:57:13
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6377, Parent PID: 6371

General

Start time (UTC):	12:57:13
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 fdevalvex
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.sparc.elf PID: 6378, Parent PID: 6237

General

Start time (UTC):	12:57:13
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: sh PID: 6378, Parent PID: 6237

General

Start time (UTC):	12:57:13
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scanspc \|\| busybox pkill -9 scanspc"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6383, Parent PID: 6378

General

Start time (UTC):	12:57:13
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6383, Parent PID: 6378

General

Start time (UTC):	12:57:13
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 scanspc
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6386, Parent PID: 6378

General

Start time (UTC):	12:57:15
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6386, Parent PID: 6378

General

Start time (UTC):	12:57:15
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scanspc
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.sparc.elf PID: 6387, Parent PID: 6237

General

Start time (UTC):	12:57:15
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: sh PID: 6387, Parent PID: 6237

General

Start time (UTC):	12:57:15
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MELTEDNINJAREALZ \|\| busybox pkill -9 MELTEDNINJAREALZ"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6392, Parent PID: 6387

General

Start time (UTC):	12:57:15
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6392, Parent PID: 6387

General

Start time (UTC):	12:57:15
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MELTEDNINJAREALZ
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6393, Parent PID: 6387

General

Start time (UTC):	12:57:17
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6393, Parent PID: 6387

General

Start time (UTC):	12:57:17
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MELTEDNINJAREALZ
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.sparc.elf PID: 6394, Parent PID: 6237

General

Start time (UTC):	12:57:17
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: sh PID: 6394, Parent PID: 6237

General

Start time (UTC):	12:57:17
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 flexsonskids \|\| busybox pkill -9 flexsonskids"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6399, Parent PID: 6394

General

Start time (UTC):	12:57:17
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6399, Parent PID: 6394

General

Start time (UTC):	12:57:17
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 flexsonskids
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6400, Parent PID: 6394

General

Start time (UTC):	12:57:18
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6400, Parent PID: 6394

General

Start time (UTC):	12:57:18
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 flexsonskids
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.sparc.elf PID: 6401, Parent PID: 6237

General

Start time (UTC):	12:57:18
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Chronological Activities

Analysis Process: sh PID: 6401, Parent PID: 6237

General

Start time (UTC):	12:57:18
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scanx86 \|\| busybox pkill -9 scanx86"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6407, Parent PID: 6401

General

Start time (UTC):	12:57:18
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6407, Parent PID: 6401

General

Start time (UTC):	12:57:18
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 scanx86
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6408, Parent PID: 6401

General

Start time (UTC):	12:57:20
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6408, Parent PID: 6401

General

Start time (UTC):	12:57:20
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scanx86
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6411, Parent PID: 6237

General

Start time (UTC):	12:57:20
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6411, Parent PID: 6237

General

Start time (UTC):	12:57:20
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MISAKI-U79OL \|\| busybox pkill -9 MISAKI-U79OL"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6413, Parent PID: 6411

General

Start time (UTC):	12:57:21
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6413, Parent PID: 6411

General

Start time (UTC):	12:57:21
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MISAKI-U79OL
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6414, Parent PID: 6411

General

Start time (UTC):	12:57:23
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6414, Parent PID: 6411

General

Start time (UTC):	12:57:23
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MISAKI-U79OL
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6415, Parent PID: 6237

General

Start time (UTC):	12:57:23
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6415, Parent PID: 6237

General

Start time (UTC):	12:57:23
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 foAxi102kxe \|\| busybox pkill -9 foAxi102kxe"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6420, Parent PID: 6415

General

Start time (UTC):	12:57:23
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6420, Parent PID: 6415

General

Start time (UTC):	12:57:23
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 foAxi102kxe
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6421, Parent PID: 6415

General

Start time (UTC):	12:57:24
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6421, Parent PID: 6415

General

Start time (UTC):	12:57:24
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 foAxi102kxe
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6422, Parent PID: 6237

General

Start time (UTC):	12:57:24
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6422, Parent PID: 6237

General

Start time (UTC):	12:57:24
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 swodjwodjwoj \|\| busybox pkill -9 swodjwodjwoj"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6425, Parent PID: 6422

General

Start time (UTC):	12:57:24
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6425, Parent PID: 6422

General

Start time (UTC):	12:57:24
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 swodjwodjwoj
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6430, Parent PID: 6422

General

Start time (UTC):	12:57:26
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6430, Parent PID: 6422

General

Start time (UTC):	12:57:26
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 swodjwodjwoj
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6431, Parent PID: 6237

General

Start time (UTC):	12:57:26
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6431, Parent PID: 6237

General

Start time (UTC):	12:57:26
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MmKiy7f87l \|\| busybox pkill -9 MmKiy7f87l"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6436, Parent PID: 6431

General

Start time (UTC):	12:57:26
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6436, Parent PID: 6431

General

Start time (UTC):	12:57:26
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MmKiy7f87l
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6437, Parent PID: 6431

General

Start time (UTC):	12:57:28
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6437, Parent PID: 6431

General

Start time (UTC):	12:57:28
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MmKiy7f87l
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6438, Parent PID: 6237

General

Start time (UTC):	12:57:28
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6438, Parent PID: 6237

General

Start time (UTC):	12:57:28
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 freecookiex86 \|\| busybox pkill -9 freecookiex86"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6443, Parent PID: 6438

General

Start time (UTC):	12:57:28
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6443, Parent PID: 6438

General

Start time (UTC):	12:57:28
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 freecookiex86
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6444, Parent PID: 6438

General

Start time (UTC):	12:57:30
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6444, Parent PID: 6438

General

Start time (UTC):	12:57:30
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 freecookiex86
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6445, Parent PID: 6237

General

Start time (UTC):	12:57:30
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6445, Parent PID: 6237

General

Start time (UTC):	12:57:30
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 sysgpu \|\| busybox pkill -9 sysgpu"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6450, Parent PID: 6445

General

Start time (UTC):	12:57:30
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6450, Parent PID: 6445

General

Start time (UTC):	12:57:30
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 sysgpu
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6453, Parent PID: 6445

General

Start time (UTC):	12:57:31
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6453, Parent PID: 6445

General

Start time (UTC):	12:57:31
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 sysgpu
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6454, Parent PID: 6237

General

Start time (UTC):	12:57:31
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6454, Parent PID: 6237

General

Start time (UTC):	12:57:31
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6459, Parent PID: 6454

General

Start time (UTC):	12:57:31
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6459, Parent PID: 6454

General

Start time (UTC):	12:57:31
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeR69xd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6461, Parent PID: 6454

General

Start time (UTC):	12:57:33
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6461, Parent PID: 6454

General

Start time (UTC):	12:57:33
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeR69xd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6462, Parent PID: 6237

General

Start time (UTC):	12:57:33
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6462, Parent PID: 6237

General

Start time (UTC):	12:57:33
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 frgege \|\| busybox pkill -9 frgege"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6468, Parent PID: 6462

General

Start time (UTC):	12:57:33
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6468, Parent PID: 6462

General

Start time (UTC):	12:57:33
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 frgege
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6469, Parent PID: 6462

General

Start time (UTC):	12:57:34
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6469, Parent PID: 6462

General

Start time (UTC):	12:57:34
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 frgege
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6470, Parent PID: 6237

General

Start time (UTC):	12:57:34
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6470, Parent PID: 6237

General

Start time (UTC):	12:57:34
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 sysupdater \|\| busybox pkill -9 sysupdater"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6475, Parent PID: 6470

General

Start time (UTC):	12:57:34
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6475, Parent PID: 6470

General

Start time (UTC):	12:57:34
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 sysupdater
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6478, Parent PID: 6470

General

Start time (UTC):	12:57:36
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6478, Parent PID: 6470

General

Start time (UTC):	12:57:36
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 sysupdater
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6479, Parent PID: 6237

General

Start time (UTC):	12:57:36
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6479, Parent PID: 6237

General

Start time (UTC):	12:57:36
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 0DnAzepd \|\| busybox pkill -9 0DnAzepd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6481, Parent PID: 6479

General

Start time (UTC):	12:57:36
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6481, Parent PID: 6479

General

Start time (UTC):	12:57:36
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 0DnAzepd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6482, Parent PID: 6479

General

Start time (UTC):	12:57:37
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6482, Parent PID: 6479

General

Start time (UTC):	12:57:37
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 0DnAzepd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6483, Parent PID: 6237

General

Start time (UTC):	12:57:37
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6483, Parent PID: 6237

General

Start time (UTC):	12:57:37
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeRD0nks69 \|\| busybox pkill -9 NiGGeRD0nks69"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6488, Parent PID: 6483

General

Start time (UTC):	12:57:37
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6488, Parent PID: 6483

General

Start time (UTC):	12:57:37
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeRD0nks69
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6489, Parent PID: 6483

General

Start time (UTC):	12:57:39
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6489, Parent PID: 6483

General

Start time (UTC):	12:57:39
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeRD0nks69
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6490, Parent PID: 6237

General

Start time (UTC):	12:57:39
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6490, Parent PID: 6237

General

Start time (UTC):	12:57:39
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 frgreu \|\| busybox pkill -9 frgreu"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6495, Parent PID: 6490

General

Start time (UTC):	12:57:39
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6495, Parent PID: 6490

General

Start time (UTC):	12:57:39
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 frgreu
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6500, Parent PID: 6490

General

Start time (UTC):	12:57:41
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6500, Parent PID: 6490

General

Start time (UTC):	12:57:41
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 frgreu
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6501, Parent PID: 6237

General

Start time (UTC):	12:57:41
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6501, Parent PID: 6237

General

Start time (UTC):	12:57:41
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 telnetd \|\| busybox pkill -9 telnetd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6503, Parent PID: 6501

General

Start time (UTC):	12:57:41
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6503, Parent PID: 6501

General

Start time (UTC):	12:57:41
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 telnetd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6504, Parent PID: 6501

General

Start time (UTC):	12:57:43
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6504, Parent PID: 6501

General

Start time (UTC):	12:57:43
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 telnetd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6505, Parent PID: 6237

General

Start time (UTC):	12:57:43
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6505, Parent PID: 6237

General

Start time (UTC):	12:57:43
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 0x766f6964 \|\| busybox pkill -9 0x766f6964"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6510, Parent PID: 6505

General

Start time (UTC):	12:57:43
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6510, Parent PID: 6505

General

Start time (UTC):	12:57:43
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 0x766f6964
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6513, Parent PID: 6505

General

Start time (UTC):	12:57:45
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6513, Parent PID: 6505

General

Start time (UTC):	12:57:45
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 0x766f6964
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6514, Parent PID: 6237

General

Start time (UTC):	12:57:45
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6514, Parent PID: 6237

General

Start time (UTC):	12:57:45
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeRd0nks1337 \|\| busybox pkill -9 NiGGeRd0nks1337"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6516, Parent PID: 6514

General

Start time (UTC):	12:57:45
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6516, Parent PID: 6514

General

Start time (UTC):	12:57:45
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeRd0nks1337
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6517, Parent PID: 6514

General

Start time (UTC):	12:57:47
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6517, Parent PID: 6514

General

Start time (UTC):	12:57:47
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeRd0nks1337
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6518, Parent PID: 6237

General

Start time (UTC):	12:57:47
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6518, Parent PID: 6237

General

Start time (UTC):	12:57:47
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 gaft \|\| busybox pkill -9 gaft"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6523, Parent PID: 6518

General

Start time (UTC):	12:57:47
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6523, Parent PID: 6518

General

Start time (UTC):	12:57:47
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 gaft
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6524, Parent PID: 6518

General

Start time (UTC):	12:57:49
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6524, Parent PID: 6518

General

Start time (UTC):	12:57:49
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 gaft
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6525, Parent PID: 6237

General

Start time (UTC):	12:57:49
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6525, Parent PID: 6237

General

Start time (UTC):	12:57:49
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 urasgbsigboa \|\| busybox pkill -9 urasgbsigboa"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6531, Parent PID: 6525

General

Start time (UTC):	12:57:49
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6531, Parent PID: 6525

General

Start time (UTC):	12:57:49
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 urasgbsigboa
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6534, Parent PID: 6525

General

Start time (UTC):	12:57:51
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6534, Parent PID: 6525

General

Start time (UTC):	12:57:51
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 urasgbsigboa
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6535, Parent PID: 6237

General

Start time (UTC):	12:57:51
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6535, Parent PID: 6237

General

Start time (UTC):	12:57:51
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 120i3UI49 \|\| busybox pkill -9 120i3UI49"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6540, Parent PID: 6535

General

Start time (UTC):	12:57:51
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6540, Parent PID: 6535

General

Start time (UTC):	12:57:51
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 120i3UI49
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6541, Parent PID: 6535

General

Start time (UTC):	12:57:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6541, Parent PID: 6535

General

Start time (UTC):	12:57:53
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 120i3UI49
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6542, Parent PID: 6237

General

Start time (UTC):	12:57:53
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6542, Parent PID: 6237

General

Start time (UTC):	12:57:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 OaF3 \|\| busybox pkill -9 OaF3"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6547, Parent PID: 6542

General

Start time (UTC):	12:57:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6547, Parent PID: 6542

General

Start time (UTC):	12:57:53
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 OaF3
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6548, Parent PID: 6542

General

Start time (UTC):	12:57:54
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6548, Parent PID: 6542

General

Start time (UTC):	12:57:54
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 OaF3
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6549, Parent PID: 6237

General

Start time (UTC):	12:57:54
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6549, Parent PID: 6237

General

Start time (UTC):	12:57:54
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 geae \|\| busybox pkill -9 geae"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6554, Parent PID: 6549

General

Start time (UTC):	12:57:54
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6554, Parent PID: 6549

General

Start time (UTC):	12:57:54
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 geae
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6557, Parent PID: 6549

General

Start time (UTC):	12:57:56
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6557, Parent PID: 6549

General

Start time (UTC):	12:57:56
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 geae
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6558, Parent PID: 6237

General

Start time (UTC):	12:57:56
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6558, Parent PID: 6237

General

Start time (UTC):	12:57:56
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 vaiolmao \|\| busybox pkill -9 vaiolmao"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6563, Parent PID: 6558

General

Start time (UTC):	12:57:56
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6563, Parent PID: 6558

General

Start time (UTC):	12:57:56
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 vaiolmao
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6564, Parent PID: 6558

General

Start time (UTC):	12:57:58
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6564, Parent PID: 6558

General

Start time (UTC):	12:57:58
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 vaiolmao
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6565, Parent PID: 6237

General

Start time (UTC):	12:57:58
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6565, Parent PID: 6237

General

Start time (UTC):	12:57:58
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 123123a \|\| busybox pkill -9 123123a"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6570, Parent PID: 6565

General

Start time (UTC):	12:57:58
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6570, Parent PID: 6565

General

Start time (UTC):	12:57:58
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 123123a
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6571, Parent PID: 6565

General

Start time (UTC):	12:57:59
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6571, Parent PID: 6565

General

Start time (UTC):	12:57:59
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 123123a
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6572, Parent PID: 6237

General

Start time (UTC):	12:57:59
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6572, Parent PID: 6237

General

Start time (UTC):	12:57:59
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 Ofurain0n4H34D \|\| busybox pkill -9 Ofurain0n4H34D"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6577, Parent PID: 6572

General

Start time (UTC):	12:57:59
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6577, Parent PID: 6572

General

Start time (UTC):	12:57:59
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 Ofurain0n4H34D
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6580, Parent PID: 6572

General

Start time (UTC):	12:58:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6580, Parent PID: 6572

General

Start time (UTC):	12:58:01
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 Ofurain0n4H34D
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6581, Parent PID: 6237

General

Start time (UTC):	12:58:01
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6581, Parent PID: 6237

General

Start time (UTC):	12:58:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggTrex \|\| busybox pkill -9 ggTrex"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6586, Parent PID: 6581

General

Start time (UTC):	12:58:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6586, Parent PID: 6581

General

Start time (UTC):	12:58:01
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggTrex
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6588, Parent PID: 6581

General

Start time (UTC):	12:58:03
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6588, Parent PID: 6581

General

Start time (UTC):	12:58:03
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggTrex
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6589, Parent PID: 6237

General

Start time (UTC):	12:58:03
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6589, Parent PID: 6237

General

Start time (UTC):	12:58:03
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 wasads \|\| busybox pkill -9 wasads"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6595, Parent PID: 6589

General

Start time (UTC):	12:58:03
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6595, Parent PID: 6589

General

Start time (UTC):	12:58:03
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 wasads
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6596, Parent PID: 6589

General

Start time (UTC):	12:58:04
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6596, Parent PID: 6589

General

Start time (UTC):	12:58:04
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 wasads
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6597, Parent PID: 6237

General

Start time (UTC):	12:58:04
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6597, Parent PID: 6237

General

Start time (UTC):	12:58:04
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1293194hjXD \|\| busybox pkill -9 1293194hjXD"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6602, Parent PID: 6597

General

Start time (UTC):	12:58:04
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6602, Parent PID: 6597

General

Start time (UTC):	12:58:04
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1293194hjXD
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6605, Parent PID: 6597

General

Start time (UTC):	12:58:06
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6605, Parent PID: 6597

General

Start time (UTC):	12:58:06
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1293194hjXD
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6606, Parent PID: 6237

General

Start time (UTC):	12:58:06
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6606, Parent PID: 6237

General

Start time (UTC):	12:58:06
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 OthLaLosn \|\| busybox pkill -9 OthLaLosn"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6608, Parent PID: 6606

General

Start time (UTC):	12:58:06
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6608, Parent PID: 6606

General

Start time (UTC):	12:58:06
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 OthLaLosn
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6609, Parent PID: 6606

General

Start time (UTC):	12:58:08
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6609, Parent PID: 6606

General

Start time (UTC):	12:58:08
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 OthLaLosn
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6610, Parent PID: 6237

General

Start time (UTC):	12:58:08
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6610, Parent PID: 6237

General

Start time (UTC):	12:58:08
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggt \|\| busybox pkill -9 ggt"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6615, Parent PID: 6610

General

Start time (UTC):	12:58:08
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6615, Parent PID: 6610

General

Start time (UTC):	12:58:08
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggt
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6616, Parent PID: 6610

General

Start time (UTC):	12:58:09
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6616, Parent PID: 6610

General

Start time (UTC):	12:58:09
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggt
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6617, Parent PID: 6237

General

Start time (UTC):	12:58:09
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6617, Parent PID: 6237

General

Start time (UTC):	12:58:09
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 wget-log \|\| busybox pkill -9 wget-log"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6619, Parent PID: 6617

General

Start time (UTC):	12:58:10
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6619, Parent PID: 6617

General

Start time (UTC):	12:58:10
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 wget-log
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6622, Parent PID: 6617

General

Start time (UTC):	12:58:11
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6622, Parent PID: 6617

General

Start time (UTC):	12:58:11
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 wget-log
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6623, Parent PID: 6237

General

Start time (UTC):	12:58:11
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6623, Parent PID: 6237

General

Start time (UTC):	12:58:11
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1337SoraLOADER \|\| busybox pkill -9 1337SoraLOADER"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6628, Parent PID: 6623

General

Start time (UTC):	12:58:11
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6628, Parent PID: 6623

General

Start time (UTC):	12:58:11
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1337SoraLOADER
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6629, Parent PID: 6623

General

Start time (UTC):	12:58:13
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6629, Parent PID: 6623

General

Start time (UTC):	12:58:13
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1337SoraLOADER
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6630, Parent PID: 6237

General

Start time (UTC):	12:58:13
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6630, Parent PID: 6237

General

Start time (UTC):	12:58:13
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SAIAKINA \|\| busybox pkill -9 SAIAKINA"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6632, Parent PID: 6630

General

Start time (UTC):	12:58:13
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6632, Parent PID: 6630

General

Start time (UTC):	12:58:13
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SAIAKINA
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6635, Parent PID: 6630

General

Start time (UTC):	12:58:15
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6635, Parent PID: 6630

General

Start time (UTC):	12:58:15
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SAIAKINA
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6636, Parent PID: 6237

General

Start time (UTC):	12:58:15
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6636, Parent PID: 6237

General

Start time (UTC):	12:58:15
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggtq \|\| busybox pkill -9 ggtq"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6641, Parent PID: 6636

General

Start time (UTC):	12:58:15
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6641, Parent PID: 6636

General

Start time (UTC):	12:58:15
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggtq
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6642, Parent PID: 6636

General

Start time (UTC):	12:58:17
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6642, Parent PID: 6636

General

Start time (UTC):	12:58:17
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggtq
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6643, Parent PID: 6237

General

Start time (UTC):	12:58:17
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6643, Parent PID: 6237

General

Start time (UTC):	12:58:17
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1378bfp919GRB1Q2 \|\| busybox pkill -9 1378bfp919GRB1Q2"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6648, Parent PID: 6643

General

Start time (UTC):	12:58:17
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6648, Parent PID: 6643

General

Start time (UTC):	12:58:17
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1378bfp919GRB1Q2
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6649, Parent PID: 6643

General

Start time (UTC):	12:58:19
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6649, Parent PID: 6643

General

Start time (UTC):	12:58:19
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1378bfp919GRB1Q2
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6650, Parent PID: 6237

General

Start time (UTC):	12:58:19
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6650, Parent PID: 6237

General

Start time (UTC):	12:58:19
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SAIAKUSO \|\| busybox pkill -9 SAIAKUSO"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6656, Parent PID: 6650

General

Start time (UTC):	12:58:19
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6656, Parent PID: 6650

General

Start time (UTC):	12:58:19
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SAIAKUSO
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6657, Parent PID: 6650

General

Start time (UTC):	12:58:20
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6657, Parent PID: 6650

General

Start time (UTC):	12:58:20
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SAIAKUSO
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6658, Parent PID: 6237

General

Start time (UTC):	12:58:20
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6658, Parent PID: 6237

General

Start time (UTC):	12:58:20
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggtr \|\| busybox pkill -9 ggtr"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6663, Parent PID: 6658

General

Start time (UTC):	12:58:20
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6663, Parent PID: 6658

General

Start time (UTC):	12:58:20
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggtr
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6666, Parent PID: 6658

General

Start time (UTC):	12:58:22
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6666, Parent PID: 6658

General

Start time (UTC):	12:58:22
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggtr
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6667, Parent PID: 6237

General

Start time (UTC):	12:58:22
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6667, Parent PID: 6237

General

Start time (UTC):	12:58:22
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 14Fa \|\| busybox pkill -9 14Fa"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6672, Parent PID: 6667

General

Start time (UTC):	12:58:22
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6672, Parent PID: 6667

General

Start time (UTC):	12:58:22
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 14Fa
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6673, Parent PID: 6667

General

Start time (UTC):	12:58:24
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6673, Parent PID: 6667

General

Start time (UTC):	12:58:24
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 14Fa
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6674, Parent PID: 6237

General

Start time (UTC):	12:58:24
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6674, Parent PID: 6237

General

Start time (UTC):	12:58:24
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SEXSLAVE1337 \|\| busybox pkill -9 SEXSLAVE1337"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6676, Parent PID: 6674

General

Start time (UTC):	12:58:24
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6676, Parent PID: 6674

General

Start time (UTC):	12:58:24
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SEXSLAVE1337
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6679, Parent PID: 6674

General

Start time (UTC):	12:58:25
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6679, Parent PID: 6674

General

Start time (UTC):	12:58:25
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SEXSLAVE1337
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6680, Parent PID: 6237

General

Start time (UTC):	12:58:25
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6680, Parent PID: 6237

General

Start time (UTC):	12:58:25
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggtt \|\| busybox pkill -9 ggtt"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6682, Parent PID: 6680

General

Start time (UTC):	12:58:25
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6682, Parent PID: 6680

General

Start time (UTC):	12:58:25
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggtt
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6683, Parent PID: 6680

General

Start time (UTC):	12:58:27
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6683, Parent PID: 6680

General

Start time (UTC):	12:58:27
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggtt
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6684, Parent PID: 6237

General

Start time (UTC):	12:58:27
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6684, Parent PID: 6237

General

Start time (UTC):	12:58:27
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1902a3u912u3u4 \|\| busybox pkill -9 1902a3u912u3u4"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6689, Parent PID: 6684

General

Start time (UTC):	12:58:27
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6689, Parent PID: 6684

General

Start time (UTC):	12:58:27
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1902a3u912u3u4
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6690, Parent PID: 6684

General

Start time (UTC):	12:58:28
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6690, Parent PID: 6684

General

Start time (UTC):	12:58:28
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1902a3u912u3u4
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6691, Parent PID: 6237

General

Start time (UTC):	12:58:28
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6691, Parent PID: 6237

General

Start time (UTC):	12:58:28
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6693, Parent PID: 6691

General

Start time (UTC):	12:58:28
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6693, Parent PID: 6691

General

Start time (UTC):	12:58:28
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SO190Ij1X
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6695, Parent PID: 6691

General

Start time (UTC):	12:58:30
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6695, Parent PID: 6691

General

Start time (UTC):	12:58:30
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SO190Ij1X
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6696, Parent PID: 6237

General

Start time (UTC):	12:58:30
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6696, Parent PID: 6237

General

Start time (UTC):	12:58:30
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 haetrghbr \|\| busybox pkill -9 haetrghbr"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6701, Parent PID: 6696

General

Start time (UTC):	12:58:30
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6701, Parent PID: 6696

General

Start time (UTC):	12:58:30
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 haetrghbr
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6704, Parent PID: 6696

General

Start time (UTC):	12:58:32
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6704, Parent PID: 6696

General

Start time (UTC):	12:58:32
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 haetrghbr
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6705, Parent PID: 6237

General

Start time (UTC):	12:58:32
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6705, Parent PID: 6237

General

Start time (UTC):	12:58:32
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 19ju3d \|\| busybox pkill -9 19ju3d"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6710, Parent PID: 6705

General

Start time (UTC):	12:58:32
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6710, Parent PID: 6705

General

Start time (UTC):	12:58:32
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 19ju3d
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6712, Parent PID: 6705

General

Start time (UTC):	12:58:34
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6712, Parent PID: 6705

General

Start time (UTC):	12:58:34
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 19ju3d
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6713, Parent PID: 6237

General

Start time (UTC):	12:58:34
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6713, Parent PID: 6237

General

Start time (UTC):	12:58:34
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SORAojkf120 \|\| busybox pkill -9 SORAojkf120"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6719, Parent PID: 6713

General

Start time (UTC):	12:58:34
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6719, Parent PID: 6713

General

Start time (UTC):	12:58:34
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SORAojkf120
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6722, Parent PID: 6713

General

Start time (UTC):	12:58:35
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6722, Parent PID: 6713

General

Start time (UTC):	12:58:35
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SORAojkf120
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6723, Parent PID: 6237

General

Start time (UTC):	12:58:35
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6723, Parent PID: 6237

General

Start time (UTC):	12:58:35
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 hehahejeje92 \|\| busybox pkill -9 hehahejeje92"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6728, Parent PID: 6723

General

Start time (UTC):	12:58:35
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6728, Parent PID: 6723

General

Start time (UTC):	12:58:35
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 hehahejeje92
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6729, Parent PID: 6723

General

Start time (UTC):	12:58:37
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6729, Parent PID: 6723

General

Start time (UTC):	12:58:37
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 hehahejeje92
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6730, Parent PID: 6237

General

Start time (UTC):	12:58:37
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6730, Parent PID: 6237

General

Start time (UTC):	12:58:37
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 2U2JDJA901F91 \|\| busybox pkill -9 2U2JDJA901F91"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6735, Parent PID: 6730

General

Start time (UTC):	12:58:37
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6735, Parent PID: 6730

General

Start time (UTC):	12:58:37
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 2U2JDJA901F91
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6736, Parent PID: 6730

General

Start time (UTC):	12:58:39
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6736, Parent PID: 6730

General

Start time (UTC):	12:58:39
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 2U2JDJA901F91
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6737, Parent PID: 6237

General

Start time (UTC):	12:58:39
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6737, Parent PID: 6237

General

Start time (UTC):	12:58:39
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SlaVLav12 \|\| busybox pkill -9 SlaVLav12"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6742, Parent PID: 6737

General

Start time (UTC):	12:58:39
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6742, Parent PID: 6737

General

Start time (UTC):	12:58:39
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SlaVLav12
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6747, Parent PID: 6737

General

Start time (UTC):	12:58:40
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6747, Parent PID: 6737

General

Start time (UTC):	12:58:40
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SlaVLav12
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6748, Parent PID: 6237

General

Start time (UTC):	12:58:41
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6748, Parent PID: 6237

General

Start time (UTC):	12:58:41
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 helpmedaddthhhhh \|\| busybox pkill -9 helpmedaddthhhhh"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6750, Parent PID: 6748

General

Start time (UTC):	12:58:41
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6750, Parent PID: 6748

General

Start time (UTC):	12:58:41
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 helpmedaddthhhhh
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6751, Parent PID: 6748

General

Start time (UTC):	12:58:42
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6751, Parent PID: 6748

General

Start time (UTC):	12:58:42
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 helpmedaddthhhhh
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6752, Parent PID: 6237

General

Start time (UTC):	12:58:42
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6752, Parent PID: 6237

General

Start time (UTC):	12:58:42
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 2wgg9qphbq \|\| busybox pkill -9 2wgg9qphbq"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6757, Parent PID: 6752

General

Start time (UTC):	12:58:42
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6757, Parent PID: 6752

General

Start time (UTC):	12:58:42
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 2wgg9qphbq
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6758, Parent PID: 6752

General

Start time (UTC):	12:58:44
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6758, Parent PID: 6752

General

Start time (UTC):	12:58:44
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 2wgg9qphbq
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6759, Parent PID: 6237

General

Start time (UTC):	12:58:44
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6759, Parent PID: 6237

General

Start time (UTC):	12:58:44
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 Slav3Th3seD3vices \|\| busybox pkill -9 Slav3Th3seD3vices"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6764, Parent PID: 6759

General

Start time (UTC):	12:58:44
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6764, Parent PID: 6759

General

Start time (UTC):	12:58:44
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 Slav3Th3seD3vices
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6767, Parent PID: 6759

General

Start time (UTC):	12:58:46
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6767, Parent PID: 6759

General

Start time (UTC):	12:58:46
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 Slav3Th3seD3vices
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6768, Parent PID: 6237

General

Start time (UTC):	12:58:46
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6768, Parent PID: 6237

General

Start time (UTC):	12:58:46
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 hzSmYZjYMQ \|\| busybox pkill -9 hzSmYZjYMQ"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6772, Parent PID: 6768

General

Start time (UTC):	12:58:46
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6772, Parent PID: 6768

General

Start time (UTC):	12:58:46
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 hzSmYZjYMQ
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6774, Parent PID: 6768

General

Start time (UTC):	12:58:48
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6774, Parent PID: 6768

General

Start time (UTC):	12:58:48
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 hzSmYZjYMQ
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6775, Parent PID: 6237

General

Start time (UTC):	12:58:48
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6775, Parent PID: 6237

General

Start time (UTC):	12:58:48
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 5Gbf \|\| busybox pkill -9 5Gbf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6777, Parent PID: 6775

General

Start time (UTC):	12:58:48
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6777, Parent PID: 6775

General

Start time (UTC):	12:58:48
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 5Gbf
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6778, Parent PID: 6775

General

Start time (UTC):	12:58:50
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6778, Parent PID: 6775

General

Start time (UTC):	12:58:50
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 5Gbf
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6779, Parent PID: 6237

General

Start time (UTC):	12:58:50
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6779, Parent PID: 6237

General

Start time (UTC):	12:58:50
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SoRAxD123LOL \|\| busybox pkill -9 SoRAxD123LOL"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6785, Parent PID: 6779

General

Start time (UTC):	12:58:50
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6785, Parent PID: 6779

General

Start time (UTC):	12:58:50
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SoRAxD123LOL
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6788, Parent PID: 6779

General

Start time (UTC):	12:58:51
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6788, Parent PID: 6779

General

Start time (UTC):	12:58:51
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SoRAxD123LOL
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6789, Parent PID: 6237

General

Start time (UTC):	12:58:52
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6789, Parent PID: 6237

General

Start time (UTC):	12:58:52
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 iaGv \|\| busybox pkill -9 iaGv"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6791, Parent PID: 6789

General

Start time (UTC):	12:58:52
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6791, Parent PID: 6789

General

Start time (UTC):	12:58:52
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 iaGv
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6792, Parent PID: 6789

General

Start time (UTC):	12:58:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6792, Parent PID: 6789

General

Start time (UTC):	12:58:53
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 iaGv
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.sparc.elf PID: 6793, Parent PID: 6237

General

Start time (UTC):	12:58:53
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.sparc.elf
Arguments:	-
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Analysis Process: sh PID: 6793, Parent PID: 6237

General

Start time (UTC):	12:58:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 5aA3 \|\| busybox pkill -9 5aA3"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6798, Parent PID: 6793

General

Start time (UTC):	12:58:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6798, Parent PID: 6793

General

Start time (UTC):	12:58:53
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 5aA3
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.
Tactics:	Credential Access
Data Sources:	Application Log: Application Log Content, Command: Command Execution, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report yakuza.sparc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: yakuza.sparc.elf PID: 6235, Parent PID: 6160

General

Chronological Activities

Analysis Process: yakuza.sparc.elf PID: 6237, Parent PID: 6235

General

Chronological Activities

Analysis Process: yakuza.sparc.elf PID: 6239, Parent PID: 6237

General

Analysis Process: yakuza.sparc.elf PID: 6240, Parent PID: 6237

General

Chronological Activities

Analysis Process: yakuza.sparc.elf PID: 6246, Parent PID: 6237

General

Chronological Activities

Analysis Process: sh PID: 6246, Parent PID: 6237

Linux Analysis Report
yakuza.sparc.elf