Edit tour

Linux Analysis Report
yakuza.i586.elf

Overview

General Information

Sample name:	yakuza.i586.elf
Analysis ID:	1581667
MD5:	03a4bba7037ad3891c404b3715863ed1
SHA1:	12781c0e39e8e4d5b446c0899c7aa4b3d931a8ac
SHA256:	868940d7321ebd2f2aa237f09bc5a67dba8740698d800ed6dffc4c81310419da
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Machine Learning detection for sample

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "kill" or "pkill" command typically used to terminate processes

Reads CPU information from /sys indicative of miner or evasive malware

Reads the 'hosts' file potentially containing internal network hosts

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample contains strings indicative of password brute-forcing capabilities

Sample contains strings that are user agent strings indicative of HTTP manipulation

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581667
Start date and time:	2024-12-28 14:41:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	yakuza.i586.elf
Detection:	MAL
Classification:	mal68.troj.linELF@0/0@3/0

Warnings

Report size exceeded maximum capacity and may have missing behavior information.

Runtime Messages

Command:	/tmp/yakuza.i586.elf
PID:	5493
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	CAPSAICIN
Standard Error:

Process Tree

system is lnxubuntu20

yakuza.i586.elf (PID: 5493, Parent: 5414, MD5: 03a4bba7037ad3891c404b3715863ed1) Arguments: /tmp/yakuza.i586.elf

yakuza.i586.elf New Fork (PID: 5494, Parent: 5493)

yakuza.i586.elf New Fork (PID: 5495, Parent: 5494)

yakuza.i586.elf New Fork (PID: 5496, Parent: 5494)

yakuza.i586.elf New Fork (PID: 5497, Parent: 5494)

sh (PID: 5497, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 902i13 || busybox pkill -9 902i13"

sh New Fork (PID: 5498, Parent: 5497)

pkill (PID: 5498, Parent: 5497, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 902i13

sh New Fork (PID: 5516, Parent: 5497)

busybox (PID: 5516, Parent: 5497, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 902i13

yakuza.i586.elf New Fork (PID: 5517, Parent: 5494)

sh (PID: 5517, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 BzSxLxBxeY || busybox pkill -9 BzSxLxBxeY"

sh New Fork (PID: 5518, Parent: 5517)

pkill (PID: 5518, Parent: 5517, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 BzSxLxBxeY

sh New Fork (PID: 5521, Parent: 5517)

busybox (PID: 5521, Parent: 5517, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 BzSxLxBxeY

yakuza.i586.elf New Fork (PID: 5522, Parent: 5494)

sh (PID: 5522, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 HOHO-LUGO7 || busybox pkill -9 HOHO-LUGO7"

sh New Fork (PID: 5523, Parent: 5522)

pkill (PID: 5523, Parent: 5522, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 HOHO-LUGO7

sh New Fork (PID: 5524, Parent: 5522)

busybox (PID: 5524, Parent: 5522, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 HOHO-LUGO7

yakuza.i586.elf New Fork (PID: 5525, Parent: 5494)

sh (PID: 5525, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 HOHO-U79OL || busybox pkill -9 HOHO-U79OL"

sh New Fork (PID: 5526, Parent: 5525)

pkill (PID: 5526, Parent: 5525, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 HOHO-U79OL

sh New Fork (PID: 5529, Parent: 5525)

busybox (PID: 5529, Parent: 5525, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 HOHO-U79OL

yakuza.i586.elf New Fork (PID: 5530, Parent: 5494)

sh (PID: 5530, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 JuYfouyf87 || busybox pkill -9 JuYfouyf87"

sh New Fork (PID: 5531, Parent: 5530)

pkill (PID: 5531, Parent: 5530, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 JuYfouyf87

sh New Fork (PID: 5532, Parent: 5530)

busybox (PID: 5532, Parent: 5530, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 JuYfouyf87

yakuza.i586.elf New Fork (PID: 5539, Parent: 5494)

sh (PID: 5539, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"

sh New Fork (PID: 5540, Parent: 5539)

pkill (PID: 5540, Parent: 5539, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeR69xd

sh New Fork (PID: 5541, Parent: 5539)

busybox (PID: 5541, Parent: 5539, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeR69xd

yakuza.i586.elf New Fork (PID: 5544, Parent: 5494)

sh (PID: 5544, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SO190Ij1X || busybox pkill -9 SO190Ij1X"

sh New Fork (PID: 5545, Parent: 5544)

pkill (PID: 5545, Parent: 5544, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SO190Ij1X

sh New Fork (PID: 5546, Parent: 5544)

busybox (PID: 5546, Parent: 5544, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SO190Ij1X

yakuza.i586.elf New Fork (PID: 5547, Parent: 5494)

sh (PID: 5547, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 LOLKIKEEEDDE || busybox pkill -9 LOLKIKEEEDDE"

sh New Fork (PID: 5548, Parent: 5547)

pkill (PID: 5548, Parent: 5547, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 LOLKIKEEEDDE

sh New Fork (PID: 5549, Parent: 5547)

busybox (PID: 5549, Parent: 5547, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 LOLKIKEEEDDE

yakuza.i586.elf New Fork (PID: 5553, Parent: 5494)

sh (PID: 5553, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ekjheory98e || busybox pkill -9 ekjheory98e"

sh New Fork (PID: 5554, Parent: 5553)

pkill (PID: 5554, Parent: 5553, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ekjheory98e

sh New Fork (PID: 5555, Parent: 5553)

busybox (PID: 5555, Parent: 5553, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ekjheory98e

yakuza.i586.elf New Fork (PID: 5574, Parent: 5494)

sh (PID: 5574, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scansh4 || busybox pkill -9 scansh4"

sh New Fork (PID: 5575, Parent: 5574)

pkill (PID: 5575, Parent: 5574, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scansh4

sh New Fork (PID: 5576, Parent: 5574)

busybox (PID: 5576, Parent: 5574, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scansh4

yakuza.i586.elf New Fork (PID: 5577, Parent: 5494)

sh (PID: 5577, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MDMA || busybox pkill -9 MDMA"

sh New Fork (PID: 5578, Parent: 5577)

pkill (PID: 5578, Parent: 5577, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MDMA

sh New Fork (PID: 5581, Parent: 5577)

busybox (PID: 5581, Parent: 5577, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MDMA

yakuza.i586.elf New Fork (PID: 5582, Parent: 5494)

sh (PID: 5582, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 fdevalvex || busybox pkill -9 fdevalvex"

sh New Fork (PID: 5583, Parent: 5582)

pkill (PID: 5583, Parent: 5582, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 fdevalvex

sh New Fork (PID: 5584, Parent: 5582)

busybox (PID: 5584, Parent: 5582, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 fdevalvex

yakuza.i586.elf New Fork (PID: 5585, Parent: 5494)

sh (PID: 5585, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scanspc || busybox pkill -9 scanspc"

sh New Fork (PID: 5586, Parent: 5585)

pkill (PID: 5586, Parent: 5585, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scanspc

sh New Fork (PID: 5589, Parent: 5585)

busybox (PID: 5589, Parent: 5585, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scanspc

yakuza.i586.elf New Fork (PID: 5590, Parent: 5494)

sh (PID: 5590, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MELTEDNINJAREALZ || busybox pkill -9 MELTEDNINJAREALZ"

sh New Fork (PID: 5591, Parent: 5590)

pkill (PID: 5591, Parent: 5590, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MELTEDNINJAREALZ

sh New Fork (PID: 5592, Parent: 5590)

busybox (PID: 5592, Parent: 5590, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MELTEDNINJAREALZ

yakuza.i586.elf New Fork (PID: 5593, Parent: 5494)

sh (PID: 5593, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 flexsonskids || busybox pkill -9 flexsonskids"

sh New Fork (PID: 5594, Parent: 5593)

pkill (PID: 5594, Parent: 5593, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 flexsonskids

sh New Fork (PID: 5595, Parent: 5593)

busybox (PID: 5595, Parent: 5593, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 flexsonskids

yakuza.i586.elf New Fork (PID: 5598, Parent: 5494)

sh (PID: 5598, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scanx86 || busybox pkill -9 scanx86"

sh New Fork (PID: 5599, Parent: 5598)

pkill (PID: 5599, Parent: 5598, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scanx86

sh New Fork (PID: 5600, Parent: 5598)

busybox (PID: 5600, Parent: 5598, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scanx86

yakuza.i586.elf New Fork (PID: 5601, Parent: 5494)

sh (PID: 5601, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MISAKI-U79OL || busybox pkill -9 MISAKI-U79OL"

sh New Fork (PID: 5602, Parent: 5601)

pkill (PID: 5602, Parent: 5601, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MISAKI-U79OL

sh New Fork (PID: 5603, Parent: 5601)

busybox (PID: 5603, Parent: 5601, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MISAKI-U79OL

yakuza.i586.elf New Fork (PID: 5606, Parent: 5494)

sh (PID: 5606, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 foAxi102kxe || busybox pkill -9 foAxi102kxe"

sh New Fork (PID: 5607, Parent: 5606)

pkill (PID: 5607, Parent: 5606, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 foAxi102kxe

sh New Fork (PID: 5608, Parent: 5606)

busybox (PID: 5608, Parent: 5606, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 foAxi102kxe

yakuza.i586.elf New Fork (PID: 5609, Parent: 5494)

sh (PID: 5609, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 swodjwodjwoj || busybox pkill -9 swodjwodjwoj"

sh New Fork (PID: 5610, Parent: 5609)

pkill (PID: 5610, Parent: 5609, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 swodjwodjwoj

sh New Fork (PID: 5611, Parent: 5609)

busybox (PID: 5611, Parent: 5609, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 swodjwodjwoj

yakuza.i586.elf New Fork (PID: 5612, Parent: 5494)

sh (PID: 5612, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MmKiy7f87l || busybox pkill -9 MmKiy7f87l"

sh New Fork (PID: 5613, Parent: 5612)

pkill (PID: 5613, Parent: 5612, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MmKiy7f87l

sh New Fork (PID: 5616, Parent: 5612)

busybox (PID: 5616, Parent: 5612, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MmKiy7f87l

yakuza.i586.elf New Fork (PID: 5617, Parent: 5494)

sh (PID: 5617, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 freecookiex86 || busybox pkill -9 freecookiex86"

sh New Fork (PID: 5618, Parent: 5617)

pkill (PID: 5618, Parent: 5617, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 freecookiex86

sh New Fork (PID: 5619, Parent: 5617)

busybox (PID: 5619, Parent: 5617, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 freecookiex86

yakuza.i586.elf New Fork (PID: 5620, Parent: 5494)

sh (PID: 5620, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 sysgpu || busybox pkill -9 sysgpu"

sh New Fork (PID: 5621, Parent: 5620)

pkill (PID: 5621, Parent: 5620, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 sysgpu

sh New Fork (PID: 5622, Parent: 5620)

busybox (PID: 5622, Parent: 5620, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 sysgpu

yakuza.i586.elf New Fork (PID: 5626, Parent: 5494)

sh (PID: 5626, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"

sh New Fork (PID: 5627, Parent: 5626)

pkill (PID: 5627, Parent: 5626, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeR69xd

sh New Fork (PID: 5630, Parent: 5626)

busybox (PID: 5630, Parent: 5626, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeR69xd

yakuza.i586.elf New Fork (PID: 5631, Parent: 5494)

sh (PID: 5631, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 frgege || busybox pkill -9 frgege"

sh New Fork (PID: 5632, Parent: 5631)

pkill (PID: 5632, Parent: 5631, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 frgege

sh New Fork (PID: 5633, Parent: 5631)

busybox (PID: 5633, Parent: 5631, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 frgege

yakuza.i586.elf New Fork (PID: 5636, Parent: 5494)

sh (PID: 5636, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 sysupdater || busybox pkill -9 sysupdater"

sh New Fork (PID: 5637, Parent: 5636)

pkill (PID: 5637, Parent: 5636, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 sysupdater

sh New Fork (PID: 5638, Parent: 5636)

busybox (PID: 5638, Parent: 5636, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 sysupdater

yakuza.i586.elf New Fork (PID: 5639, Parent: 5494)

sh (PID: 5639, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 0DnAzepd || busybox pkill -9 0DnAzepd"

sh New Fork (PID: 5640, Parent: 5639)

pkill (PID: 5640, Parent: 5639, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 0DnAzepd

sh New Fork (PID: 5641, Parent: 5639)

busybox (PID: 5641, Parent: 5639, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 0DnAzepd

yakuza.i586.elf New Fork (PID: 5642, Parent: 5494)

sh (PID: 5642, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeRD0nks69 || busybox pkill -9 NiGGeRD0nks69"

sh New Fork (PID: 5643, Parent: 5642)

pkill (PID: 5643, Parent: 5642, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeRD0nks69

sh New Fork (PID: 5646, Parent: 5642)

busybox (PID: 5646, Parent: 5642, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeRD0nks69

yakuza.i586.elf New Fork (PID: 5647, Parent: 5494)

sh (PID: 5647, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 frgreu || busybox pkill -9 frgreu"

sh New Fork (PID: 5648, Parent: 5647)

pkill (PID: 5648, Parent: 5647, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 frgreu

sh New Fork (PID: 5649, Parent: 5647)

busybox (PID: 5649, Parent: 5647, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 frgreu

yakuza.i586.elf New Fork (PID: 5650, Parent: 5494)

sh (PID: 5650, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 telnetd || busybox pkill -9 telnetd"

sh New Fork (PID: 5651, Parent: 5650)

pkill (PID: 5651, Parent: 5650, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 telnetd

sh New Fork (PID: 5652, Parent: 5650)

busybox (PID: 5652, Parent: 5650, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 telnetd

yakuza.i586.elf New Fork (PID: 5655, Parent: 5494)

sh (PID: 5655, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 0x766f6964 || busybox pkill -9 0x766f6964"

sh New Fork (PID: 5656, Parent: 5655)

pkill (PID: 5656, Parent: 5655, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 0x766f6964

sh New Fork (PID: 5657, Parent: 5655)

busybox (PID: 5657, Parent: 5655, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 0x766f6964

yakuza.i586.elf New Fork (PID: 5658, Parent: 5494)

sh (PID: 5658, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeRd0nks1337 || busybox pkill -9 NiGGeRd0nks1337"

sh New Fork (PID: 5659, Parent: 5658)

pkill (PID: 5659, Parent: 5658, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeRd0nks1337

sh New Fork (PID: 5660, Parent: 5658)

busybox (PID: 5660, Parent: 5658, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeRd0nks1337

yakuza.i586.elf New Fork (PID: 5663, Parent: 5494)

sh (PID: 5663, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 gaft || busybox pkill -9 gaft"

sh New Fork (PID: 5664, Parent: 5663)

pkill (PID: 5664, Parent: 5663, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 gaft

sh New Fork (PID: 5665, Parent: 5663)

busybox (PID: 5665, Parent: 5663, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 gaft

yakuza.i586.elf New Fork (PID: 5666, Parent: 5494)

sh (PID: 5666, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 urasgbsigboa || busybox pkill -9 urasgbsigboa"

sh New Fork (PID: 5667, Parent: 5666)

pkill (PID: 5667, Parent: 5666, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 urasgbsigboa

sh New Fork (PID: 5668, Parent: 5666)

busybox (PID: 5668, Parent: 5666, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 urasgbsigboa

yakuza.i586.elf New Fork (PID: 5669, Parent: 5494)

sh (PID: 5669, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 120i3UI49 || busybox pkill -9 120i3UI49"

sh New Fork (PID: 5670, Parent: 5669)

pkill (PID: 5670, Parent: 5669, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 120i3UI49

sh New Fork (PID: 5673, Parent: 5669)

busybox (PID: 5673, Parent: 5669, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 120i3UI49

yakuza.i586.elf New Fork (PID: 5674, Parent: 5494)

sh (PID: 5674, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 OaF3 || busybox pkill -9 OaF3"

sh New Fork (PID: 5675, Parent: 5674)

pkill (PID: 5675, Parent: 5674, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 OaF3

sh New Fork (PID: 5676, Parent: 5674)

busybox (PID: 5676, Parent: 5674, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 OaF3

yakuza.i586.elf New Fork (PID: 5677, Parent: 5494)

sh (PID: 5677, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 geae || busybox pkill -9 geae"

sh New Fork (PID: 5678, Parent: 5677)

pkill (PID: 5678, Parent: 5677, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 geae

sh New Fork (PID: 5680, Parent: 5677)

busybox (PID: 5680, Parent: 5677, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 geae

yakuza.i586.elf New Fork (PID: 5683, Parent: 5494)

sh (PID: 5683, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 vaiolmao || busybox pkill -9 vaiolmao"

sh New Fork (PID: 5684, Parent: 5683)

pkill (PID: 5684, Parent: 5683, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 vaiolmao

sh New Fork (PID: 5685, Parent: 5683)

busybox (PID: 5685, Parent: 5683, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 vaiolmao

yakuza.i586.elf New Fork (PID: 5686, Parent: 5494)

sh (PID: 5686, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 123123a || busybox pkill -9 123123a"

sh New Fork (PID: 5687, Parent: 5686)

pkill (PID: 5687, Parent: 5686, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 123123a

sh New Fork (PID: 5688, Parent: 5686)

busybox (PID: 5688, Parent: 5686, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 123123a

yakuza.i586.elf New Fork (PID: 5691, Parent: 5494)

sh (PID: 5691, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 Ofurain0n4H34D || busybox pkill -9 Ofurain0n4H34D"

sh New Fork (PID: 5692, Parent: 5691)

pkill (PID: 5692, Parent: 5691, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 Ofurain0n4H34D

sh New Fork (PID: 5693, Parent: 5691)

busybox (PID: 5693, Parent: 5691, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 Ofurain0n4H34D

yakuza.i586.elf New Fork (PID: 5694, Parent: 5494)

sh (PID: 5694, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggTrex || busybox pkill -9 ggTrex"

sh New Fork (PID: 5695, Parent: 5694)

pkill (PID: 5695, Parent: 5694, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggTrex

sh New Fork (PID: 5696, Parent: 5694)

busybox (PID: 5696, Parent: 5694, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggTrex

yakuza.i586.elf New Fork (PID: 5697, Parent: 5494)

sh (PID: 5697, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 wasads || busybox pkill -9 wasads"

sh New Fork (PID: 5698, Parent: 5697)

pkill (PID: 5698, Parent: 5697, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 wasads

sh New Fork (PID: 5701, Parent: 5697)

busybox (PID: 5701, Parent: 5697, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 wasads

yakuza.i586.elf New Fork (PID: 5702, Parent: 5494)

sh (PID: 5702, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1293194hjXD || busybox pkill -9 1293194hjXD"

sh New Fork (PID: 5703, Parent: 5702)

pkill (PID: 5703, Parent: 5702, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1293194hjXD

sh New Fork (PID: 5704, Parent: 5702)

busybox (PID: 5704, Parent: 5702, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1293194hjXD

yakuza.i586.elf New Fork (PID: 5705, Parent: 5494)

sh (PID: 5705, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 OthLaLosn || busybox pkill -9 OthLaLosn"

sh New Fork (PID: 5706, Parent: 5705)

pkill (PID: 5706, Parent: 5705, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 OthLaLosn

sh New Fork (PID: 5707, Parent: 5705)

busybox (PID: 5707, Parent: 5705, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 OthLaLosn

yakuza.i586.elf New Fork (PID: 5710, Parent: 5494)

sh (PID: 5710, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggt || busybox pkill -9 ggt"

sh New Fork (PID: 5711, Parent: 5710)

pkill (PID: 5711, Parent: 5710, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggt

sh New Fork (PID: 5712, Parent: 5710)

busybox (PID: 5712, Parent: 5710, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggt

yakuza.i586.elf New Fork (PID: 5713, Parent: 5494)

sh (PID: 5713, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 wget-log || busybox pkill -9 wget-log"

sh New Fork (PID: 5714, Parent: 5713)

pkill (PID: 5714, Parent: 5713, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 wget-log

sh New Fork (PID: 5715, Parent: 5713)

busybox (PID: 5715, Parent: 5713, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 wget-log

yakuza.i586.elf New Fork (PID: 5718, Parent: 5494)

sh (PID: 5718, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1337SoraLOADER || busybox pkill -9 1337SoraLOADER"

sh New Fork (PID: 5719, Parent: 5718)

pkill (PID: 5719, Parent: 5718, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1337SoraLOADER

sh New Fork (PID: 5720, Parent: 5718)

busybox (PID: 5720, Parent: 5718, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1337SoraLOADER

yakuza.i586.elf New Fork (PID: 5721, Parent: 5494)

sh (PID: 5721, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SAIAKINA || busybox pkill -9 SAIAKINA"

sh New Fork (PID: 5722, Parent: 5721)

pkill (PID: 5722, Parent: 5721, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SAIAKINA

sh New Fork (PID: 5723, Parent: 5721)

busybox (PID: 5723, Parent: 5721, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SAIAKINA

yakuza.i586.elf New Fork (PID: 5724, Parent: 5494)

sh (PID: 5724, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggtq || busybox pkill -9 ggtq"

sh New Fork (PID: 5725, Parent: 5724)

pkill (PID: 5725, Parent: 5724, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggtq

sh New Fork (PID: 5729, Parent: 5724)

busybox (PID: 5729, Parent: 5724, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggtq

yakuza.i586.elf New Fork (PID: 5730, Parent: 5494)

sh (PID: 5730, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1378bfp919GRB1Q2 || busybox pkill -9 1378bfp919GRB1Q2"

sh New Fork (PID: 5731, Parent: 5730)

pkill (PID: 5731, Parent: 5730, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1378bfp919GRB1Q2

sh New Fork (PID: 5732, Parent: 5730)

busybox (PID: 5732, Parent: 5730, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1378bfp919GRB1Q2

yakuza.i586.elf New Fork (PID: 5733, Parent: 5494)

sh (PID: 5733, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SAIAKUSO || busybox pkill -9 SAIAKUSO"

sh New Fork (PID: 5734, Parent: 5733)

pkill (PID: 5734, Parent: 5733, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SAIAKUSO

sh New Fork (PID: 5736, Parent: 5733)

busybox (PID: 5736, Parent: 5733, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SAIAKUSO

yakuza.i586.elf New Fork (PID: 5739, Parent: 5494)

sh (PID: 5739, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggtr || busybox pkill -9 ggtr"

sh New Fork (PID: 5740, Parent: 5739)

pkill (PID: 5740, Parent: 5739, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggtr

sh New Fork (PID: 5743, Parent: 5739)

busybox (PID: 5743, Parent: 5739, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggtr

yakuza.i586.elf New Fork (PID: 5744, Parent: 5494)

sh (PID: 5744, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 14Fa || busybox pkill -9 14Fa"

sh New Fork (PID: 5745, Parent: 5744)

pkill (PID: 5745, Parent: 5744, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 14Fa

sh New Fork (PID: 5746, Parent: 5744)

busybox (PID: 5746, Parent: 5744, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 14Fa

yakuza.i586.elf New Fork (PID: 5749, Parent: 5494)

sh (PID: 5749, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SEXSLAVE1337 || busybox pkill -9 SEXSLAVE1337"

sh New Fork (PID: 5750, Parent: 5749)

pkill (PID: 5750, Parent: 5749, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SEXSLAVE1337

sh New Fork (PID: 5751, Parent: 5749)

busybox (PID: 5751, Parent: 5749, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SEXSLAVE1337

yakuza.i586.elf New Fork (PID: 5752, Parent: 5494)

sh (PID: 5752, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggtt || busybox pkill -9 ggtt"

sh New Fork (PID: 5753, Parent: 5752)

pkill (PID: 5753, Parent: 5752, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggtt

sh New Fork (PID: 5754, Parent: 5752)

busybox (PID: 5754, Parent: 5752, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggtt

yakuza.i586.elf New Fork (PID: 5755, Parent: 5494)

sh (PID: 5755, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1902a3u912u3u4 || busybox pkill -9 1902a3u912u3u4"

sh New Fork (PID: 5756, Parent: 5755)

pkill (PID: 5756, Parent: 5755, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1902a3u912u3u4

sh New Fork (PID: 5759, Parent: 5755)

busybox (PID: 5759, Parent: 5755, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1902a3u912u3u4

yakuza.i586.elf New Fork (PID: 5760, Parent: 5494)

sh (PID: 5760, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SO190Ij1X || busybox pkill -9 SO190Ij1X"

sh New Fork (PID: 5761, Parent: 5760)

pkill (PID: 5761, Parent: 5760, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SO190Ij1X

sh New Fork (PID: 5762, Parent: 5760)

busybox (PID: 5762, Parent: 5760, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SO190Ij1X

yakuza.i586.elf New Fork (PID: 5763, Parent: 5494)

sh (PID: 5763, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 haetrghbr || busybox pkill -9 haetrghbr"

sh New Fork (PID: 5764, Parent: 5763)

pkill (PID: 5764, Parent: 5763, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 haetrghbr

sh New Fork (PID: 5765, Parent: 5763)

busybox (PID: 5765, Parent: 5763, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 haetrghbr

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
yakuza.i586.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
yakuza.i586.elf	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x33b7:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
yakuza.i586.elf	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0xc879:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
yakuza.i586.elf	Linux_Trojan_Gafgyt_750fe002	unknown	unknown	0x39b2:$a: 10 8B 45 0C 40 8A 00 3C FC 75 06 C6 45 FF FE EB 50 8B 45 0C 40
yakuza.i586.elf	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x3454:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
yakuza.i586.elf	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc3fc:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
yakuza.i586.elf	Linux_Trojan_Tsunami_0fa3a6e9	unknown	unknown	0x1de:$a: EC 8B 55 EC C1 FA 10 0F B7 45 EC 01 C2 89 55 EC 8B 45 EC C1 0x853:$a: EC 8B 55 EC C1 FA 10 0F B7 45 EC 01 C2 89 55 EC 8B 45 EC C1
yakuza.i586.elf	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x129f5:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x13091:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
yakuza.i586.elf	Linux_Trojan_Tsunami_6b3974b2	unknown	unknown	0x45a:$a: F4 89 45 EC 8B 45 EC C9 C3 55 89 E5 57 83 EC 0C EB 1F 8B 45 08 B9 FF FF
Click to see the 4 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5493.1.0000000008048000.000000000805e000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5493.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x33b7:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
5493.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0xc879:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
5493.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Gafgyt_750fe002	unknown	unknown	0x39b2:$a: 10 8B 45 0C 40 8A 00 3C FC 75 06 C6 45 FF FE EB 50 8B 45 0C 40
5493.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x3454:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
5493.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc3fc:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5493.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Tsunami_0fa3a6e9	unknown	unknown	0x1de:$a: EC 8B 55 EC C1 FA 10 0F B7 45 EC 01 C2 89 55 EC 8B 45 EC C1 0x853:$a: EC 8B 55 EC C1 FA 10 0F B7 45 EC 01 C2 89 55 EC 8B 45 EC C1
5493.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x129f5:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x13091:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
5493.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Tsunami_6b3974b2	unknown	unknown	0x45a:$a: F4 89 45 EC 8B 45 EC C9 C3 55 89 E5 57 83 EC 0C EB 1F 8B 45 08 B9 FF FF
5496.1.0000000008048000.000000000805e000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5496.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Gafgyt_c573932b	unknown	unknown	0x33b7:$a: 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF
5496.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0xc879:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
5496.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Gafgyt_750fe002	unknown	unknown	0x39b2:$a: 10 8B 45 0C 40 8A 00 3C FC 75 06 C6 45 FF FE EB 50 8B 45 0C 40
5496.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Gafgyt_7167d08f	unknown	unknown	0x3454:$a: 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF
5496.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xc3fc:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
5496.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Tsunami_0fa3a6e9	unknown	unknown	0x1de:$a: EC 8B 55 EC C1 FA 10 0F B7 45 EC 01 C2 89 55 EC 8B 45 EC C1 0x853:$a: EC 8B 55 EC C1 FA 10 0F B7 45 EC 01 C2 89 55 EC 8B 45 EC C1
5496.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x129f5:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x13091:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
5496.1.0000000008048000.000000000805e000.r-x.sdmp	Linux_Trojan_Tsunami_6b3974b2	unknown	unknown	0x45a:$a: F4 89 45 EC 8B 45 EC C9 C3 55 89 E5 57 83 EC 0C EB 1F 8B 45 08 B9 FF FF
Process Memory Space: yakuza.i586.elf PID: 5493	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x43c5:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x44fa:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x4b67:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
Process Memory Space: yakuza.i586.elf PID: 5496	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x40a0:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x41d5:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x4842:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
Click to see the 15 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: yakuza.i586.elf

ReversingLabs: Detection: 60%

Machine Learning detection for sample

Source: yakuza.i586.elf

Joe Sandbox ML: detected

Source: /usr/bin/pkill (PID: 5498)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5518)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5523)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5526)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5531)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5545)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5548)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5554)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5575)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5578)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5586)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5591)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5594)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5599)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5602)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5607)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5610)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5613)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5618)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5621)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5627)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5632)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5637)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5640)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5643)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5648)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5651)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5656)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5659)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5664)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5667)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5670)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5675)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5678)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5684)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5687)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5692)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5695)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5698)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5703)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5706)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5711)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5714)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5719)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5722)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5725)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5731)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5734)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5740)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5745)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5750)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5753)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5756)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5761)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5764)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/yakuza.i586.elf (PID: 5496)

Reads hosts file: /etc/hosts

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.14:46540 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: pirati.privatedns.org
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: yakuza.i586.elf	String found in binary or memory: http://linux-it.abuser.eu/yak.sh;
Source: yakuza.i586.elf	String found in binary or memory: https://youtu.be/dQw4w9WgXcQ
Source: yakuza.i586.elf	String found in binary or memory: https://youtu.be/dQw4w9WgXcQNever

Source: unknown

Network traffic detected: HTTP traffic on port 46540 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: yakuza.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: yakuza.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: yakuza.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_750fe002 Author: unknown
Source: yakuza.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: yakuza.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: yakuza.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_0fa3a6e9 Author: unknown
Source: yakuza.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: yakuza.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_6b3974b2 Author: unknown
Source: 5493.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: 5493.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 5493.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_750fe002 Author: unknown
Source: 5493.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: 5493.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5493.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_0fa3a6e9 Author: unknown
Source: 5493.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: 5493.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_6b3974b2 Author: unknown
Source: 5496.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b Author: unknown
Source: 5496.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 5496.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_750fe002 Author: unknown
Source: 5496.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f Author: unknown
Source: 5496.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5496.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_0fa3a6e9 Author: unknown
Source: 5496.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: 5496.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_6b3974b2 Author: unknown
Source: Process Memory Space: yakuza.i586.elf PID: 5493, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: Process Memory Space: yakuza.i586.elf PID: 5496, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown

Source: yakuza.i586.elf	ELF static info symbol of initial sample: passwords
Source: yakuza.i586.elf	ELF static info symbol of initial sample: usernames

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: pkill -9 %s \|\| busybox pkill -9 %s
Source: Initial sample	String containing 'busybox' found: pkill -9 %s \|\| busybox pkill -9 %shistory -c;history -wcd /root;rm -f .bash_historycd /var/tmp; rm -f *NOTICE %s :MOVE <server>

Source: Initial sample	String containing potential weak password found: guest
Source: Initial sample	String containing potential weak password found: default
Source: Initial sample	String containing potential weak password found: admin
Source: Initial sample	String containing potential weak password found: supervisor
Source: Initial sample	String containing potential weak password found: service
Source: Initial sample	String containing potential weak password found: administrator
Source: Initial sample	String containing potential weak password found: support
Source: Initial sample	String containing potential weak password found: 123456
Source: Initial sample	String containing potential weak password found: password
Source: Initial sample	String containing potential weak password found: 12345

Source: yakuza.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: yakuza.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: yakuza.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_750fe002 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f51347158a6477b0da4ed4df3374fbad92b6ac137aa4775f83035d1e30cba7dc, id = 750fe002-cac1-4832-94d2-212aa5ec17e3, last_modified = 2021-09-16
Source: yakuza.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: yakuza.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: yakuza.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_0fa3a6e9 reference_sample = 40a15a186373a062bfb476b37a73c61e1ba84e5fa57282a7f9ec0481860f372a, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = fed796c5275e2e91c75dcdbf73d0c0ab37591115989312c6f6c5adcd138bc91f, id = 0fa3a6e9-89f3-4bc8-8dc1-e9ccbeeb836d, last_modified = 2021-09-16
Source: yakuza.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: yakuza.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_6b3974b2 reference_sample = 2216776ba5c6495d86a13f6a3ce61b655b72a328ca05b3678d1abb7a20829d04, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 942a35f7acacf1d07577fe159a34dc7b04e5d07ff32ea13be975cfeea23e34be, id = 6b3974b2-fd7f-4ebf-8aba-217761e7b846, last_modified = 2021-09-16
Source: 5493.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: 5493.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 5493.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_750fe002 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f51347158a6477b0da4ed4df3374fbad92b6ac137aa4775f83035d1e30cba7dc, id = 750fe002-cac1-4832-94d2-212aa5ec17e3, last_modified = 2021-09-16
Source: 5493.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: 5493.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5493.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_0fa3a6e9 reference_sample = 40a15a186373a062bfb476b37a73c61e1ba84e5fa57282a7f9ec0481860f372a, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = fed796c5275e2e91c75dcdbf73d0c0ab37591115989312c6f6c5adcd138bc91f, id = 0fa3a6e9-89f3-4bc8-8dc1-e9ccbeeb836d, last_modified = 2021-09-16
Source: 5493.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: 5493.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_6b3974b2 reference_sample = 2216776ba5c6495d86a13f6a3ce61b655b72a328ca05b3678d1abb7a20829d04, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 942a35f7acacf1d07577fe159a34dc7b04e5d07ff32ea13be975cfeea23e34be, id = 6b3974b2-fd7f-4ebf-8aba-217761e7b846, last_modified = 2021-09-16
Source: 5496.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_c573932b reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266, id = c573932b-9b3f-4ab7-a6b6-32dcc7473790, last_modified = 2021-09-16
Source: 5496.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 5496.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_750fe002 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f51347158a6477b0da4ed4df3374fbad92b6ac137aa4775f83035d1e30cba7dc, id = 750fe002-cac1-4832-94d2-212aa5ec17e3, last_modified = 2021-09-16
Source: 5496.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_7167d08f reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9, id = 7167d08f-bfeb-4d78-9783-3a1df2ef0ed3, last_modified = 2021-09-16
Source: 5496.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5496.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_0fa3a6e9 reference_sample = 40a15a186373a062bfb476b37a73c61e1ba84e5fa57282a7f9ec0481860f372a, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = fed796c5275e2e91c75dcdbf73d0c0ab37591115989312c6f6c5adcd138bc91f, id = 0fa3a6e9-89f3-4bc8-8dc1-e9ccbeeb836d, last_modified = 2021-09-16
Source: 5496.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: 5496.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_6b3974b2 reference_sample = 2216776ba5c6495d86a13f6a3ce61b655b72a328ca05b3678d1abb7a20829d04, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 942a35f7acacf1d07577fe159a34dc7b04e5d07ff32ea13be975cfeea23e34be, id = 6b3974b2-fd7f-4ebf-8aba-217761e7b846, last_modified = 2021-09-16
Source: Process Memory Space: yakuza.i586.elf PID: 5493, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: Process Memory Space: yakuza.i586.elf PID: 5496, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16

Source: classification engine

Classification label: mal68.troj.linELF@0/0@3/0

Source: yakuza.i586.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crt1.S
Source: yakuza.i586.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crti.S
Source: yakuza.i586.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/crtn.S
Source: yakuza.i586.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/mmap.S
Source: yakuza.i586.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/i386/vfork.S

Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/1583/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/2672/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/234/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/234/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/1577/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/1577/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/917/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/917/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/13/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/14/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/14/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/15/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/15/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/16/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/16/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/17/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/17/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/18/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/18/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/19/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/19/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/1593/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/1593/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/240/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/240/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/120/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/120/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/3094/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/3094/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/121/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/121/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/242/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/242/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/3406/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/1/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/122/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/122/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/243/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/243/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/2/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/2/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/123/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/123/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/244/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/244/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/1589/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/1589/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/3/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/3/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/124/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/124/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/245/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/245/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/1588/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/125/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/125/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/4/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/4/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/246/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/246/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/3402/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/3402/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/126/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/126/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/5/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/5/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/247/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/247/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/127/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/127/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/6/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	File opened: /proc/6/cmdline	Jump to behavior

Source: /tmp/yakuza.i586.elf (PID: 5497)	Shell command executed: sh -c "pkill -9 902i13 \|\| busybox pkill -9 902i13"	Jump to behavior
Source: /tmp/yakuza.i586.elf (PID: 5517)	Shell command executed: sh -c "pkill -9 BzSxLxBxeY \|\| busybox pkill -9 BzSxLxBxeY"	Jump to behavior
Source: /tmp/yakuza.i586.elf (PID: 5522)	Shell command executed: sh -c "pkill -9 HOHO-LUGO7 \|\| busybox pkill -9 HOHO-LUGO7"	Jump to behavior
Source: /tmp/yakuza.i586.elf (PID: 5525)	Shell command executed: sh -c "pkill -9 HOHO-U79OL \|\| busybox pkill -9 HOHO-U79OL"	Jump to behavior
Source: /tmp/yakuza.i586.elf (PID: 5530)	Shell command executed: sh -c "pkill -9 JuYfouyf87 \|\| busybox pkill -9 JuYfouyf87"	Jump to behavior
Source: /tmp/yakuza.i586.elf (PID: 5539)	Shell command executed: sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"	Jump to behavior
Source: /tmp/yakuza.i586.elf (PID: 5544)	Shell command executed: sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"	Jump to behavior
Source: /tmp/yakuza.i586.elf (PID: 5547)	Shell command executed: sh -c "pkill -9 LOLKIKEEEDDE \|\| busybox pkill -9 LOLKIKEEEDDE"	Jump to behavior
Source: /tmp/yakuza.i586.elf (PID: 5553)	Shell command executed: sh -c "pkill -9 ekjheory98e \|\| busybox pkill -9 ekjheory98e"	Jump to behavior
Source: /tmp/yakuza.i586.elf (PID: 5574)	Shell command executed: sh -c "pkill -9 scansh4 \|\| busybox pkill -9 scansh4"	Jump to behavior
Source: /tmp/yakuza.i586.elf (PID: 5577)	Shell command executed: sh -c "pkill -9 MDMA \|\| busybox pkill -9 MDMA"	Jump to behavior
Source: /tmp/yakuza.i586.elf (PID: 5582)	Shell command executed: sh -c "pkill -9 fdevalvex \|\| busybox pkill -9 fdevalvex"	Jump to behavior
Source: /tmp/yakuza.i586.elf (PID: 5585)	Shell command executed: sh -c "pkill -9 scanspc \|\| busybox pkill -9 scanspc"	Jump to behavior
Source: /tmp/yakuza.i586.elf (PID: 5590)	Shell command executed: sh -c "pkill -9 MELTEDNINJAREALZ \|\| busybox pkill -9 MELTEDNINJAREALZ"	Jump to behavior
Source: /tmp/yakuza.i586.elf (PID: 5593)	Shell command executed: sh -c "pkill -9 flexsonskids \|\| busybox pkill -9 flexsonskids"	Jump to behavior
Source: /tmp/yakuza.i586.elf (PID: 5598)	Shell command executed: sh -c "pkill -9 scanx86 \|\| busybox pkill -9 scanx86"
Source: /tmp/yakuza.i586.elf (PID: 5601)	Shell command executed: sh -c "pkill -9 MISAKI-U79OL \|\| busybox pkill -9 MISAKI-U79OL"
Source: /tmp/yakuza.i586.elf (PID: 5606)	Shell command executed: sh -c "pkill -9 foAxi102kxe \|\| busybox pkill -9 foAxi102kxe"
Source: /tmp/yakuza.i586.elf (PID: 5609)	Shell command executed: sh -c "pkill -9 swodjwodjwoj \|\| busybox pkill -9 swodjwodjwoj"
Source: /tmp/yakuza.i586.elf (PID: 5612)	Shell command executed: sh -c "pkill -9 MmKiy7f87l \|\| busybox pkill -9 MmKiy7f87l"
Source: /tmp/yakuza.i586.elf (PID: 5617)	Shell command executed: sh -c "pkill -9 freecookiex86 \|\| busybox pkill -9 freecookiex86"
Source: /tmp/yakuza.i586.elf (PID: 5620)	Shell command executed: sh -c "pkill -9 sysgpu \|\| busybox pkill -9 sysgpu"
Source: /tmp/yakuza.i586.elf (PID: 5626)	Shell command executed: sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
Source: /tmp/yakuza.i586.elf (PID: 5631)	Shell command executed: sh -c "pkill -9 frgege \|\| busybox pkill -9 frgege"
Source: /tmp/yakuza.i586.elf (PID: 5636)	Shell command executed: sh -c "pkill -9 sysupdater \|\| busybox pkill -9 sysupdater"
Source: /tmp/yakuza.i586.elf (PID: 5639)	Shell command executed: sh -c "pkill -9 0DnAzepd \|\| busybox pkill -9 0DnAzepd"
Source: /tmp/yakuza.i586.elf (PID: 5642)	Shell command executed: sh -c "pkill -9 NiGGeRD0nks69 \|\| busybox pkill -9 NiGGeRD0nks69"
Source: /tmp/yakuza.i586.elf (PID: 5647)	Shell command executed: sh -c "pkill -9 frgreu \|\| busybox pkill -9 frgreu"
Source: /tmp/yakuza.i586.elf (PID: 5650)	Shell command executed: sh -c "pkill -9 telnetd \|\| busybox pkill -9 telnetd"
Source: /tmp/yakuza.i586.elf (PID: 5655)	Shell command executed: sh -c "pkill -9 0x766f6964 \|\| busybox pkill -9 0x766f6964"
Source: /tmp/yakuza.i586.elf (PID: 5658)	Shell command executed: sh -c "pkill -9 NiGGeRd0nks1337 \|\| busybox pkill -9 NiGGeRd0nks1337"
Source: /tmp/yakuza.i586.elf (PID: 5663)	Shell command executed: sh -c "pkill -9 gaft \|\| busybox pkill -9 gaft"
Source: /tmp/yakuza.i586.elf (PID: 5666)	Shell command executed: sh -c "pkill -9 urasgbsigboa \|\| busybox pkill -9 urasgbsigboa"
Source: /tmp/yakuza.i586.elf (PID: 5669)	Shell command executed: sh -c "pkill -9 120i3UI49 \|\| busybox pkill -9 120i3UI49"
Source: /tmp/yakuza.i586.elf (PID: 5674)	Shell command executed: sh -c "pkill -9 OaF3 \|\| busybox pkill -9 OaF3"
Source: /tmp/yakuza.i586.elf (PID: 5677)	Shell command executed: sh -c "pkill -9 geae \|\| busybox pkill -9 geae"
Source: /tmp/yakuza.i586.elf (PID: 5683)	Shell command executed: sh -c "pkill -9 vaiolmao \|\| busybox pkill -9 vaiolmao"
Source: /tmp/yakuza.i586.elf (PID: 5686)	Shell command executed: sh -c "pkill -9 123123a \|\| busybox pkill -9 123123a"
Source: /tmp/yakuza.i586.elf (PID: 5691)	Shell command executed: sh -c "pkill -9 Ofurain0n4H34D \|\| busybox pkill -9 Ofurain0n4H34D"
Source: /tmp/yakuza.i586.elf (PID: 5694)	Shell command executed: sh -c "pkill -9 ggTrex \|\| busybox pkill -9 ggTrex"
Source: /tmp/yakuza.i586.elf (PID: 5697)	Shell command executed: sh -c "pkill -9 wasads \|\| busybox pkill -9 wasads"
Source: /tmp/yakuza.i586.elf (PID: 5702)	Shell command executed: sh -c "pkill -9 1293194hjXD \|\| busybox pkill -9 1293194hjXD"
Source: /tmp/yakuza.i586.elf (PID: 5705)	Shell command executed: sh -c "pkill -9 OthLaLosn \|\| busybox pkill -9 OthLaLosn"
Source: /tmp/yakuza.i586.elf (PID: 5710)	Shell command executed: sh -c "pkill -9 ggt \|\| busybox pkill -9 ggt"
Source: /tmp/yakuza.i586.elf (PID: 5713)	Shell command executed: sh -c "pkill -9 wget-log \|\| busybox pkill -9 wget-log"
Source: /tmp/yakuza.i586.elf (PID: 5718)	Shell command executed: sh -c "pkill -9 1337SoraLOADER \|\| busybox pkill -9 1337SoraLOADER"
Source: /tmp/yakuza.i586.elf (PID: 5721)	Shell command executed: sh -c "pkill -9 SAIAKINA \|\| busybox pkill -9 SAIAKINA"
Source: /tmp/yakuza.i586.elf (PID: 5724)	Shell command executed: sh -c "pkill -9 ggtq \|\| busybox pkill -9 ggtq"
Source: /tmp/yakuza.i586.elf (PID: 5730)	Shell command executed: sh -c "pkill -9 1378bfp919GRB1Q2 \|\| busybox pkill -9 1378bfp919GRB1Q2"
Source: /tmp/yakuza.i586.elf (PID: 5733)	Shell command executed: sh -c "pkill -9 SAIAKUSO \|\| busybox pkill -9 SAIAKUSO"
Source: /tmp/yakuza.i586.elf (PID: 5739)	Shell command executed: sh -c "pkill -9 ggtr \|\| busybox pkill -9 ggtr"
Source: /tmp/yakuza.i586.elf (PID: 5744)	Shell command executed: sh -c "pkill -9 14Fa \|\| busybox pkill -9 14Fa"
Source: /tmp/yakuza.i586.elf (PID: 5749)	Shell command executed: sh -c "pkill -9 SEXSLAVE1337 \|\| busybox pkill -9 SEXSLAVE1337"
Source: /tmp/yakuza.i586.elf (PID: 5752)	Shell command executed: sh -c "pkill -9 ggtt \|\| busybox pkill -9 ggtt"
Source: /tmp/yakuza.i586.elf (PID: 5755)	Shell command executed: sh -c "pkill -9 1902a3u912u3u4 \|\| busybox pkill -9 1902a3u912u3u4"
Source: /tmp/yakuza.i586.elf (PID: 5760)	Shell command executed: sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"
Source: /tmp/yakuza.i586.elf (PID: 5763)	Shell command executed: sh -c "pkill -9 haetrghbr \|\| busybox pkill -9 haetrghbr"

Source: /bin/sh (PID: 5498)	Pkill executable: /usr/bin/pkill -> pkill -9 902i13	Jump to behavior
Source: /bin/sh (PID: 5518)	Pkill executable: /usr/bin/pkill -> pkill -9 BzSxLxBxeY	Jump to behavior
Source: /bin/sh (PID: 5523)	Pkill executable: /usr/bin/pkill -> pkill -9 HOHO-LUGO7	Jump to behavior
Source: /bin/sh (PID: 5526)	Pkill executable: /usr/bin/pkill -> pkill -9 HOHO-U79OL	Jump to behavior
Source: /bin/sh (PID: 5531)	Pkill executable: /usr/bin/pkill -> pkill -9 JuYfouyf87	Jump to behavior
Source: /bin/sh (PID: 5540)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeR69xd	Jump to behavior
Source: /bin/sh (PID: 5545)	Pkill executable: /usr/bin/pkill -> pkill -9 SO190Ij1X	Jump to behavior
Source: /bin/sh (PID: 5548)	Pkill executable: /usr/bin/pkill -> pkill -9 LOLKIKEEEDDE	Jump to behavior
Source: /bin/sh (PID: 5554)	Pkill executable: /usr/bin/pkill -> pkill -9 ekjheory98e	Jump to behavior
Source: /bin/sh (PID: 5575)	Pkill executable: /usr/bin/pkill -> pkill -9 scansh4	Jump to behavior
Source: /bin/sh (PID: 5578)	Pkill executable: /usr/bin/pkill -> pkill -9 MDMA	Jump to behavior
Source: /bin/sh (PID: 5583)	Pkill executable: /usr/bin/pkill -> pkill -9 fdevalvex	Jump to behavior
Source: /bin/sh (PID: 5586)	Pkill executable: /usr/bin/pkill -> pkill -9 scanspc	Jump to behavior
Source: /bin/sh (PID: 5591)	Pkill executable: /usr/bin/pkill -> pkill -9 MELTEDNINJAREALZ	Jump to behavior
Source: /bin/sh (PID: 5594)	Pkill executable: /usr/bin/pkill -> pkill -9 flexsonskids	Jump to behavior
Source: /bin/sh (PID: 5599)	Pkill executable: /usr/bin/pkill -> pkill -9 scanx86
Source: /bin/sh (PID: 5602)	Pkill executable: /usr/bin/pkill -> pkill -9 MISAKI-U79OL
Source: /bin/sh (PID: 5607)	Pkill executable: /usr/bin/pkill -> pkill -9 foAxi102kxe
Source: /bin/sh (PID: 5610)	Pkill executable: /usr/bin/pkill -> pkill -9 swodjwodjwoj
Source: /bin/sh (PID: 5613)	Pkill executable: /usr/bin/pkill -> pkill -9 MmKiy7f87l
Source: /bin/sh (PID: 5618)	Pkill executable: /usr/bin/pkill -> pkill -9 freecookiex86
Source: /bin/sh (PID: 5621)	Pkill executable: /usr/bin/pkill -> pkill -9 sysgpu
Source: /bin/sh (PID: 5627)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeR69xd
Source: /bin/sh (PID: 5632)	Pkill executable: /usr/bin/pkill -> pkill -9 frgege
Source: /bin/sh (PID: 5637)	Pkill executable: /usr/bin/pkill -> pkill -9 sysupdater
Source: /bin/sh (PID: 5640)	Pkill executable: /usr/bin/pkill -> pkill -9 0DnAzepd
Source: /bin/sh (PID: 5643)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeRD0nks69
Source: /bin/sh (PID: 5648)	Pkill executable: /usr/bin/pkill -> pkill -9 frgreu
Source: /bin/sh (PID: 5651)	Pkill executable: /usr/bin/pkill -> pkill -9 telnetd
Source: /bin/sh (PID: 5656)	Pkill executable: /usr/bin/pkill -> pkill -9 0x766f6964
Source: /bin/sh (PID: 5659)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeRd0nks1337
Source: /bin/sh (PID: 5664)	Pkill executable: /usr/bin/pkill -> pkill -9 gaft
Source: /bin/sh (PID: 5667)	Pkill executable: /usr/bin/pkill -> pkill -9 urasgbsigboa
Source: /bin/sh (PID: 5670)	Pkill executable: /usr/bin/pkill -> pkill -9 120i3UI49
Source: /bin/sh (PID: 5675)	Pkill executable: /usr/bin/pkill -> pkill -9 OaF3
Source: /bin/sh (PID: 5678)	Pkill executable: /usr/bin/pkill -> pkill -9 geae
Source: /bin/sh (PID: 5684)	Pkill executable: /usr/bin/pkill -> pkill -9 vaiolmao
Source: /bin/sh (PID: 5687)	Pkill executable: /usr/bin/pkill -> pkill -9 123123a
Source: /bin/sh (PID: 5692)	Pkill executable: /usr/bin/pkill -> pkill -9 Ofurain0n4H34D
Source: /bin/sh (PID: 5695)	Pkill executable: /usr/bin/pkill -> pkill -9 ggTrex
Source: /bin/sh (PID: 5698)	Pkill executable: /usr/bin/pkill -> pkill -9 wasads
Source: /bin/sh (PID: 5703)	Pkill executable: /usr/bin/pkill -> pkill -9 1293194hjXD
Source: /bin/sh (PID: 5706)	Pkill executable: /usr/bin/pkill -> pkill -9 OthLaLosn
Source: /bin/sh (PID: 5711)	Pkill executable: /usr/bin/pkill -> pkill -9 ggt
Source: /bin/sh (PID: 5714)	Pkill executable: /usr/bin/pkill -> pkill -9 wget-log
Source: /bin/sh (PID: 5719)	Pkill executable: /usr/bin/pkill -> pkill -9 1337SoraLOADER
Source: /bin/sh (PID: 5722)	Pkill executable: /usr/bin/pkill -> pkill -9 SAIAKINA
Source: /bin/sh (PID: 5725)	Pkill executable: /usr/bin/pkill -> pkill -9 ggtq
Source: /bin/sh (PID: 5731)	Pkill executable: /usr/bin/pkill -> pkill -9 1378bfp919GRB1Q2
Source: /bin/sh (PID: 5734)	Pkill executable: /usr/bin/pkill -> pkill -9 SAIAKUSO
Source: /bin/sh (PID: 5740)	Pkill executable: /usr/bin/pkill -> pkill -9 ggtr
Source: /bin/sh (PID: 5745)	Pkill executable: /usr/bin/pkill -> pkill -9 14Fa
Source: /bin/sh (PID: 5750)	Pkill executable: /usr/bin/pkill -> pkill -9 SEXSLAVE1337
Source: /bin/sh (PID: 5753)	Pkill executable: /usr/bin/pkill -> pkill -9 ggtt
Source: /bin/sh (PID: 5756)	Pkill executable: /usr/bin/pkill -> pkill -9 1902a3u912u3u4
Source: /bin/sh (PID: 5761)	Pkill executable: /usr/bin/pkill -> pkill -9 SO190Ij1X
Source: /bin/sh (PID: 5764)	Pkill executable: /usr/bin/pkill -> pkill -9 haetrghbr

Source: /usr/bin/pkill (PID: 5498)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5518)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5523)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5526)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5531)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5545)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5548)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5554)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5575)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5578)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5583)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5586)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5591)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5594)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5599)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5602)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5607)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5610)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5613)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5618)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5621)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5627)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5632)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5637)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5640)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5643)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5648)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5651)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5656)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5659)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5664)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5667)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5670)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5675)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5678)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5684)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5687)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5692)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5695)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5698)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5703)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5706)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5711)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5714)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5719)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5722)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5725)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5731)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5734)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5740)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5745)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5750)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5753)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5756)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5761)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5764)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /usr/bin/busybox (PID: 5516)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5521)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5524)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5529)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5532)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5541)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5546)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5549)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5555)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5576)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5581)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5584)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5589)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5592)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5595)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5600)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5603)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5608)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5611)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5616)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5619)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5622)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5630)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5633)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5638)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5641)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5646)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5649)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5652)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5657)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5660)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5665)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5668)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5673)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5676)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5680)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5685)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5688)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5693)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5696)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5701)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5704)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5707)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5712)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5715)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5720)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5723)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5729)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5732)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5736)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5743)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5746)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5751)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5754)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5759)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5762)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5765)	Queries kernel information via 'uname':

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: yakuza.i586.elf, type: SAMPLE
Source: Yara match	File source: 5493.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5496.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U;) Presto/2.7.62 Version/11.01
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; U; de; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.62
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0) Gecko/20110517 Firefox/5.0 Fennec/5.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (compatible; Teleca Q7; Brew 3.1.5; U; en) 480X800 LGE VX11000

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: yakuza.i586.elf, type: SAMPLE
Source: Yara match	File source: 5493.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5496.1.0000000008048000.000000000805e000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	1 Brute Force	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
yakuza.i586.elf	61%	ReversingLabs	Linux.Trojan.Tsunami
yakuza.i586.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high
pirati.privatedns.org	79.12.214.240	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://youtu.be/dQw4w9WgXcQ	yakuza.i586.elf	false	high
http://linux-it.abuser.eu/yak.sh;	yakuza.i586.elf	false	high
https://youtu.be/dQw4w9WgXcQNever	yakuza.i586.elf	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.125.190.26	unknown	United Kingdom		41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.125.190.26	x86_64.elf	Get hash	malicious	Gafgyt	Browse
	45.200.149.186-boatnet.arc-2024-12-28T01_22_59.elf	Get hash	malicious	Mirai	Browse
	109.176.30.237-boatnet.mpsl-2024-12-27T20_20_43.elf	Get hash	malicious	Mirai	Browse
	drp.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	ppc.elf	Get hash	malicious	Mirai	Browse
	arm6.nn.elf	Get hash	malicious	Okiru	Browse
	RpcSecurity.arm7.elf	Get hash	malicious	Mirai	Browse
	RpcSecurity.ppc.elf	Get hash	malicious	Unknown	Browse
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse
	kitsune.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pirati.privatedns.org	yakuza.sh.elf	Get hash	malicious	Mirai	Browse	79.12.214.240
	yakuza.sparc.elf	Get hash	malicious	Mirai	Browse	79.12.214.240
	yakuza.arm4.elf	Get hash	malicious	Mirai	Browse	79.12.214.240
	yakuza.mipsel.elf	Get hash	malicious	Mirai	Browse	79.12.214.240
	yakuza.arm7.elf	Get hash	malicious	Mirai	Browse	212.171.15.94
	yakuza.i686.elf	Get hash	malicious	Mirai	Browse	212.171.15.94
	yakuza.ppc.elf	Get hash	malicious	Mirai	Browse	212.171.15.94
daisy.ubuntu.com	yakuza.i686.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	arm6.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	45.200.149.186-boatnet.arm-2024-12-28T01_23_00.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	byte.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.24
	109.176.30.237-boatnet.mpsl-2024-12-27T20_20_43.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	byte.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	byte.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	byte.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	llklllklld.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	arm6.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	arm4.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	yakuza.sh.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	yakuza.sparc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	yakuza.arm4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	yakuza.mipsel.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	yakuza.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	yakuza.ppc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	most-mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	most-mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.475890035569833
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	yakuza.i586.elf
File size:	122'651 bytes
MD5:	03a4bba7037ad3891c404b3715863ed1
SHA1:	12781c0e39e8e4d5b446c0899c7aa4b3d931a8ac
SHA256:	868940d7321ebd2f2aa237f09bc5a67dba8740698d800ed6dffc4c81310419da
SHA512:	beb992650b464b31ce9dddafc5c58f32af20e6442e3dd902d253f3b17bde5fcc00eb2d911ce94fbbd8b5e7d9463f45d9d533ccb0d6ba9729dc356bb6665bc420
SSDEEP:	3072:JN+UjGru5fb5BCVIVBEXNII7YLueR9uc2v69ny6JP/KTiFi:JN+mXfyEqKI7YBjudv69ny6JHKTiFi
TLSH:	A2C33AC3E780D7B3D1830AB603A79B1502B1E9371A1BCE95F35C3CB49A19585F6266BC
File Content Preview:	.ELF....................d...4....{......4. ...(......................Y...Y...............`..........`...............Q.td............................U..S.......w_...h....S...[]...$.............U......=`....t..5....$......$.......u........t....h............

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	97052
Section Header Size:	40
Number of Section Headers:	16
Header String Table Index:	13

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x80480b0	0xb0	0x10378	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x8058428	0x10428	0x17	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x8058440	0x10440	0x5552	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x805d994	0x15994	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x805e000	0x16000	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x805e008	0x16008	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x805e010	0x16010	0x4	0x0	0x3	WA	0	0	4
.got.plt	PROGBITS	0x805e014	0x16014	0xc	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x805e020	0x16020	0xd40	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x805ed60	0x16d60	0x7ba8	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0x16d60	0xd4a	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x17aaa	0x6f	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x17d9c	0x3840	0x10	0x0		15	296	4
.strtab	STRTAB	0x0	0x1b5dc	0x293f	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x15998	0x15998	6.6740	0x5	R E	0x1000	.init .text .fini .rodata .eh_frame
LOAD	0x16000	0x805e000	0x805e000	0xd60	0x8908	4.7662	0x6	RW	0x1000	.ctors .dtors .jcr .got.plt .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x8048094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80480b0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x8058428	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x8058440	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x805d994	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x805e000	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x805e008	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x805e010	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x805e014	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x805e020	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x805ed60	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
C.73.5600	.symtab	0x805a0c0	36	OBJECT	<unknown>	DEFAULT	4
C.91.5818	.symtab	0x805a6e0	312	OBJECT	<unknown>	DEFAULT	4
ClearHistory	.symtab	0x804d2ec	56	FUNC	<unknown>	DEFAULT	2
HTTP	.symtab	0x8049ea4	263	FUNC	<unknown>	DEFAULT	2
Q	.symtab	0x805f1c0	16384	OBJECT	<unknown>	DEFAULT	11
Send	.symtab	0x804832d	87	FUNC	<unknown>	DEFAULT	2
UserAgents	.symtab	0x805e380	144	OBJECT	<unknown>	DEFAULT	10
_352	.symtab	0x804e6f9	5	FUNC	<unknown>	DEFAULT	2
_376	.symtab	0x804e66d	110	FUNC	<unknown>	DEFAULT	2
_433	.symtab	0x804e6fe	57	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x805e014	0	OBJECT	<unknown>	HIDDEN	9
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_NICK	.symtab	0x804e737	170	FUNC	<unknown>	DEFAULT	2
_PING	.symtab	0x804e6db	30	FUNC	<unknown>	DEFAULT	2
_PRIVMSG	.symtab	0x804dc40	2605	FUNC	<unknown>	DEFAULT	2
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x805e004	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x805e000	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x805ed1c	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x805d240	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x805ed24	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x805d540	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x805eac0	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x805bfa0	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x805e00c	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x805e008	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x805d994	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x805d994	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x805ed1c	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_b_data	.symtab	0x805d240	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x805ed24	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_tolower_data	.symtab	0x805d540	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x805eac0	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_toupper_data	.symtab	0x805bfa0	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x805ed20	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_tolower	.symtab	0x805ed28	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_toupper	.symtab	0x805eac4	4	OBJECT	<unknown>	HIDDEN	10
__GI___errno_location	.symtab	0x804f7d8	6	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x8055df4	220	FUNC	<unknown>	HIDDEN	2
__GI___fputc_unlocked	.symtab	0x8051230	197	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x805147c	29	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x805538c	6	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x804f354	87	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x804f3ac	63	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x80551f4	75	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x8054be8	63	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x8054c5f	64	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x805149c	183	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x8054fe4	40	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x80540e0	273	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x8053030	43	FUNC	<unknown>	HIDDEN	2
__GI_asprintf	.symtab	0x804f9f0	30	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x80546ac	20	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x80546ac	20	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x805305c	43	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x8057870	54	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x804f3ec	46	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x805500c	50	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x804f41c	46	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x8053088	43	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x8055040	50	FUNC	<unknown>	HIDDEN	2
__GI_endservent	.symtab	0x80562bc	92	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x8065234	4	OBJECT	<unknown>	HIDDEN	11
__GI_execl	.symtab	0x8054878	105	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x8055074	54	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x8054810	103	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x804f7e0	265	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x804f354	87	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x804f3ac	63	FUNC	<unknown>	HIDDEN	2
__GI_fdopen	.symtab	0x8055480	50	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x8051080	321	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x8055df4	220	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x8050e44	98	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x80511c4	105	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x804f8ec	24	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x804f44c	38	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x804f9d0	30	FUNC	<unknown>	HIDDEN	2
__GI_fputc	.symtab	0x8050ea8	146	FUNC	<unknown>	HIDDEN	2
__GI_fputs	.symtab	0x8050f3c	95	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x80512f8	51	FUNC	<unknown>	HIDDEN	2
__GI_freeaddrinfo	.symtab	0x8052126	35	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x80578c0	27	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x805793c	227	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x805132c	116	FUNC	<unknown>	HIDDEN	2
__GI_getaddrinfo	.symtab	0x8052149	652	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x8055df4	220	FUNC	<unknown>	HIDDEN	2
__GI_getcwd	.symtab	0x804f474	185	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x804f530	37	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x80550ac	38	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x80550d4	38	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x80550fc	38	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyaddr_r	.symtab	0x8052cbc	884	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x805298c	815	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x80573d4	818	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x804f558	19	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x804f56c	38	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x804f5bc	50	FUNC	<unknown>	HIDDEN	2
__GI_getservbyname_r	.symtab	0x805646e	224	FUNC	<unknown>	HIDDEN	2
__GI_getservbyport	.symtab	0x805643a	52	FUNC	<unknown>	HIDDEN	2
__GI_getservbyport_r	.symtab	0x805638b	175	FUNC	<unknown>	HIDDEN	2
__GI_getservent_r	.symtab	0x80560c2	464	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x8055124	38	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x8065238	4	OBJECT	<unknown>	HIDDEN	11
__GI_if_freenameindex	.symtab	0x805680a	52	FUNC	<unknown>	HIDDEN	2
__GI_if_nameindex	.symtab	0x8056670	410	FUNC	<unknown>	HIDDEN	2
__GI_if_nametoindex	.symtab	0x80565fb	117	FUNC	<unknown>	HIDDEN	2
__GI_in6addr_loopback	.symtab	0x805cf58	16	OBJECT	<unknown>	HIDDEN	4
__GI_inet_addr	.symtab	0x8052964	37	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x8056840	148	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x805294f	21	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x8052900	79	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x8052730	462	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x805245e	458	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x80544ca	171	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x804f5f0	63	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x805164c	29	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x804f630	50	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x80530f0	35	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x8058290	95	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x8055ed0	35	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x80513a0	39	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x8055ef4	39	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x8055f3c	33	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x8055f60	176	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x80513c8	21	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x8054f58	27	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x805514c	63	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x805518c	50	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x80551c0	50	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x80551f4	75	FUNC	<unknown>	HIDDEN	2
__GI_perror	.symtab	0x804f904	50	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x8055258	46	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x804f664	54	FUNC	<unknown>	HIDDEN	2
__GI_putc	.symtab	0x8050ea8	146	FUNC	<unknown>	HIDDEN	2
__GI_putc_unlocked	.symtab	0x8051230	197	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x8057730	24	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x80541fc	72	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x80543d5	95	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x8057c20	99	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x80582f0	54	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x8053114	51	FUNC	<unknown>	HIDDEN	2
__GI_rewind	.symtab	0x80578dc	94	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x8055288	78	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x804f69c	63	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x8053148	51	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x805317c	67	FUNC	<unknown>	HIDDEN	2
__GI_setservent	.symtab	0x8056318	115	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x804f6dc	38	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x80531c0	59	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x805433c	153	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x8054e67	217	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x8057748	175	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x80552d8	85	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x80548e4	393	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x80531fc	43	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x804fa10	31	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x8054434	150	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x805156c	54	FUNC	<unknown>	HIDDEN	2
__GI_strcasestr	.symtab	0x80515a4	83	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x8055f1c	30	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x8057bd0	29	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x8057bd0	29	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x80513e0	27	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x80515f8	54	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x80513fc	19	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x8057bf0	46	FUNC	<unknown>	HIDDEN	2
__GI_strncmp	.symtab	0x8051410	37	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x8051438	38	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x8051460	25	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x805606c	39	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x8057c84	50	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x8051630	25	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x8056010	89	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x80546c0	26	FUNC	<unknown>	HIDDEN	2
__GI_strtoul	.symtab	0x80546dc	26	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x8054a70	325	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x805166c	112	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x804f704	46	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x805536c	29	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x804f7b8	29	FUNC	<unknown>	HIDDEN	2
__GI_vasprintf	.symtab	0x804fa30	115	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x8054f40	21	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x805016c	136	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x804faa4	178	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x8055330	59	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x804f764	26	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x8055394	68	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x80553f8	134	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x80553d8	30	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x804f780	54	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x805e010	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x805e010	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x8065228	4	OBJECT	<unknown>	HIDDEN	11
__atexit_lock	.symtab	0x805ed00	24	OBJECT	<unknown>	DEFAULT	10
__bsd_signal	.symtab	0x8057748	175	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x805ed60	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x8054c2b	52	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x805ed20	4	OBJECT	<unknown>	DEFAULT	10
__ctype_tolower	.symtab	0x805ed28	4	OBJECT	<unknown>	DEFAULT	10
__ctype_toupper	.symtab	0x805eac4	4	OBJECT	<unknown>	DEFAULT	10
__curbrk	.symtab	0x8065274	4	OBJECT	<unknown>	HIDDEN	11
__data_start	.symtab	0x805e028	0	NOTYPE	<unknown>	DEFAULT	10
__decode_answer	.symtab	0x8057e8c	249	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x80568d4	215	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x8057d6c	171	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x80569ac	1876	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x8058400	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x80480c0	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x805e020	0	OBJECT	<unknown>	HIDDEN	10
__encode_dotted	.symtab	0x8058328	144	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x8057cb8	177	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x8057e18	83	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x8065220	4	OBJECT	<unknown>	DEFAULT	11
__errno_location	.symtab	0x804f7d8	6	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x8065218	4	OBJECT	<unknown>	HIDDEN	11
__fgetc_unlocked	.symtab	0x8055df4	220	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x805e000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x805e000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fputc_unlocked	.symtab	0x8051230	197	FUNC	<unknown>	DEFAULT	2
__get_hosts_byaddr_r	.symtab	0x8057370	97	FUNC	<unknown>	HIDDEN	2
__get_hosts_byname_r	.symtab	0x8057344	44	FUNC	<unknown>	HIDDEN	2
__get_pc_thunk_bx	.symtab	0x80480b0	0	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x804f558	19	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x805147c	29	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x805538c	6	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x805e000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x805e000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__initbuf	.symtab	0x8056094	46	FUNC	<unknown>	DEFAULT	2
__length_dotted	.symtab	0x80583b8	65	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x8057e6c	30	FUNC	<unknown>	HIDDEN	2
__libc_accept	.symtab	0x8053030	43	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x804f41c	46	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x8053088	43	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x805523f	25	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x804f354	87	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x804f3ac	63	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x804f44c	38	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x804f56c	38	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x8058290	95	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x80551c0	50	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x80551f4	75	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x804f664	54	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x80582f0	54	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x8053114	51	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x804f69c	63	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x8053148	51	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x805317c	67	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x8054e67	217	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x806521c	4	OBJECT	<unknown>	DEFAULT	11
__libc_system	.symtab	0x8054578	305	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x804f764	26	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x804f780	54	FUNC	<unknown>	DEFAULT	2
__malloc_consolidate	.symtab	0x8053d79	424	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x8053228	38	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x805ec10	24	OBJECT	<unknown>	DEFAULT	10
__malloc_state	.symtab	0x80664e0	888	OBJECT	<unknown>	DEFAULT	11
__malloc_trim	.symtab	0x8053cec	141	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x8066868	12	OBJECT	<unknown>	HIDDEN	11
__nameservers	.symtab	0x8066874	4	OBJECT	<unknown>	HIDDEN	11
__open_etc_hosts	.symtab	0x8057f88	49	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x8057100	579	FUNC	<unknown>	HIDDEN	2
__opensock	.symtab	0x8057708	40	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x8065224	4	OBJECT	<unknown>	DEFAULT	11
__preinit_array_end	.symtab	0x805e000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x805e000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x8054c27	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x8054c27	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x8054c27	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x8054c27	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x8054c27	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x8054c2a	1	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x8057730	24	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x8057fb9	724	FUNC	<unknown>	HIDDEN	2
__register_frame_info_bases	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x805ed48	24	OBJECT	<unknown>	DEFAULT	10
__restore	.symtab	0x8054e5f	0	NOTYPE	<unknown>	DEFAULT	2
__restore_rt	.symtab	0x8054e58	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x806522c	4	OBJECT	<unknown>	HIDDEN	11
__searchdomain	.symtab	0x8066858	16	OBJECT	<unknown>	HIDDEN	11
__searchdomains	.symtab	0x8066878	4	OBJECT	<unknown>	HIDDEN	11
__sigaddset	.symtab	0x805781c	32	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x805783c	32	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x80577f8	36	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x8054f74	50	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x805ead4	4	OBJECT	<unknown>	DEFAULT	10
__stdio_READ	.symtab	0x8057a20	68	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x80554b4	126	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x8057a64	168	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x8055534	240	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x80500a1	23	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3991	.symtab	0x805c2b8	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x8057b0c	40	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x8057b9c	51	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x8057b34	101	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x8055624	158	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x8050140	43	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x805ead8	4	OBJECT	<unknown>	DEFAULT	10
__syscall_error	.symtab	0x80578a8	21	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x8054fa8	59	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x8054be8	63	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x8054c5f	64	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x8054c9f	441	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x805ed18	4	OBJECT	<unknown>	HIDDEN	10
__vfork	.symtab	0x8054f40	21	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x805149c	183	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x80501f4	54	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x805785c	18	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x8066900	4	OBJECT	<unknown>	DEFAULT	11
_dl_phnum	.symtab	0x8066904	4	OBJECT	<unknown>	DEFAULT	11
_edata	.symtab	0x805ed60	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x8066908	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x8065234	4	OBJECT	<unknown>	DEFAULT	11
_exit	.symtab	0x8054fe4	40	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x8058428	3	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x8063200	8192	OBJECT	<unknown>	DEFAULT	11
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x805022a	106	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x8055830	1476	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x8065238	4	OBJECT	<unknown>	DEFAULT	11
_init	.symtab	0x8048094	3	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x80556c4	86	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x805083c	111	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x8050a29	966	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x80508ac	66	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x80508f0	271	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x8050a00	41	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x8054c2a	1	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x8054c2a	1	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x8066880	128	OBJECT	<unknown>	HIDDEN	11
_start	.symtab	0x8048164	34	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x804fe10	559	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x8050040	97	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x805eadc	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_add_lock	.symtab	0x805eae0	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_dec_use	.symtab	0x8050f9c	228	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x80631e0	4	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_del_lock	.symtab	0x805eaf8	24	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_use_count	.symtab	0x80631dc	4	OBJECT	<unknown>	DEFAULT	11
_stdio_streams	.symtab	0x805eb20	240	OBJECT	<unknown>	DEFAULT	10
_stdio_term	.symtab	0x80500b8	136	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x805eb10	4	OBJECT	<unknown>	DEFAULT	10
_stdlib_strto_l	.symtab	0x80546f8	277	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x805571c	61	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x805c380	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x805575c	209	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x8050294	1448	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x80540e0	273	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
accept	.symtab	0x8053030	43	FUNC	<unknown>	DEFAULT	2
accept.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
actualparent	.symtab	0x8065394	4	OBJECT	<unknown>	DEFAULT	11
advance_telstate	.symtab	0x804bc70	80	FUNC	<unknown>	DEFAULT	2
advances	.symtab	0x805e8d0	28	OBJECT	<unknown>	DEFAULT	10
advances2	.symtab	0x805e960	44	OBJECT	<unknown>	DEFAULT	10
ak47scan	.symtab	0x804d019	185	FUNC	<unknown>	DEFAULT	2
ak47scantoggle	.symtab	0x804d0d2	421	FUNC	<unknown>	DEFAULT	2
ak47telscan	.symtab	0x804bd0e	4875	FUNC	<unknown>	DEFAULT	2
append	.symtab	0x804d8e9	41	FUNC	<unknown>	DEFAULT	2
asprintf	.symtab	0x804f9f0	30	FUNC	<unknown>	DEFAULT	2
asprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x80546ac	20	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x80546ac	20	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x8051554	21	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x8065214	1	OBJECT	<unknown>	DEFAULT	11
been_there_done_that.2832	.symtab	0x8065230	1	OBJECT	<unknown>	DEFAULT	11
bind	.symtab	0x805305c	43	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
blacknurse	.symtab	0x80492ff	576	FUNC	<unknown>	DEFAULT	2
botkill	.symtab	0x804d277	117	FUNC	<unknown>	DEFAULT	2
brk	.symtab	0x8057870	54	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x8057748	175	FUNC	<unknown>	DEFAULT	2
buf.2658	.symtab	0x8065204	16	OBJECT	<unknown>	DEFAULT	11
c	.symtab	0x805e99c	4	OBJECT	<unknown>	DEFAULT	10
capsaicin2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chan	.symtab	0x80664d0	4	OBJECT	<unknown>	DEFAULT	11
changeservers	.symtab	0x805ed84	4	OBJECT	<unknown>	DEFAULT	11
chdir	.symtab	0x804f3ec	46	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x805500c	50	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x804f41c	46	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.2429	.symtab	0x805ed60	1	OBJECT	<unknown>	DEFAULT	11
con	.symtab	0x804e7e1	631	FUNC	<unknown>	DEFAULT	2
connect	.symtab	0x8053088	43	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
contains_fail	.symtab	0x804badd	27	FUNC	<unknown>	DEFAULT	2
contains_response	.symtab	0x804baf8	63	FUNC	<unknown>	DEFAULT	2
contains_string	.symtab	0x804ba4e	116	FUNC	<unknown>	DEFAULT	2
contains_success	.symtab	0x804bac2	27	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x805523f	25	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x8048192	113	FUNC	<unknown>	DEFAULT	2
data_start	.symtab	0x805e028	0	NOTYPE	<unknown>	DEFAULT	10
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
disable	.symtab	0x8048f79	264	FUNC	<unknown>	DEFAULT	2
disabled	.symtab	0x805ed88	1	OBJECT	<unknown>	DEFAULT	11
dispass	.symtab	0x8065280	256	OBJECT	<unknown>	DEFAULT	11
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dns	.symtab	0x804af79	602	FUNC	<unknown>	DEFAULT	2
dns_format	.symtab	0x804a8b2	167	FUNC	<unknown>	DEFAULT	2
dns_hdr_create	.symtab	0x804a959	112	FUNC	<unknown>	DEFAULT	2
dns_send	.symtab	0x804a9c9	1021	FUNC	<unknown>	DEFAULT	2
dnsflood	.symtab	0x804adc6	435	FUNC	<unknown>	DEFAULT	2
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
download	.symtab	0x804891e	1055	FUNC	<unknown>	DEFAULT	2
dup2	.symtab	0x8055040	50	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
enable	.symtab	0x8049081	200	FUNC	<unknown>	DEFAULT	2
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
endservent	.symtab	0x80562bc	92	FUNC	<unknown>	DEFAULT	2
environ	.symtab	0x8065220	4	OBJECT	<unknown>	DEFAULT	11
errno	.symtab	0x8065234	4	OBJECT	<unknown>	DEFAULT	11
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execfile	.symtab	0x80653a0	256	OBJECT	<unknown>	DEFAULT	11
execl	.symtab	0x8054878	105	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x8055074	54	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x8054810	103	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x805d880	156	OBJECT	<unknown>	DEFAULT	4
fails	.symtab	0x805e900	36	OBJECT	<unknown>	DEFAULT	10
fastflux	.symtab	0x804da7e	450	FUNC	<unknown>	DEFAULT	2
fclose	.symtab	0x804f7e0	265	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x804f354	87	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x804f3ac	63	FUNC	<unknown>	DEFAULT	2
fdopen	.symtab	0x8055480	50	FUNC	<unknown>	DEFAULT	2
fdopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
feof	.symtab	0x8050df0	83	FUNC	<unknown>	DEFAULT	2
feof.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fflush_unlocked	.symtab	0x8051080	321	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x8055df4	220	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x8050e44	98	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x80511c4	105	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
filter	.symtab	0x8048463	114	FUNC	<unknown>	DEFAULT	2
flooders	.symtab	0x805e9c0	176	OBJECT	<unknown>	DEFAULT	10
fmt	.symtab	0x805d850	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x804f8ec	24	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x804f44c	38	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fprintf	.symtab	0x804f9d0	30	FUNC	<unknown>	DEFAULT	2
fprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputc	.symtab	0x8050ea8	146	FUNC	<unknown>	DEFAULT	2
fputc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputc_unlocked	.symtab	0x8051230	197	FUNC	<unknown>	DEFAULT	2
fputc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs	.symtab	0x8050f3c	95	FUNC	<unknown>	DEFAULT	2
fputs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x80512f8	51	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x8048110	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x8053f21	412	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
freeaddrinfo	.symtab	0x8052126	35	FUNC	<unknown>	DEFAULT	2
fseek	.symtab	0x80578c0	27	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x80578c0	27	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x805793c	227	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x805132c	116	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gaih	.symtab	0x805cedc	24	OBJECT	<unknown>	DEFAULT	4
gaih_inet	.symtab	0x8051797	2447	FUNC	<unknown>	DEFAULT	2
gaih_inet_serv	.symtab	0x8051704	147	FUNC	<unknown>	DEFAULT	2
gaih_inet_typeproto	.symtab	0x805cf00	35	OBJECT	<unknown>	DEFAULT	4
get	.symtab	0x8048d3d	241	FUNC	<unknown>	DEFAULT	2
getBuild	.symtab	0x8048188	10	FUNC	<unknown>	DEFAULT	2
getDatIP	.symtab	0x804b675	734	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x8049c44	59	FUNC	<unknown>	DEFAULT	2
getPublicIP	.symtab	0x804d9b5	123	FUNC	<unknown>	DEFAULT	2
get_hosts_byaddr_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_telstate_host	.symtab	0x804bc51	31	FUNC	<unknown>	DEFAULT	2
getaddrinfo	.symtab	0x8052149	652	FUNC	<unknown>	DEFAULT	2
getaddrinfo.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x8055df4	220	FUNC	<unknown>	DEFAULT	2
getcwd	.symtab	0x804f474	185	FUNC	<unknown>	DEFAULT	2
getcwd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x804f530	37	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x80550ac	38	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x80550d4	38	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x80550fc	38	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyaddr_r	.symtab	0x8052cbc	884	FUNC	<unknown>	DEFAULT	2
gethostbyaddr_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x805298c	815	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x80573d4	818	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getmyip	.symtab	0x804da30	78	FUNC	<unknown>	DEFAULT	2
getpagesize	.symtab	0x804f558	19	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x804f56c	38	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x804f594	38	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x804f5bc	50	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getservbyname	.symtab	0x805654e	52	FUNC	<unknown>	DEFAULT	2
getservbyname_r	.symtab	0x805646e	224	FUNC	<unknown>	DEFAULT	2
getservbyport	.symtab	0x805643a	52	FUNC	<unknown>	DEFAULT	2
getservbyport_r	.symtab	0x805638b	175	FUNC	<unknown>	DEFAULT	2
getservent	.symtab	0x8056292	42	FUNC	<unknown>	DEFAULT	2
getservent_r	.symtab	0x80560c2	464	FUNC	<unknown>	DEFAULT	2
getservice.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x80530b4	59	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x8055124	38	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x8065238	4	OBJECT	<unknown>	DEFAULT	11
head	.symtab	0x80664c0	4	OBJECT	<unknown>	DEFAULT	11
help	.symtab	0x804d383	1090	FUNC	<unknown>	DEFAULT	2
histClear	.symtab	0x804d992	35	FUNC	<unknown>	DEFAULT	2
hold	.symtab	0x804a7f4	190	FUNC	<unknown>	DEFAULT	2
host2ip	.symtab	0x8049149	135	FUNC	<unknown>	DEFAULT	2
htonl	.symtab	0x80516e8	7	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x80516dc	12	FUNC	<unknown>	DEFAULT	2
i.5507	.symtab	0x805f1a0	4	OBJECT	<unknown>	DEFAULT	11
i.5549	.symtab	0x805e9a0	4	OBJECT	<unknown>	DEFAULT	10
ident	.symtab	0x8065384	4	OBJECT	<unknown>	DEFAULT	11
identd	.symtab	0x8048575	578	FUNC	<unknown>	DEFAULT	2
if_freenameindex	.symtab	0x805680a	52	FUNC	<unknown>	DEFAULT	2
if_index.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
if_indextoname	.symtab	0x8056584	119	FUNC	<unknown>	DEFAULT	2
if_nameindex	.symtab	0x8056670	410	FUNC	<unknown>	DEFAULT	2
if_nametoindex	.symtab	0x80565fb	117	FUNC	<unknown>	DEFAULT	2
in6_addr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
in6addr_any	.symtab	0x805cf48	16	OBJECT	<unknown>	DEFAULT	4
in6addr_loopback	.symtab	0x805cf58	16	OBJECT	<unknown>	DEFAULT	4
in_cksum	.symtab	0x80487fb	133	FUNC	<unknown>	DEFAULT	2
index	.symtab	0x8055f1c	30	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x8052964	37	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x8056840	148	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x805294f	21	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x8052900	79	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x8052730	462	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x8052628	264	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x805245e	458	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x80523d8	134	FUNC	<unknown>	DEFAULT	2
infected	.symtab	0x805e994	8	OBJECT	<unknown>	DEFAULT	10
init_rand	.symtab	0x80491d0	111	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x80542a1	87	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x80544ca	171	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x804f5f0	63	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x805164c	29	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ismaster	.symtab	0x804d912	128	FUNC	<unknown>	DEFAULT	2
junk	.symtab	0x804a372	190	FUNC	<unknown>	DEFAULT	2
key	.symtab	0x80664c8	4	OBJECT	<unknown>	DEFAULT	11
kill	.symtab	0x804f630	50	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killall	.symtab	0x804d7c5	189	FUNC	<unknown>	DEFAULT	2
killd	.symtab	0x804d882	103	FUNC	<unknown>	DEFAULT	2
knownBots	.symtab	0x805e060	776	OBJECT	<unknown>	DEFAULT	10
legit	.symtab	0x805e98c	8	OBJECT	<unknown>	DEFAULT	10
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/mmap.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/i386/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
limiter	.symtab	0x8065388	4	OBJECT	<unknown>	DEFAULT	11
listFork	.symtab	0x80498b7	177	FUNC	<unknown>	DEFAULT	2
listen	.symtab	0x80530f0	35	FUNC	<unknown>	DEFAULT	2
listen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x8058290	95	FUNC	<unknown>	DEFAULT	2
main	.symtab	0x804eb0d	2117	FUNC	<unknown>	DEFAULT	2
makeFukdString	.symtab	0x804ea58	100	FUNC	<unknown>	DEFAULT	2
makeRandomShit	.symtab	0x804953f	98	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x805324e	1908	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x80540bd	34	FUNC	<unknown>	DEFAULT	2
masters	.symtab	0x805e050	12	OBJECT	<unknown>	DEFAULT	10
memchr	.symtab	0x8055ed0	35	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x80513a0	39	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x8055ef4	39	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x8055f3c	33	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x8055f60	176	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x80513c8	21	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mfork	.symtab	0x8048384	223	FUNC	<unknown>	DEFAULT	2
mmap	.symtab	0x8054f58	27	FUNC	<unknown>	DEFAULT	2
move	.symtab	0x804d324	95	FUNC	<unknown>	DEFAULT	2
mremap	.symtab	0x805514c	63	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
msgs	.symtab	0x805ea80	64	OBJECT	<unknown>	DEFAULT	10
munmap	.symtab	0x805518c	50	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mygethostbyname	.symtab	0x8048880	158	FUNC	<unknown>	DEFAULT	2
mylock	.symtab	0x80631c0	24	OBJECT	<unknown>	DEFAULT	11
mylock	.symtab	0x805ec28	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x805ec40	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x805ed2c	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x8065258	24	OBJECT	<unknown>	DEFAULT	11
nanosleep	.symtab	0x80551c0	50	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
negotiate	.symtab	0x804b953	251	FUNC	<unknown>	DEFAULT	2
next_start.1109	.symtab	0x8065200	4	OBJECT	<unknown>	DEFAULT	11
nick	.symtab	0x806538c	4	OBJECT	<unknown>	DEFAULT	11
nickc	.symtab	0x8048e4c	141	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x80516fb	7	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x80516ef	12	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
nummasters	.symtab	0x805e04c	4	OBJECT	<unknown>	DEFAULT	10
numpids	.symtab	0x805ed94	4	OBJECT	<unknown>	DEFAULT	11
numservers	.symtab	0x805e040	4	OBJECT	<unknown>	DEFAULT	10
object.2482	.symtab	0x805ed64	24	OBJECT	<unknown>	DEFAULT	11
open	.symtab	0x80551f4	75	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opensock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
p.2427	.symtab	0x805e024	0	OBJECT	<unknown>	DEFAULT	10
passwords	.symtab	0x805e680	592	OBJECT	<unknown>	DEFAULT	10
pclose	.symtab	0x804fb58	190	FUNC	<unknown>	DEFAULT	2
perror	.symtab	0x804f904	50	FUNC	<unknown>	DEFAULT	2
perror.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pid	.symtab	0x8065380	4	OBJECT	<unknown>	DEFAULT	11
pids	.symtab	0x80664d4	4	OBJECT	<unknown>	DEFAULT	11
pipe	.symtab	0x8055258	46	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
poll	.symtab	0x804f664	54	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
popen	.symtab	0x804fc16	506	FUNC	<unknown>	DEFAULT	2
popen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
popen_list	.symtab	0x80631d8	4	OBJECT	<unknown>	DEFAULT	11
poww	.symtab	0x80487b7	68	FUNC	<unknown>	DEFAULT	2
pps	.symtab	0x80654a0	4	OBJECT	<unknown>	DEFAULT	11
prefix.4202	.symtab	0x805c2dd	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x804b409	584	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x804b1d3	58	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x804b2e4	293	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x804b20d	215	FUNC	<unknown>	DEFAULT	2
putc	.symtab	0x8050ea8	146	FUNC	<unknown>	DEFAULT	2
putc_unlocked	.symtab	0x8051230	197	FUNC	<unknown>	DEFAULT	2
puts	.symtab	0x804f938	124	FUNC	<unknown>	DEFAULT	2
puts.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
qual_chars.4208	.symtab	0x805c2f0	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x8057730	24	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x80541f4	5	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x804923f	192	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x80541fc	72	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x805cfa0	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x80543d5	95	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randstring	.symtab	0x80484d5	160	FUNC	<unknown>	DEFAULT	2
randtbl	.symtab	0x805ec80	128	OBJECT	<unknown>	DEFAULT	10
rawmemchr	.symtab	0x8057c20	99	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x80582f0	54	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_until_response	.symtab	0x804bbda	119	FUNC	<unknown>	DEFAULT	2
read_with_timeout	.symtab	0x804bb37	163	FUNC	<unknown>	DEFAULT	2
realloc	.symtab	0x80539c4	808	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realrand	.symtab	0x8048ed9	79	FUNC	<unknown>	DEFAULT	2
recv	.symtab	0x8053114	51	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rekdevice	.symtab	0x805e05c	4	OBJECT	<unknown>	DEFAULT	10
reset_telstate	.symtab	0x804bcc0	31	FUNC	<unknown>	DEFAULT	2
rewind	.symtab	0x80578dc	94	FUNC	<unknown>	DEFAULT	2
rewind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rnd	.symtab	0x80664cc	4	OBJECT	<unknown>	DEFAULT	11
rndnick	.symtab	0x8048f28	81	FUNC	<unknown>	DEFAULT	2
rseed	.symtab	0x80654c0	4096	OBJECT	<unknown>	DEFAULT	11
rsi	.symtab	0x8065398	4	OBJECT	<unknown>	DEFAULT	11
sbrk	.symtab	0x8055288	78	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x805ed80	4	OBJECT	<unknown>	DEFAULT	11
sclose	.symtab	0x804bcdf	47	FUNC	<unknown>	DEFAULT	2
select	.symtab	0x804f69c	63	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x8053148	51	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendHOLD	.symtab	0x804a430	964	FUNC	<unknown>	DEFAULT	2
sendHTTP	.symtab	0x8049d36	366	FUNC	<unknown>	DEFAULT	2
sendJUNK	.symtab	0x8049fab	967	FUNC	<unknown>	DEFAULT	2
sendSTD	.symtab	0x8049968	732	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x805317c	67	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
serv	.symtab	0x8065244	16	OBJECT	<unknown>	DEFAULT	11
serv_stayopen	.symtab	0x8065254	1	OBJECT	<unknown>	DEFAULT	11
servbuf	.symtab	0x806523c	4	OBJECT	<unknown>	DEFAULT	11
server	.symtab	0x80654a4	4	OBJECT	<unknown>	DEFAULT	11
servers	.symtab	0x805e044	8	OBJECT	<unknown>	DEFAULT	10
servf	.symtab	0x8065240	4	OBJECT	<unknown>	DEFAULT	11
setservent	.symtab	0x8056318	115	FUNC	<unknown>	DEFAULT	2
setsid	.symtab	0x804f6dc	38	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x80531c0	59	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x8054244	93	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x805433c	153	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x8054e67	217	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x8057748	175	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x80552d8	85	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x80548e4	393	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleeptime	.symtab	0x805e9a4	4	OBJECT	<unknown>	DEFAULT	10
sock	.symtab	0x8065390	4	OBJECT	<unknown>	DEFAULT	11
socket	.symtab	0x80531fc	43	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x8049c7f	183	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4207	.symtab	0x805c304	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4201	.symtab	0x805c2e9	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4204	.symtab	0x805c32d	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4203	.symtab	0x805c342	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4206	.symtab	0x805c314	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4205	.symtab	0x805c324	9	OBJECT	<unknown>	DEFAULT	4
spoofs	.symtab	0x805ed8c	4	OBJECT	<unknown>	DEFAULT	11
spoofsm	.symtab	0x805ed90	4	OBJECT	<unknown>	DEFAULT	11
sprintf	.symtab	0x804fa10	31	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x80542f8	67	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x80542f8	67	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x8054434	150	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x805ed44	2	OBJECT	<unknown>	DEFAULT	10
static_ns	.symtab	0x8065270	4	OBJECT	<unknown>	DEFAULT	11
stderr	.symtab	0x805ead0	4	OBJECT	<unknown>	DEFAULT	10
stdin	.symtab	0x805eac8	4	OBJECT	<unknown>	DEFAULT	10
stdout	.symtab	0x805eacc	4	OBJECT	<unknown>	DEFAULT	10
strcasecmp	.symtab	0x805156c	54	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcasestr	.symtab	0x80515a4	83	FUNC	<unknown>	DEFAULT	2
strcasestr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x8055f1c	30	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x8057bd0	29	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x8057bd0	29	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x80513e0	27	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x80515f8	54	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x805149c	183	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x80513fc	19	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncat	.symtab	0x8057bf0	46	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncmp	.symtab	0x8051410	37	FUNC	<unknown>	DEFAULT	2
strncmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x8051438	38	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x8051460	25	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x805606c	39	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x8057c84	50	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x8051630	25	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x8056010	89	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x80546c0	26	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoul	.symtab	0x80546dc	26	FUNC	<unknown>	DEFAULT	2
strtoul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strwildmatch	.symtab	0x8048203	298	FUNC	<unknown>	DEFAULT	2
successes	.symtab	0x805e940	32	OBJECT	<unknown>	DEFAULT	10
sysconf	.symtab	0x8054a70	325	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
system	.symtab	0x8054578	305	FUNC	<unknown>	DEFAULT	2
system.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x804b651	36	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x805166c	112	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tehport	.symtab	0x80664c4	4	OBJECT	<unknown>	DEFAULT	11
textBuffer.5000	.symtab	0x805eda0	1024	OBJECT	<unknown>	DEFAULT	11
thanks	.symtab	0x805e9a8	4	OBJECT	<unknown>	DEFAULT	10
time	.symtab	0x804f704	46	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x805536c	29	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
touchMyself	.symtab	0x804eabc	81	FUNC	<unknown>	DEFAULT	2
toupper	.symtab	0x804f7b8	29	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
type_codes	.symtab	0x805c34a	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x805c362	12	OBJECT	<unknown>	DEFAULT	4
umask	.symtab	0x804f734	48	FUNC	<unknown>	DEFAULT	2
umask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown	.symtab	0x80495a1	790	FUNC	<unknown>	DEFAULT	2
unknown.1161	.symtab	0x805c36e	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x805ec58	28	OBJECT	<unknown>	DEFAULT	10
user	.symtab	0x806539c	4	OBJECT	<unknown>	DEFAULT	11
usernames	.symtab	0x805e420	592	OBJECT	<unknown>	DEFAULT	10
usleep	.symtab	0x8054bb8	48	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vasprintf	.symtab	0x804fa30	115	FUNC	<unknown>	DEFAULT	2
vasprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
version	.symtab	0x8048e2e	30	FUNC	<unknown>	DEFAULT	2
vfork	.symtab	0x8054f40	21	FUNC	<unknown>	DEFAULT	2
vfprintf	.symtab	0x805016c	136	FUNC	<unknown>	DEFAULT	2
vfprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vsnprintf	.symtab	0x804faa4	178	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vsprintf	.symtab	0x804f9b4	26	FUNC	<unknown>	DEFAULT	2
vsprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x8055330	59	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x804f764	26	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x8055394	68	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x80553f8	134	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x80553d8	30	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x804f780	54	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3116	.symtab	0x805cf37	17	OBJECT	<unknown>	DEFAULT	4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 14:42:01.442405939 CET	46540	443	192.168.2.14	185.125.190.26
Dec 28, 2024 14:42:32.673324108 CET	46540	443	192.168.2.14	185.125.190.26

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 14:41:50.267918110 CET	54622	53	192.168.2.14	1.1.1.1
Dec 28, 2024 14:41:50.823383093 CET	53	54622	1.1.1.1	192.168.2.14
Dec 28, 2024 14:41:51.978703022 CET	39396	53	192.168.2.14	1.1.1.1
Dec 28, 2024 14:41:51.978751898 CET	51980	53	192.168.2.14	1.1.1.1
Dec 28, 2024 14:41:52.197060108 CET	53	51980	1.1.1.1	192.168.2.14
Dec 28, 2024 14:41:52.204771996 CET	53	39396	1.1.1.1	192.168.2.14

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 28, 2024 14:41:50.267918110 CET	192.168.2.14	1.1.1.1	0x5333	Standard query (0)	pirati.privatedns.org	A (IP address)	IN (0x0001)	false
Dec 28, 2024 14:41:51.978703022 CET	192.168.2.14	1.1.1.1	0xfc10	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 14:41:51.978751898 CET	192.168.2.14	1.1.1.1	0xa2c7	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 28, 2024 14:41:50.823383093 CET	1.1.1.1	192.168.2.14	0x5333	No error (0)	pirati.privatedns.org	79.12.214.240	A (IP address)	IN (0x0001)	false
Dec 28, 2024 14:41:52.204771996 CET	1.1.1.1	192.168.2.14	0xfc10	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Dec 28, 2024 14:41:52.204771996 CET	1.1.1.1	192.168.2.14	0xfc10	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: yakuza.i586.elf PID: 5493, Parent PID: 5414

General

Start time (UTC):	13:41:49
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	/tmp/yakuza.i586.elf
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Chronological Activities

Analysis Process: yakuza.i586.elf PID: 5494, Parent PID: 5493

General

Start time (UTC):	13:41:49
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Chronological Activities

Analysis Process: yakuza.i586.elf PID: 5495, Parent PID: 5494

General

Start time (UTC):	13:41:49
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Chronological Activities

Analysis Process: yakuza.i586.elf PID: 5496, Parent PID: 5494

General

Start time (UTC):	13:41:49
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Chronological Activities

Analysis Process: yakuza.i586.elf PID: 5497, Parent PID: 5494

General

Start time (UTC):	13:41:49
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Chronological Activities

Analysis Process: sh PID: 5497, Parent PID: 5494

General

Start time (UTC):	13:41:49
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 902i13 \|\| busybox pkill -9 902i13"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5498, Parent PID: 5497

General

Start time (UTC):	13:41:49
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5498, Parent PID: 5497

General

Start time (UTC):	13:41:49
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 902i13
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5516, Parent PID: 5497

General

Start time (UTC):	13:41:52
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5516, Parent PID: 5497

General

Start time (UTC):	13:41:52
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 902i13
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i586.elf PID: 5517, Parent PID: 5494

General

Start time (UTC):	13:41:53
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Chronological Activities

Analysis Process: sh PID: 5517, Parent PID: 5494

General

Start time (UTC):	13:41:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 BzSxLxBxeY \|\| busybox pkill -9 BzSxLxBxeY"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5518, Parent PID: 5517

General

Start time (UTC):	13:41:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5518, Parent PID: 5517

General

Start time (UTC):	13:41:53
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 BzSxLxBxeY
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5521, Parent PID: 5517

General

Start time (UTC):	13:41:54
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5521, Parent PID: 5517

General

Start time (UTC):	13:41:54
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 BzSxLxBxeY
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i586.elf PID: 5522, Parent PID: 5494

General

Start time (UTC):	13:41:55
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Chronological Activities

Analysis Process: sh PID: 5522, Parent PID: 5494

General

Start time (UTC):	13:41:55
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 HOHO-LUGO7 \|\| busybox pkill -9 HOHO-LUGO7"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5523, Parent PID: 5522

General

Start time (UTC):	13:41:55
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5523, Parent PID: 5522

General

Start time (UTC):	13:41:55
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 HOHO-LUGO7
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5524, Parent PID: 5522

General

Start time (UTC):	13:41:56
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5524, Parent PID: 5522

General

Start time (UTC):	13:41:56
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 HOHO-LUGO7
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i586.elf PID: 5525, Parent PID: 5494

General

Start time (UTC):	13:41:57
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Chronological Activities

Analysis Process: sh PID: 5525, Parent PID: 5494

General

Start time (UTC):	13:41:57
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 HOHO-U79OL \|\| busybox pkill -9 HOHO-U79OL"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5526, Parent PID: 5525

General

Start time (UTC):	13:41:57
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5526, Parent PID: 5525

General

Start time (UTC):	13:41:57
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 HOHO-U79OL
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5529, Parent PID: 5525

General

Start time (UTC):	13:41:58
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5529, Parent PID: 5525

General

Start time (UTC):	13:41:58
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 HOHO-U79OL
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i586.elf PID: 5530, Parent PID: 5494

General

Start time (UTC):	13:41:59
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Chronological Activities

Analysis Process: sh PID: 5530, Parent PID: 5494

General

Start time (UTC):	13:41:59
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 JuYfouyf87 \|\| busybox pkill -9 JuYfouyf87"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5531, Parent PID: 5530

General

Start time (UTC):	13:41:59
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5531, Parent PID: 5530

General

Start time (UTC):	13:41:59
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 JuYfouyf87
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5532, Parent PID: 5530

General

Start time (UTC):	13:42:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5532, Parent PID: 5530

General

Start time (UTC):	13:42:01
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 JuYfouyf87
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i586.elf PID: 5539, Parent PID: 5494

General

Start time (UTC):	13:42:02
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Chronological Activities

Analysis Process: sh PID: 5539, Parent PID: 5494

General

Start time (UTC):	13:42:02
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5540, Parent PID: 5539

General

Start time (UTC):	13:42:02
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5540, Parent PID: 5539

General

Start time (UTC):	13:42:02
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeR69xd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5541, Parent PID: 5539

General

Start time (UTC):	13:42:03
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5541, Parent PID: 5539

General

Start time (UTC):	13:42:03
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeR69xd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i586.elf PID: 5544, Parent PID: 5494

General

Start time (UTC):	13:42:04
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Chronological Activities

Analysis Process: sh PID: 5544, Parent PID: 5494

General

Start time (UTC):	13:42:04
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5545, Parent PID: 5544

General

Start time (UTC):	13:42:04
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5545, Parent PID: 5544

General

Start time (UTC):	13:42:04
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SO190Ij1X
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5546, Parent PID: 5544

General

Start time (UTC):	13:42:05
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5546, Parent PID: 5544

General

Start time (UTC):	13:42:05
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SO190Ij1X
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i586.elf PID: 5547, Parent PID: 5494

General

Start time (UTC):	13:42:06
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Chronological Activities

Analysis Process: sh PID: 5547, Parent PID: 5494

General

Start time (UTC):	13:42:06
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 LOLKIKEEEDDE \|\| busybox pkill -9 LOLKIKEEEDDE"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5548, Parent PID: 5547

General

Start time (UTC):	13:42:06
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5548, Parent PID: 5547

General

Start time (UTC):	13:42:06
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 LOLKIKEEEDDE
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5549, Parent PID: 5547

General

Start time (UTC):	13:42:08
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5549, Parent PID: 5547

General

Start time (UTC):	13:42:08
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 LOLKIKEEEDDE
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i586.elf PID: 5553, Parent PID: 5494

General

Start time (UTC):	13:42:09
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Chronological Activities

Analysis Process: sh PID: 5553, Parent PID: 5494

General

Start time (UTC):	13:42:09
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ekjheory98e \|\| busybox pkill -9 ekjheory98e"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5554, Parent PID: 5553

General

Start time (UTC):	13:42:09
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5554, Parent PID: 5553

General

Start time (UTC):	13:42:09
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ekjheory98e
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5555, Parent PID: 5553

General

Start time (UTC):	13:42:10
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5555, Parent PID: 5553

General

Start time (UTC):	13:42:10
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ekjheory98e
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i586.elf PID: 5574, Parent PID: 5494

General

Start time (UTC):	13:42:11
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Chronological Activities

Analysis Process: sh PID: 5574, Parent PID: 5494

General

Start time (UTC):	13:42:11
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scansh4 \|\| busybox pkill -9 scansh4"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5575, Parent PID: 5574

General

Start time (UTC):	13:42:11
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5575, Parent PID: 5574

General

Start time (UTC):	13:42:11
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 scansh4
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5576, Parent PID: 5574

General

Start time (UTC):	13:42:12
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5576, Parent PID: 5574

General

Start time (UTC):	13:42:12
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scansh4
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i586.elf PID: 5577, Parent PID: 5494

General

Start time (UTC):	13:42:13
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Chronological Activities

Analysis Process: sh PID: 5577, Parent PID: 5494

General

Start time (UTC):	13:42:13
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MDMA \|\| busybox pkill -9 MDMA"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5578, Parent PID: 5577

General

Start time (UTC):	13:42:13
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5578, Parent PID: 5577

General

Start time (UTC):	13:42:13
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MDMA
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5581, Parent PID: 5577

General

Start time (UTC):	13:42:14
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5581, Parent PID: 5577

General

Start time (UTC):	13:42:14
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MDMA
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i586.elf PID: 5582, Parent PID: 5494

General

Start time (UTC):	13:42:15
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Chronological Activities

Analysis Process: sh PID: 5582, Parent PID: 5494

General

Start time (UTC):	13:42:15
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 fdevalvex \|\| busybox pkill -9 fdevalvex"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5583, Parent PID: 5582

General

Start time (UTC):	13:42:15
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5583, Parent PID: 5582

General

Start time (UTC):	13:42:15
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 fdevalvex
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5584, Parent PID: 5582

General

Start time (UTC):	13:42:16
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5584, Parent PID: 5582

General

Start time (UTC):	13:42:16
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 fdevalvex
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i586.elf PID: 5585, Parent PID: 5494

General

Start time (UTC):	13:42:17
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Chronological Activities

Analysis Process: sh PID: 5585, Parent PID: 5494

General

Start time (UTC):	13:42:17
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scanspc \|\| busybox pkill -9 scanspc"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5586, Parent PID: 5585

General

Start time (UTC):	13:42:17
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5586, Parent PID: 5585

General

Start time (UTC):	13:42:17
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 scanspc
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5589, Parent PID: 5585

General

Start time (UTC):	13:42:18
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5589, Parent PID: 5585

General

Start time (UTC):	13:42:18
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scanspc
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i586.elf PID: 5590, Parent PID: 5494

General

Start time (UTC):	13:42:19
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Chronological Activities

Analysis Process: sh PID: 5590, Parent PID: 5494

General

Start time (UTC):	13:42:19
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MELTEDNINJAREALZ \|\| busybox pkill -9 MELTEDNINJAREALZ"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5591, Parent PID: 5590

General

Start time (UTC):	13:42:19
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5591, Parent PID: 5590

General

Start time (UTC):	13:42:19
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MELTEDNINJAREALZ
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5592, Parent PID: 5590

General

Start time (UTC):	13:42:21
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5592, Parent PID: 5590

General

Start time (UTC):	13:42:21
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MELTEDNINJAREALZ
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.i586.elf PID: 5593, Parent PID: 5494

General

Start time (UTC):	13:42:22
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Chronological Activities

Analysis Process: sh PID: 5593, Parent PID: 5494

General

Start time (UTC):	13:42:22
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 flexsonskids \|\| busybox pkill -9 flexsonskids"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5594, Parent PID: 5593

General

Start time (UTC):	13:42:22
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5594, Parent PID: 5593

General

Start time (UTC):	13:42:22
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 flexsonskids
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5595, Parent PID: 5593

General

Start time (UTC):	13:42:23
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5595, Parent PID: 5593

General

Start time (UTC):	13:42:23
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 flexsonskids
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5598, Parent PID: 5494

General

Start time (UTC):	13:42:24
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5598, Parent PID: 5494

General

Start time (UTC):	13:42:24
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scanx86 \|\| busybox pkill -9 scanx86"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5599, Parent PID: 5598

General

Start time (UTC):	13:42:24
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5599, Parent PID: 5598

General

Start time (UTC):	13:42:24
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 scanx86
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5600, Parent PID: 5598

General

Start time (UTC):	13:42:25
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5600, Parent PID: 5598

General

Start time (UTC):	13:42:25
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scanx86
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5601, Parent PID: 5494

General

Start time (UTC):	13:42:26
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5601, Parent PID: 5494

General

Start time (UTC):	13:42:26
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MISAKI-U79OL \|\| busybox pkill -9 MISAKI-U79OL"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5602, Parent PID: 5601

General

Start time (UTC):	13:42:26
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5602, Parent PID: 5601

General

Start time (UTC):	13:42:26
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MISAKI-U79OL
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5603, Parent PID: 5601

General

Start time (UTC):	13:42:27
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5603, Parent PID: 5601

General

Start time (UTC):	13:42:27
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MISAKI-U79OL
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5606, Parent PID: 5494

General

Start time (UTC):	13:42:28
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5606, Parent PID: 5494

General

Start time (UTC):	13:42:28
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 foAxi102kxe \|\| busybox pkill -9 foAxi102kxe"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5607, Parent PID: 5606

General

Start time (UTC):	13:42:28
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5607, Parent PID: 5606

General

Start time (UTC):	13:42:28
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 foAxi102kxe
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5608, Parent PID: 5606

General

Start time (UTC):	13:42:29
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5608, Parent PID: 5606

General

Start time (UTC):	13:42:29
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 foAxi102kxe
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5609, Parent PID: 5494

General

Start time (UTC):	13:42:30
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5609, Parent PID: 5494

General

Start time (UTC):	13:42:30
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 swodjwodjwoj \|\| busybox pkill -9 swodjwodjwoj"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5610, Parent PID: 5609

General

Start time (UTC):	13:42:30
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5610, Parent PID: 5609

General

Start time (UTC):	13:42:30
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 swodjwodjwoj
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5611, Parent PID: 5609

General

Start time (UTC):	13:42:31
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5611, Parent PID: 5609

General

Start time (UTC):	13:42:31
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 swodjwodjwoj
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5612, Parent PID: 5494

General

Start time (UTC):	13:42:32
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5612, Parent PID: 5494

General

Start time (UTC):	13:42:32
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MmKiy7f87l \|\| busybox pkill -9 MmKiy7f87l"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5613, Parent PID: 5612

General

Start time (UTC):	13:42:32
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5613, Parent PID: 5612

General

Start time (UTC):	13:42:32
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MmKiy7f87l
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5616, Parent PID: 5612

General

Start time (UTC):	13:42:33
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5616, Parent PID: 5612

General

Start time (UTC):	13:42:33
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MmKiy7f87l
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5617, Parent PID: 5494

General

Start time (UTC):	13:42:34
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5617, Parent PID: 5494

General

Start time (UTC):	13:42:34
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 freecookiex86 \|\| busybox pkill -9 freecookiex86"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5618, Parent PID: 5617

General

Start time (UTC):	13:42:34
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5618, Parent PID: 5617

General

Start time (UTC):	13:42:34
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 freecookiex86
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5619, Parent PID: 5617

General

Start time (UTC):	13:42:35
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5619, Parent PID: 5617

General

Start time (UTC):	13:42:35
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 freecookiex86
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5620, Parent PID: 5494

General

Start time (UTC):	13:42:36
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5620, Parent PID: 5494

General

Start time (UTC):	13:42:36
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 sysgpu \|\| busybox pkill -9 sysgpu"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5621, Parent PID: 5620

General

Start time (UTC):	13:42:37
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5621, Parent PID: 5620

General

Start time (UTC):	13:42:37
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 sysgpu
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5622, Parent PID: 5620

General

Start time (UTC):	13:42:38
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5622, Parent PID: 5620

General

Start time (UTC):	13:42:38
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 sysgpu
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5626, Parent PID: 5494

General

Start time (UTC):	13:42:39
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5626, Parent PID: 5494

General

Start time (UTC):	13:42:39
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5627, Parent PID: 5626

General

Start time (UTC):	13:42:39
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5627, Parent PID: 5626

General

Start time (UTC):	13:42:39
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeR69xd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5630, Parent PID: 5626

General

Start time (UTC):	13:42:40
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5630, Parent PID: 5626

General

Start time (UTC):	13:42:40
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeR69xd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5631, Parent PID: 5494

General

Start time (UTC):	13:42:41
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5631, Parent PID: 5494

General

Start time (UTC):	13:42:41
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 frgege \|\| busybox pkill -9 frgege"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5632, Parent PID: 5631

General

Start time (UTC):	13:42:41
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5632, Parent PID: 5631

General

Start time (UTC):	13:42:41
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 frgege
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5633, Parent PID: 5631

General

Start time (UTC):	13:42:42
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5633, Parent PID: 5631

General

Start time (UTC):	13:42:42
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 frgege
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5636, Parent PID: 5494

General

Start time (UTC):	13:42:43
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5636, Parent PID: 5494

General

Start time (UTC):	13:42:43
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 sysupdater \|\| busybox pkill -9 sysupdater"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5637, Parent PID: 5636

General

Start time (UTC):	13:42:43
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5637, Parent PID: 5636

General

Start time (UTC):	13:42:43
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 sysupdater
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5638, Parent PID: 5636

General

Start time (UTC):	13:42:44
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5638, Parent PID: 5636

General

Start time (UTC):	13:42:44
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 sysupdater
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5639, Parent PID: 5494

General

Start time (UTC):	13:42:46
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5639, Parent PID: 5494

General

Start time (UTC):	13:42:46
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 0DnAzepd \|\| busybox pkill -9 0DnAzepd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5640, Parent PID: 5639

General

Start time (UTC):	13:42:46
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5640, Parent PID: 5639

General

Start time (UTC):	13:42:46
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 0DnAzepd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5641, Parent PID: 5639

General

Start time (UTC):	13:42:46
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5641, Parent PID: 5639

General

Start time (UTC):	13:42:46
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 0DnAzepd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5642, Parent PID: 5494

General

Start time (UTC):	13:42:48
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5642, Parent PID: 5494

General

Start time (UTC):	13:42:48
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeRD0nks69 \|\| busybox pkill -9 NiGGeRD0nks69"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5643, Parent PID: 5642

General

Start time (UTC):	13:42:48
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5643, Parent PID: 5642

General

Start time (UTC):	13:42:48
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeRD0nks69
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5646, Parent PID: 5642

General

Start time (UTC):	13:42:49
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5646, Parent PID: 5642

General

Start time (UTC):	13:42:49
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeRD0nks69
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5647, Parent PID: 5494

General

Start time (UTC):	13:42:50
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5647, Parent PID: 5494

General

Start time (UTC):	13:42:50
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 frgreu \|\| busybox pkill -9 frgreu"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5648, Parent PID: 5647

General

Start time (UTC):	13:42:50
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5648, Parent PID: 5647

General

Start time (UTC):	13:42:50
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 frgreu
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5649, Parent PID: 5647

General

Start time (UTC):	13:42:51
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5649, Parent PID: 5647

General

Start time (UTC):	13:42:51
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 frgreu
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5650, Parent PID: 5494

General

Start time (UTC):	13:42:52
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5650, Parent PID: 5494

General

Start time (UTC):	13:42:52
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 telnetd \|\| busybox pkill -9 telnetd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5651, Parent PID: 5650

General

Start time (UTC):	13:42:52
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5651, Parent PID: 5650

General

Start time (UTC):	13:42:52
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 telnetd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5652, Parent PID: 5650

General

Start time (UTC):	13:42:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5652, Parent PID: 5650

General

Start time (UTC):	13:42:53
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 telnetd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5655, Parent PID: 5494

General

Start time (UTC):	13:42:54
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5655, Parent PID: 5494

General

Start time (UTC):	13:42:54
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 0x766f6964 \|\| busybox pkill -9 0x766f6964"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5656, Parent PID: 5655

General

Start time (UTC):	13:42:54
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5656, Parent PID: 5655

General

Start time (UTC):	13:42:54
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 0x766f6964
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5657, Parent PID: 5655

General

Start time (UTC):	13:42:55
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5657, Parent PID: 5655

General

Start time (UTC):	13:42:55
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 0x766f6964
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5658, Parent PID: 5494

General

Start time (UTC):	13:42:56
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5658, Parent PID: 5494

General

Start time (UTC):	13:42:56
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeRd0nks1337 \|\| busybox pkill -9 NiGGeRd0nks1337"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5659, Parent PID: 5658

General

Start time (UTC):	13:42:56
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5659, Parent PID: 5658

General

Start time (UTC):	13:42:56
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeRd0nks1337
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5660, Parent PID: 5658

General

Start time (UTC):	13:42:57
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5660, Parent PID: 5658

General

Start time (UTC):	13:42:57
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeRd0nks1337
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5663, Parent PID: 5494

General

Start time (UTC):	13:42:58
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5663, Parent PID: 5494

General

Start time (UTC):	13:42:58
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 gaft \|\| busybox pkill -9 gaft"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5664, Parent PID: 5663

General

Start time (UTC):	13:42:58
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5664, Parent PID: 5663

General

Start time (UTC):	13:42:58
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 gaft
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5665, Parent PID: 5663

General

Start time (UTC):	13:42:59
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5665, Parent PID: 5663

General

Start time (UTC):	13:42:59
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 gaft
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5666, Parent PID: 5494

General

Start time (UTC):	13:43:00
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5666, Parent PID: 5494

General

Start time (UTC):	13:43:00
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 urasgbsigboa \|\| busybox pkill -9 urasgbsigboa"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5667, Parent PID: 5666

General

Start time (UTC):	13:43:00
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5667, Parent PID: 5666

General

Start time (UTC):	13:43:00
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 urasgbsigboa
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5668, Parent PID: 5666

General

Start time (UTC):	13:43:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5668, Parent PID: 5666

General

Start time (UTC):	13:43:01
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 urasgbsigboa
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5669, Parent PID: 5494

General

Start time (UTC):	13:43:02
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5669, Parent PID: 5494

General

Start time (UTC):	13:43:02
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 120i3UI49 \|\| busybox pkill -9 120i3UI49"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5670, Parent PID: 5669

General

Start time (UTC):	13:43:02
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5670, Parent PID: 5669

General

Start time (UTC):	13:43:02
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 120i3UI49
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5673, Parent PID: 5669

General

Start time (UTC):	13:43:04
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5673, Parent PID: 5669

General

Start time (UTC):	13:43:04
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 120i3UI49
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5674, Parent PID: 5494

General

Start time (UTC):	13:43:05
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5674, Parent PID: 5494

General

Start time (UTC):	13:43:05
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 OaF3 \|\| busybox pkill -9 OaF3"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5675, Parent PID: 5674

General

Start time (UTC):	13:43:05
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5675, Parent PID: 5674

General

Start time (UTC):	13:43:05
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 OaF3
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5676, Parent PID: 5674

General

Start time (UTC):	13:43:06
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5676, Parent PID: 5674

General

Start time (UTC):	13:43:06
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 OaF3
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5677, Parent PID: 5494

General

Start time (UTC):	13:43:07
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5677, Parent PID: 5494

General

Start time (UTC):	13:43:07
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 geae \|\| busybox pkill -9 geae"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5678, Parent PID: 5677

General

Start time (UTC):	13:43:07
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5678, Parent PID: 5677

General

Start time (UTC):	13:43:07
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 geae
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5680, Parent PID: 5677

General

Start time (UTC):	13:43:08
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5680, Parent PID: 5677

General

Start time (UTC):	13:43:08
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 geae
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5683, Parent PID: 5494

General

Start time (UTC):	13:43:09
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5683, Parent PID: 5494

General

Start time (UTC):	13:43:09
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 vaiolmao \|\| busybox pkill -9 vaiolmao"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5684, Parent PID: 5683

General

Start time (UTC):	13:43:09
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5684, Parent PID: 5683

General

Start time (UTC):	13:43:09
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 vaiolmao
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5685, Parent PID: 5683

General

Start time (UTC):	13:43:10
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5685, Parent PID: 5683

General

Start time (UTC):	13:43:10
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 vaiolmao
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5686, Parent PID: 5494

General

Start time (UTC):	13:43:11
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5686, Parent PID: 5494

General

Start time (UTC):	13:43:11
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 123123a \|\| busybox pkill -9 123123a"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5687, Parent PID: 5686

General

Start time (UTC):	13:43:11
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5687, Parent PID: 5686

General

Start time (UTC):	13:43:11
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 123123a
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5688, Parent PID: 5686

General

Start time (UTC):	13:43:12
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5688, Parent PID: 5686

General

Start time (UTC):	13:43:12
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 123123a
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5691, Parent PID: 5494

General

Start time (UTC):	13:43:13
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5691, Parent PID: 5494

General

Start time (UTC):	13:43:13
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 Ofurain0n4H34D \|\| busybox pkill -9 Ofurain0n4H34D"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5692, Parent PID: 5691

General

Start time (UTC):	13:43:13
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5692, Parent PID: 5691

General

Start time (UTC):	13:43:13
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 Ofurain0n4H34D
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5693, Parent PID: 5691

General

Start time (UTC):	13:43:14
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5693, Parent PID: 5691

General

Start time (UTC):	13:43:14
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 Ofurain0n4H34D
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5694, Parent PID: 5494

General

Start time (UTC):	13:43:15
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5694, Parent PID: 5494

General

Start time (UTC):	13:43:15
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggTrex \|\| busybox pkill -9 ggTrex"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5695, Parent PID: 5694

General

Start time (UTC):	13:43:15
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5695, Parent PID: 5694

General

Start time (UTC):	13:43:15
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggTrex
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5696, Parent PID: 5694

General

Start time (UTC):	13:43:17
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5696, Parent PID: 5694

General

Start time (UTC):	13:43:17
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggTrex
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5697, Parent PID: 5494

General

Start time (UTC):	13:43:18
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5697, Parent PID: 5494

General

Start time (UTC):	13:43:18
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 wasads \|\| busybox pkill -9 wasads"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5698, Parent PID: 5697

General

Start time (UTC):	13:43:18
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5698, Parent PID: 5697

General

Start time (UTC):	13:43:18
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 wasads
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5701, Parent PID: 5697

General

Start time (UTC):	13:43:19
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5701, Parent PID: 5697

General

Start time (UTC):	13:43:19
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 wasads
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5702, Parent PID: 5494

General

Start time (UTC):	13:43:20
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5702, Parent PID: 5494

General

Start time (UTC):	13:43:20
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1293194hjXD \|\| busybox pkill -9 1293194hjXD"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5703, Parent PID: 5702

General

Start time (UTC):	13:43:20
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5703, Parent PID: 5702

General

Start time (UTC):	13:43:20
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1293194hjXD
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5704, Parent PID: 5702

General

Start time (UTC):	13:43:21
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5704, Parent PID: 5702

General

Start time (UTC):	13:43:21
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1293194hjXD
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5705, Parent PID: 5494

General

Start time (UTC):	13:43:22
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5705, Parent PID: 5494

General

Start time (UTC):	13:43:22
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 OthLaLosn \|\| busybox pkill -9 OthLaLosn"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5706, Parent PID: 5705

General

Start time (UTC):	13:43:22
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5706, Parent PID: 5705

General

Start time (UTC):	13:43:22
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 OthLaLosn
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5707, Parent PID: 5705

General

Start time (UTC):	13:43:23
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5707, Parent PID: 5705

General

Start time (UTC):	13:43:23
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 OthLaLosn
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5710, Parent PID: 5494

General

Start time (UTC):	13:43:24
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5710, Parent PID: 5494

General

Start time (UTC):	13:43:24
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggt \|\| busybox pkill -9 ggt"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5711, Parent PID: 5710

General

Start time (UTC):	13:43:24
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5711, Parent PID: 5710

General

Start time (UTC):	13:43:24
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggt
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5712, Parent PID: 5710

General

Start time (UTC):	13:43:25
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5712, Parent PID: 5710

General

Start time (UTC):	13:43:25
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggt
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5713, Parent PID: 5494

General

Start time (UTC):	13:43:26
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5713, Parent PID: 5494

General

Start time (UTC):	13:43:26
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 wget-log \|\| busybox pkill -9 wget-log"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5714, Parent PID: 5713

General

Start time (UTC):	13:43:26
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5714, Parent PID: 5713

General

Start time (UTC):	13:43:26
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 wget-log
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5715, Parent PID: 5713

General

Start time (UTC):	13:43:27
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5715, Parent PID: 5713

General

Start time (UTC):	13:43:27
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 wget-log
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5718, Parent PID: 5494

General

Start time (UTC):	13:43:28
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5718, Parent PID: 5494

General

Start time (UTC):	13:43:28
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1337SoraLOADER \|\| busybox pkill -9 1337SoraLOADER"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5719, Parent PID: 5718

General

Start time (UTC):	13:43:28
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5719, Parent PID: 5718

General

Start time (UTC):	13:43:28
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1337SoraLOADER
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5720, Parent PID: 5718

General

Start time (UTC):	13:43:30
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5720, Parent PID: 5718

General

Start time (UTC):	13:43:30
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1337SoraLOADER
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5721, Parent PID: 5494

General

Start time (UTC):	13:43:31
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5721, Parent PID: 5494

General

Start time (UTC):	13:43:31
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SAIAKINA \|\| busybox pkill -9 SAIAKINA"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5722, Parent PID: 5721

General

Start time (UTC):	13:43:31
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5722, Parent PID: 5721

General

Start time (UTC):	13:43:31
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SAIAKINA
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5723, Parent PID: 5721

General

Start time (UTC):	13:43:32
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5723, Parent PID: 5721

General

Start time (UTC):	13:43:32
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SAIAKINA
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5724, Parent PID: 5494

General

Start time (UTC):	13:43:33
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5724, Parent PID: 5494

General

Start time (UTC):	13:43:33
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggtq \|\| busybox pkill -9 ggtq"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5725, Parent PID: 5724

General

Start time (UTC):	13:43:33
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5725, Parent PID: 5724

General

Start time (UTC):	13:43:33
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggtq
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5729, Parent PID: 5724

General

Start time (UTC):	13:43:34
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5729, Parent PID: 5724

General

Start time (UTC):	13:43:34
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggtq
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5730, Parent PID: 5494

General

Start time (UTC):	13:43:35
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5730, Parent PID: 5494

General

Start time (UTC):	13:43:35
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1378bfp919GRB1Q2 \|\| busybox pkill -9 1378bfp919GRB1Q2"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5731, Parent PID: 5730

General

Start time (UTC):	13:43:35
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5731, Parent PID: 5730

General

Start time (UTC):	13:43:35
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1378bfp919GRB1Q2
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5732, Parent PID: 5730

General

Start time (UTC):	13:43:36
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5732, Parent PID: 5730

General

Start time (UTC):	13:43:36
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1378bfp919GRB1Q2
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5733, Parent PID: 5494

General

Start time (UTC):	13:43:37
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5733, Parent PID: 5494

General

Start time (UTC):	13:43:37
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SAIAKUSO \|\| busybox pkill -9 SAIAKUSO"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5734, Parent PID: 5733

General

Start time (UTC):	13:43:37
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5734, Parent PID: 5733

General

Start time (UTC):	13:43:37
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SAIAKUSO
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5736, Parent PID: 5733

General

Start time (UTC):	13:43:38
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5736, Parent PID: 5733

General

Start time (UTC):	13:43:38
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SAIAKUSO
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5739, Parent PID: 5494

General

Start time (UTC):	13:43:39
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5739, Parent PID: 5494

General

Start time (UTC):	13:43:39
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggtr \|\| busybox pkill -9 ggtr"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5740, Parent PID: 5739

General

Start time (UTC):	13:43:39
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5740, Parent PID: 5739

General

Start time (UTC):	13:43:39
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggtr
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5743, Parent PID: 5739

General

Start time (UTC):	13:43:40
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5743, Parent PID: 5739

General

Start time (UTC):	13:43:40
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggtr
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5744, Parent PID: 5494

General

Start time (UTC):	13:43:41
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5744, Parent PID: 5494

General

Start time (UTC):	13:43:41
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 14Fa \|\| busybox pkill -9 14Fa"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5745, Parent PID: 5744

General

Start time (UTC):	13:43:41
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5745, Parent PID: 5744

General

Start time (UTC):	13:43:41
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 14Fa
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5746, Parent PID: 5744

General

Start time (UTC):	13:43:42
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5746, Parent PID: 5744

General

Start time (UTC):	13:43:42
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 14Fa
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5749, Parent PID: 5494

General

Start time (UTC):	13:43:43
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5749, Parent PID: 5494

General

Start time (UTC):	13:43:43
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SEXSLAVE1337 \|\| busybox pkill -9 SEXSLAVE1337"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5750, Parent PID: 5749

General

Start time (UTC):	13:43:43
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5750, Parent PID: 5749

General

Start time (UTC):	13:43:43
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SEXSLAVE1337
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5751, Parent PID: 5749

General

Start time (UTC):	13:43:44
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5751, Parent PID: 5749

General

Start time (UTC):	13:43:44
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SEXSLAVE1337
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5752, Parent PID: 5494

General

Start time (UTC):	13:43:45
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5752, Parent PID: 5494

General

Start time (UTC):	13:43:45
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggtt \|\| busybox pkill -9 ggtt"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5753, Parent PID: 5752

General

Start time (UTC):	13:43:45
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5753, Parent PID: 5752

General

Start time (UTC):	13:43:45
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggtt
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5754, Parent PID: 5752

General

Start time (UTC):	13:43:46
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5754, Parent PID: 5752

General

Start time (UTC):	13:43:46
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggtt
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5755, Parent PID: 5494

General

Start time (UTC):	13:43:47
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5755, Parent PID: 5494

General

Start time (UTC):	13:43:47
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1902a3u912u3u4 \|\| busybox pkill -9 1902a3u912u3u4"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5756, Parent PID: 5755

General

Start time (UTC):	13:43:48
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5756, Parent PID: 5755

General

Start time (UTC):	13:43:48
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1902a3u912u3u4
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5759, Parent PID: 5755

General

Start time (UTC):	13:43:49
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5759, Parent PID: 5755

General

Start time (UTC):	13:43:49
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1902a3u912u3u4
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5760, Parent PID: 5494

General

Start time (UTC):	13:43:50
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5760, Parent PID: 5494

General

Start time (UTC):	13:43:50
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5761, Parent PID: 5760

General

Start time (UTC):	13:43:50
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5761, Parent PID: 5760

General

Start time (UTC):	13:43:50
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SO190Ij1X
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5762, Parent PID: 5760

General

Start time (UTC):	13:43:51
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5762, Parent PID: 5760

General

Start time (UTC):	13:43:51
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SO190Ij1X
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.i586.elf PID: 5763, Parent PID: 5494

General

Start time (UTC):	13:43:52
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.i586.elf
Arguments:	-
File size:	122651 bytes
MD5 hash:	03a4bba7037ad3891c404b3715863ed1

Analysis Process: sh PID: 5763, Parent PID: 5494

General

Start time (UTC):	13:43:52
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 haetrghbr \|\| busybox pkill -9 haetrghbr"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5764, Parent PID: 5763

General

Start time (UTC):	13:43:52
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5764, Parent PID: 5763

General

Start time (UTC):	13:43:52
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 haetrghbr
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5765, Parent PID: 5763

General

Start time (UTC):	13:43:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5765, Parent PID: 5763

General

Start time (UTC):	13:43:53
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 haetrghbr
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.
Tactics:	Credential Access
Data Sources:	Application Log: Application Log Content, Command: Command Execution, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report yakuza.i586.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: yakuza.i586.elf PID: 5493, Parent PID: 5414

General

Chronological Activities

Analysis Process: yakuza.i586.elf PID: 5494, Parent PID: 5493

General

Chronological Activities

Analysis Process: yakuza.i586.elf PID: 5495, Parent PID: 5494

General

Chronological Activities

Analysis Process: yakuza.i586.elf PID: 5496, Parent PID: 5494

General

Chronological Activities

Analysis Process: yakuza.i586.elf PID: 5497, Parent PID: 5494

Linux Analysis Report
yakuza.i586.elf