Edit tour

Linux Analysis Report
yakuza.m68k.elf

Overview

General Information

Sample name:	yakuza.m68k.elf
Analysis ID:	1581668
MD5:	7fe9c15baee6be765bd0bf853b5a405c
SHA1:	8f1b4ef4c0095a2982fa46d2c2841f9f5413b4de
SHA256:	dc49cb0df31d92a49ee37a6656b24d03d4b4abea44ad31c6b4c24c2d521432d1
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "kill" or "pkill" command typically used to terminate processes

Reads CPU information from /sys indicative of miner or evasive malware

Reads the 'hosts' file potentially containing internal network hosts

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample contains strings indicative of password brute-forcing capabilities

Sample contains strings that are user agent strings indicative of HTTP manipulation

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581668
Start date and time:	2024-12-28 14:51:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	yakuza.m68k.elf
Detection:	MAL
Classification:	mal64.troj.linELF@0/0@3/0

Warnings

Report size exceeded maximum capacity and may have missing behavior information.

Runtime Messages

Command:	/tmp/yakuza.m68k.elf
PID:	5430
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	CAPSAICIN
Standard Error:

Process Tree

system is lnxubuntu20

yakuza.m68k.elf (PID: 5430, Parent: 5357, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/yakuza.m68k.elf

yakuza.m68k.elf New Fork (PID: 5432, Parent: 5430)

yakuza.m68k.elf New Fork (PID: 5438, Parent: 5432)

yakuza.m68k.elf New Fork (PID: 5439, Parent: 5432)

yakuza.m68k.elf New Fork (PID: 5440, Parent: 5432)

sh (PID: 5440, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 902i13 || busybox pkill -9 902i13"

sh New Fork (PID: 5445, Parent: 5440)

pkill (PID: 5445, Parent: 5440, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 902i13

sh New Fork (PID: 5472, Parent: 5440)

busybox (PID: 5472, Parent: 5440, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 902i13

yakuza.m68k.elf New Fork (PID: 5475, Parent: 5432)

sh (PID: 5475, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 BzSxLxBxeY || busybox pkill -9 BzSxLxBxeY"

sh New Fork (PID: 5480, Parent: 5475)

pkill (PID: 5480, Parent: 5475, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 BzSxLxBxeY

sh New Fork (PID: 5481, Parent: 5475)

busybox (PID: 5481, Parent: 5475, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 BzSxLxBxeY

yakuza.m68k.elf New Fork (PID: 5482, Parent: 5432)

sh (PID: 5482, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 HOHO-LUGO7 || busybox pkill -9 HOHO-LUGO7"

sh New Fork (PID: 5487, Parent: 5482)

pkill (PID: 5487, Parent: 5482, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 HOHO-LUGO7

sh New Fork (PID: 5488, Parent: 5482)

busybox (PID: 5488, Parent: 5482, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 HOHO-LUGO7

yakuza.m68k.elf New Fork (PID: 5491, Parent: 5432)

sh (PID: 5491, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 HOHO-U79OL || busybox pkill -9 HOHO-U79OL"

sh New Fork (PID: 5493, Parent: 5491)

pkill (PID: 5493, Parent: 5491, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 HOHO-U79OL

sh New Fork (PID: 5494, Parent: 5491)

busybox (PID: 5494, Parent: 5491, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 HOHO-U79OL

yakuza.m68k.elf New Fork (PID: 5495, Parent: 5432)

sh (PID: 5495, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 JuYfouyf87 || busybox pkill -9 JuYfouyf87"

sh New Fork (PID: 5500, Parent: 5495)

pkill (PID: 5500, Parent: 5495, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 JuYfouyf87

sh New Fork (PID: 5501, Parent: 5495)

busybox (PID: 5501, Parent: 5495, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 JuYfouyf87

yakuza.m68k.elf New Fork (PID: 5504, Parent: 5432)

sh (PID: 5504, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"

sh New Fork (PID: 5506, Parent: 5504)

pkill (PID: 5506, Parent: 5504, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeR69xd

sh New Fork (PID: 5507, Parent: 5504)

busybox (PID: 5507, Parent: 5504, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeR69xd

yakuza.m68k.elf New Fork (PID: 5514, Parent: 5432)

sh (PID: 5514, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SO190Ij1X || busybox pkill -9 SO190Ij1X"

sh New Fork (PID: 5520, Parent: 5514)

pkill (PID: 5520, Parent: 5514, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SO190Ij1X

sh New Fork (PID: 5521, Parent: 5514)

busybox (PID: 5521, Parent: 5514, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SO190Ij1X

yakuza.m68k.elf New Fork (PID: 5522, Parent: 5432)

sh (PID: 5522, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 LOLKIKEEEDDE || busybox pkill -9 LOLKIKEEEDDE"

sh New Fork (PID: 5524, Parent: 5522)

pkill (PID: 5524, Parent: 5522, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 LOLKIKEEEDDE

sh New Fork (PID: 5527, Parent: 5522)

busybox (PID: 5527, Parent: 5522, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 LOLKIKEEEDDE

yakuza.m68k.elf New Fork (PID: 5528, Parent: 5432)

sh (PID: 5528, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ekjheory98e || busybox pkill -9 ekjheory98e"

sh New Fork (PID: 5533, Parent: 5528)

pkill (PID: 5533, Parent: 5528, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ekjheory98e

sh New Fork (PID: 5534, Parent: 5528)

busybox (PID: 5534, Parent: 5528, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ekjheory98e

yakuza.m68k.elf New Fork (PID: 5535, Parent: 5432)

sh (PID: 5535, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scansh4 || busybox pkill -9 scansh4"

sh New Fork (PID: 5540, Parent: 5535)

pkill (PID: 5540, Parent: 5535, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scansh4

sh New Fork (PID: 5557, Parent: 5535)

busybox (PID: 5557, Parent: 5535, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scansh4

yakuza.m68k.elf New Fork (PID: 5560, Parent: 5432)

sh (PID: 5560, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MDMA || busybox pkill -9 MDMA"

sh New Fork (PID: 5565, Parent: 5560)

pkill (PID: 5565, Parent: 5560, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MDMA

sh New Fork (PID: 5566, Parent: 5560)

busybox (PID: 5566, Parent: 5560, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MDMA

yakuza.m68k.elf New Fork (PID: 5567, Parent: 5432)

sh (PID: 5567, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 fdevalvex || busybox pkill -9 fdevalvex"

sh New Fork (PID: 5572, Parent: 5567)

pkill (PID: 5572, Parent: 5567, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 fdevalvex

sh New Fork (PID: 5573, Parent: 5567)

busybox (PID: 5573, Parent: 5567, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 fdevalvex

yakuza.m68k.elf New Fork (PID: 5574, Parent: 5432)

sh (PID: 5574, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scanspc || busybox pkill -9 scanspc"

sh New Fork (PID: 5579, Parent: 5574)

pkill (PID: 5579, Parent: 5574, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scanspc

sh New Fork (PID: 5582, Parent: 5574)

busybox (PID: 5582, Parent: 5574, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scanspc

yakuza.m68k.elf New Fork (PID: 5584, Parent: 5432)

sh (PID: 5584, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MELTEDNINJAREALZ || busybox pkill -9 MELTEDNINJAREALZ"

sh New Fork (PID: 5590, Parent: 5584)

pkill (PID: 5590, Parent: 5584, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MELTEDNINJAREALZ

sh New Fork (PID: 5591, Parent: 5584)

busybox (PID: 5591, Parent: 5584, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MELTEDNINJAREALZ

yakuza.m68k.elf New Fork (PID: 5592, Parent: 5432)

sh (PID: 5592, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 flexsonskids || busybox pkill -9 flexsonskids"

sh New Fork (PID: 5597, Parent: 5592)

pkill (PID: 5597, Parent: 5592, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 flexsonskids

sh New Fork (PID: 5600, Parent: 5592)

busybox (PID: 5600, Parent: 5592, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 flexsonskids

yakuza.m68k.elf New Fork (PID: 5601, Parent: 5432)

sh (PID: 5601, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scanx86 || busybox pkill -9 scanx86"

sh New Fork (PID: 5605, Parent: 5601)

pkill (PID: 5605, Parent: 5601, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scanx86

sh New Fork (PID: 5607, Parent: 5601)

busybox (PID: 5607, Parent: 5601, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scanx86

yakuza.m68k.elf New Fork (PID: 5608, Parent: 5432)

sh (PID: 5608, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MISAKI-U79OL || busybox pkill -9 MISAKI-U79OL"

sh New Fork (PID: 5610, Parent: 5608)

pkill (PID: 5610, Parent: 5608, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MISAKI-U79OL

sh New Fork (PID: 5611, Parent: 5608)

busybox (PID: 5611, Parent: 5608, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MISAKI-U79OL

yakuza.m68k.elf New Fork (PID: 5614, Parent: 5432)

sh (PID: 5614, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 foAxi102kxe || busybox pkill -9 foAxi102kxe"

sh New Fork (PID: 5616, Parent: 5614)

pkill (PID: 5616, Parent: 5614, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 foAxi102kxe

sh New Fork (PID: 5617, Parent: 5614)

busybox (PID: 5617, Parent: 5614, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 foAxi102kxe

yakuza.m68k.elf New Fork (PID: 5618, Parent: 5432)

sh (PID: 5618, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 swodjwodjwoj || busybox pkill -9 swodjwodjwoj"

sh New Fork (PID: 5623, Parent: 5618)

pkill (PID: 5623, Parent: 5618, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 swodjwodjwoj

sh New Fork (PID: 5624, Parent: 5618)

busybox (PID: 5624, Parent: 5618, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 swodjwodjwoj

yakuza.m68k.elf New Fork (PID: 5627, Parent: 5432)

sh (PID: 5627, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MmKiy7f87l || busybox pkill -9 MmKiy7f87l"

sh New Fork (PID: 5631, Parent: 5627)

pkill (PID: 5631, Parent: 5627, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MmKiy7f87l

sh New Fork (PID: 5633, Parent: 5627)

busybox (PID: 5633, Parent: 5627, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MmKiy7f87l

yakuza.m68k.elf New Fork (PID: 5634, Parent: 5432)

sh (PID: 5634, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 freecookiex86 || busybox pkill -9 freecookiex86"

sh New Fork (PID: 5636, Parent: 5634)

pkill (PID: 5636, Parent: 5634, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 freecookiex86

sh New Fork (PID: 5637, Parent: 5634)

busybox (PID: 5637, Parent: 5634, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 freecookiex86

yakuza.m68k.elf New Fork (PID: 5638, Parent: 5432)

sh (PID: 5638, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 sysgpu || busybox pkill -9 sysgpu"

sh New Fork (PID: 5644, Parent: 5638)

pkill (PID: 5644, Parent: 5638, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 sysgpu

sh New Fork (PID: 5647, Parent: 5638)

busybox (PID: 5647, Parent: 5638, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 sysgpu

yakuza.m68k.elf New Fork (PID: 5648, Parent: 5432)

sh (PID: 5648, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"

sh New Fork (PID: 5653, Parent: 5648)

pkill (PID: 5653, Parent: 5648, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeR69xd

sh New Fork (PID: 5654, Parent: 5648)

busybox (PID: 5654, Parent: 5648, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeR69xd

yakuza.m68k.elf New Fork (PID: 5657, Parent: 5432)

sh (PID: 5657, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 frgege || busybox pkill -9 frgege"

sh New Fork (PID: 5659, Parent: 5657)

pkill (PID: 5659, Parent: 5657, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 frgege

sh New Fork (PID: 5660, Parent: 5657)

busybox (PID: 5660, Parent: 5657, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 frgege

yakuza.m68k.elf New Fork (PID: 5663, Parent: 5432)

sh (PID: 5663, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 sysupdater || busybox pkill -9 sysupdater"

sh New Fork (PID: 5668, Parent: 5663)

pkill (PID: 5668, Parent: 5663, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 sysupdater

sh New Fork (PID: 5669, Parent: 5663)

busybox (PID: 5669, Parent: 5663, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 sysupdater

yakuza.m68k.elf New Fork (PID: 5670, Parent: 5432)

sh (PID: 5670, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 0DnAzepd || busybox pkill -9 0DnAzepd"

sh New Fork (PID: 5672, Parent: 5670)

pkill (PID: 5672, Parent: 5670, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 0DnAzepd

sh New Fork (PID: 5673, Parent: 5670)

busybox (PID: 5673, Parent: 5670, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 0DnAzepd

yakuza.m68k.elf New Fork (PID: 5676, Parent: 5432)

sh (PID: 5676, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeRD0nks69 || busybox pkill -9 NiGGeRD0nks69"

sh New Fork (PID: 5681, Parent: 5676)

pkill (PID: 5681, Parent: 5676, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeRD0nks69

sh New Fork (PID: 5682, Parent: 5676)

busybox (PID: 5682, Parent: 5676, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeRD0nks69

yakuza.m68k.elf New Fork (PID: 5684, Parent: 5432)

sh (PID: 5684, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 frgreu || busybox pkill -9 frgreu"

sh New Fork (PID: 5690, Parent: 5684)

pkill (PID: 5690, Parent: 5684, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 frgreu

sh New Fork (PID: 5691, Parent: 5684)

busybox (PID: 5691, Parent: 5684, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 frgreu

yakuza.m68k.elf New Fork (PID: 5692, Parent: 5432)

sh (PID: 5692, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 telnetd || busybox pkill -9 telnetd"

sh New Fork (PID: 5694, Parent: 5692)

pkill (PID: 5694, Parent: 5692, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 telnetd

sh New Fork (PID: 5697, Parent: 5692)

busybox (PID: 5697, Parent: 5692, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 telnetd

yakuza.m68k.elf New Fork (PID: 5698, Parent: 5432)

sh (PID: 5698, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 0x766f6964 || busybox pkill -9 0x766f6964"

sh New Fork (PID: 5700, Parent: 5698)

pkill (PID: 5700, Parent: 5698, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 0x766f6964

sh New Fork (PID: 5701, Parent: 5698)

busybox (PID: 5701, Parent: 5698, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 0x766f6964

yakuza.m68k.elf New Fork (PID: 5702, Parent: 5432)

sh (PID: 5702, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeRd0nks1337 || busybox pkill -9 NiGGeRd0nks1337"

sh New Fork (PID: 5707, Parent: 5702)

pkill (PID: 5707, Parent: 5702, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeRd0nks1337

sh New Fork (PID: 5708, Parent: 5702)

busybox (PID: 5708, Parent: 5702, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeRd0nks1337

yakuza.m68k.elf New Fork (PID: 5711, Parent: 5432)

sh (PID: 5711, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 gaft || busybox pkill -9 gaft"

sh New Fork (PID: 5716, Parent: 5711)

pkill (PID: 5716, Parent: 5711, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 gaft

sh New Fork (PID: 5717, Parent: 5711)

busybox (PID: 5717, Parent: 5711, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 gaft

yakuza.m68k.elf New Fork (PID: 5718, Parent: 5432)

sh (PID: 5718, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 urasgbsigboa || busybox pkill -9 urasgbsigboa"

sh New Fork (PID: 5723, Parent: 5718)

pkill (PID: 5723, Parent: 5718, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 urasgbsigboa

sh New Fork (PID: 5724, Parent: 5718)

busybox (PID: 5724, Parent: 5718, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 urasgbsigboa

yakuza.m68k.elf New Fork (PID: 5725, Parent: 5432)

sh (PID: 5725, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 120i3UI49 || busybox pkill -9 120i3UI49"

sh New Fork (PID: 5730, Parent: 5725)

pkill (PID: 5730, Parent: 5725, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 120i3UI49

sh New Fork (PID: 5733, Parent: 5725)

busybox (PID: 5733, Parent: 5725, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 120i3UI49

yakuza.m68k.elf New Fork (PID: 5734, Parent: 5432)

sh (PID: 5734, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 OaF3 || busybox pkill -9 OaF3"

sh New Fork (PID: 5739, Parent: 5734)

pkill (PID: 5739, Parent: 5734, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 OaF3

sh New Fork (PID: 5740, Parent: 5734)

busybox (PID: 5740, Parent: 5734, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 OaF3

yakuza.m68k.elf New Fork (PID: 5741, Parent: 5432)

sh (PID: 5741, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 geae || busybox pkill -9 geae"

sh New Fork (PID: 5747, Parent: 5741)

pkill (PID: 5747, Parent: 5741, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 geae

sh New Fork (PID: 5748, Parent: 5741)

busybox (PID: 5748, Parent: 5741, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 geae

yakuza.m68k.elf New Fork (PID: 5751, Parent: 5432)

sh (PID: 5751, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 vaiolmao || busybox pkill -9 vaiolmao"

sh New Fork (PID: 5756, Parent: 5751)

pkill (PID: 5756, Parent: 5751, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 vaiolmao

sh New Fork (PID: 5757, Parent: 5751)

busybox (PID: 5757, Parent: 5751, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 vaiolmao

yakuza.m68k.elf New Fork (PID: 5758, Parent: 5432)

sh (PID: 5758, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 123123a || busybox pkill -9 123123a"

sh New Fork (PID: 5763, Parent: 5758)

pkill (PID: 5763, Parent: 5758, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 123123a

sh New Fork (PID: 5764, Parent: 5758)

busybox (PID: 5764, Parent: 5758, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 123123a

yakuza.m68k.elf New Fork (PID: 5767, Parent: 5432)

sh (PID: 5767, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 Ofurain0n4H34D || busybox pkill -9 Ofurain0n4H34D"

sh New Fork (PID: 5772, Parent: 5767)

pkill (PID: 5772, Parent: 5767, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 Ofurain0n4H34D

sh New Fork (PID: 5773, Parent: 5767)

busybox (PID: 5773, Parent: 5767, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 Ofurain0n4H34D

yakuza.m68k.elf New Fork (PID: 5774, Parent: 5432)

sh (PID: 5774, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggTrex || busybox pkill -9 ggTrex"

sh New Fork (PID: 5779, Parent: 5774)

pkill (PID: 5779, Parent: 5774, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggTrex

sh New Fork (PID: 5780, Parent: 5774)

busybox (PID: 5780, Parent: 5774, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggTrex

yakuza.m68k.elf New Fork (PID: 5781, Parent: 5432)

sh (PID: 5781, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 wasads || busybox pkill -9 wasads"

sh New Fork (PID: 5783, Parent: 5781)

pkill (PID: 5783, Parent: 5781, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 wasads

sh New Fork (PID: 5786, Parent: 5781)

busybox (PID: 5786, Parent: 5781, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 wasads

yakuza.m68k.elf New Fork (PID: 5787, Parent: 5432)

sh (PID: 5787, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1293194hjXD || busybox pkill -9 1293194hjXD"

sh New Fork (PID: 5792, Parent: 5787)

pkill (PID: 5792, Parent: 5787, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1293194hjXD

sh New Fork (PID: 5794, Parent: 5787)

busybox (PID: 5794, Parent: 5787, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1293194hjXD

yakuza.m68k.elf New Fork (PID: 5795, Parent: 5432)

sh (PID: 5795, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 OthLaLosn || busybox pkill -9 OthLaLosn"

sh New Fork (PID: 5801, Parent: 5795)

pkill (PID: 5801, Parent: 5795, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 OthLaLosn

sh New Fork (PID: 5802, Parent: 5795)

busybox (PID: 5802, Parent: 5795, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 OthLaLosn

yakuza.m68k.elf New Fork (PID: 5805, Parent: 5432)

sh (PID: 5805, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggt || busybox pkill -9 ggt"

sh New Fork (PID: 5807, Parent: 5805)

pkill (PID: 5807, Parent: 5805, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggt

sh New Fork (PID: 5808, Parent: 5805)

busybox (PID: 5808, Parent: 5805, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggt

yakuza.m68k.elf New Fork (PID: 5809, Parent: 5432)

sh (PID: 5809, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 wget-log || busybox pkill -9 wget-log"

sh New Fork (PID: 5814, Parent: 5809)

pkill (PID: 5814, Parent: 5809, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 wget-log

sh New Fork (PID: 5815, Parent: 5809)

busybox (PID: 5815, Parent: 5809, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 wget-log

yakuza.m68k.elf New Fork (PID: 5816, Parent: 5432)

sh (PID: 5816, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1337SoraLOADER || busybox pkill -9 1337SoraLOADER"

sh New Fork (PID: 5818, Parent: 5816)

pkill (PID: 5818, Parent: 5816, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1337SoraLOADER

sh New Fork (PID: 5821, Parent: 5816)

busybox (PID: 5821, Parent: 5816, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1337SoraLOADER

yakuza.m68k.elf New Fork (PID: 5822, Parent: 5432)

sh (PID: 5822, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SAIAKINA || busybox pkill -9 SAIAKINA"

sh New Fork (PID: 5824, Parent: 5822)

pkill (PID: 5824, Parent: 5822, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SAIAKINA

sh New Fork (PID: 5825, Parent: 5822)

busybox (PID: 5825, Parent: 5822, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SAIAKINA

yakuza.m68k.elf New Fork (PID: 5826, Parent: 5432)

sh (PID: 5826, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggtq || busybox pkill -9 ggtq"

sh New Fork (PID: 5831, Parent: 5826)

pkill (PID: 5831, Parent: 5826, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggtq

sh New Fork (PID: 5832, Parent: 5826)

busybox (PID: 5832, Parent: 5826, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggtq

yakuza.m68k.elf New Fork (PID: 5835, Parent: 5432)

sh (PID: 5835, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1378bfp919GRB1Q2 || busybox pkill -9 1378bfp919GRB1Q2"

sh New Fork (PID: 5837, Parent: 5835)

pkill (PID: 5837, Parent: 5835, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1378bfp919GRB1Q2

sh New Fork (PID: 5838, Parent: 5835)

busybox (PID: 5838, Parent: 5835, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1378bfp919GRB1Q2

yakuza.m68k.elf New Fork (PID: 5839, Parent: 5432)

sh (PID: 5839, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SAIAKUSO || busybox pkill -9 SAIAKUSO"

sh New Fork (PID: 5841, Parent: 5839)

pkill (PID: 5841, Parent: 5839, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SAIAKUSO

sh New Fork (PID: 5843, Parent: 5839)

busybox (PID: 5843, Parent: 5839, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SAIAKUSO

yakuza.m68k.elf New Fork (PID: 5844, Parent: 5432)

sh (PID: 5844, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggtr || busybox pkill -9 ggtr"

sh New Fork (PID: 5850, Parent: 5844)

pkill (PID: 5850, Parent: 5844, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggtr

sh New Fork (PID: 5853, Parent: 5844)

busybox (PID: 5853, Parent: 5844, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggtr

yakuza.m68k.elf New Fork (PID: 5854, Parent: 5432)

sh (PID: 5854, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 14Fa || busybox pkill -9 14Fa"

sh New Fork (PID: 5859, Parent: 5854)

pkill (PID: 5859, Parent: 5854, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 14Fa

sh New Fork (PID: 5860, Parent: 5854)

busybox (PID: 5860, Parent: 5854, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 14Fa

yakuza.m68k.elf New Fork (PID: 5861, Parent: 5432)

sh (PID: 5861, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SEXSLAVE1337 || busybox pkill -9 SEXSLAVE1337"

sh New Fork (PID: 5863, Parent: 5861)

pkill (PID: 5863, Parent: 5861, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SEXSLAVE1337

sh New Fork (PID: 5866, Parent: 5861)

busybox (PID: 5866, Parent: 5861, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SEXSLAVE1337

yakuza.m68k.elf New Fork (PID: 5869, Parent: 5432)

sh (PID: 5869, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggtt || busybox pkill -9 ggtt"

sh New Fork (PID: 5874, Parent: 5869)

pkill (PID: 5874, Parent: 5869, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggtt

sh New Fork (PID: 5875, Parent: 5869)

busybox (PID: 5875, Parent: 5869, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggtt

yakuza.m68k.elf New Fork (PID: 5876, Parent: 5432)

sh (PID: 5876, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1902a3u912u3u4 || busybox pkill -9 1902a3u912u3u4"

sh New Fork (PID: 5881, Parent: 5876)

pkill (PID: 5881, Parent: 5876, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1902a3u912u3u4

sh New Fork (PID: 5882, Parent: 5876)

busybox (PID: 5882, Parent: 5876, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1902a3u912u3u4

yakuza.m68k.elf New Fork (PID: 5883, Parent: 5432)

sh (PID: 5883, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SO190Ij1X || busybox pkill -9 SO190Ij1X"

sh New Fork (PID: 5888, Parent: 5883)

pkill (PID: 5888, Parent: 5883, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SO190Ij1X

sh New Fork (PID: 5891, Parent: 5883)

busybox (PID: 5891, Parent: 5883, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SO190Ij1X

yakuza.m68k.elf New Fork (PID: 5892, Parent: 5432)

sh (PID: 5892, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 haetrghbr || busybox pkill -9 haetrghbr"

sh New Fork (PID: 5897, Parent: 5892)

pkill (PID: 5897, Parent: 5892, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 haetrghbr

sh New Fork (PID: 5899, Parent: 5892)

busybox (PID: 5899, Parent: 5892, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 haetrghbr

yakuza.m68k.elf New Fork (PID: 5900, Parent: 5432)

sh (PID: 5900, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 19ju3d || busybox pkill -9 19ju3d"

sh New Fork (PID: 5902, Parent: 5900)

pkill (PID: 5902, Parent: 5900, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 19ju3d

sh New Fork (PID: 5903, Parent: 5900)

busybox (PID: 5903, Parent: 5900, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 19ju3d

yakuza.m68k.elf New Fork (PID: 5906, Parent: 5432)

sh (PID: 5906, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SORAojkf120 || busybox pkill -9 SORAojkf120"

sh New Fork (PID: 5912, Parent: 5906)

pkill (PID: 5912, Parent: 5906, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SORAojkf120

sh New Fork (PID: 5913, Parent: 5906)

busybox (PID: 5913, Parent: 5906, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SORAojkf120

yakuza.m68k.elf New Fork (PID: 5914, Parent: 5432)

sh (PID: 5914, Parent: 5432, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 hehahejeje92 || busybox pkill -9 hehahejeje92"

sh New Fork (PID: 5916, Parent: 5914)

pkill (PID: 5916, Parent: 5914, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 hehahejeje92

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
yakuza.m68k.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
yakuza.m68k.elf	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x19571:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x19bcd:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20

Memory Dumps

Source	Rule	Description	Author	Strings
5439.1.00007f2d50001000.00007f2d5001e000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5439.1.00007f2d50001000.00007f2d5001e000.r-x.sdmp	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x19571:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x19bcd:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
5430.1.00007f2d50001000.00007f2d5001e000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5430.1.00007f2d50001000.00007f2d5001e000.r-x.sdmp	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x19571:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x19bcd:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
Process Memory Space: yakuza.m68k.elf PID: 5430	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x76b7:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x77ec:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x7dc7:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
Process Memory Space: yakuza.m68k.elf PID: 5439	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x5078:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x51ad:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x5788:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
Click to see the 1 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: yakuza.m68k.elf

ReversingLabs: Detection: 55%

Source: /usr/bin/pkill (PID: 5445)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5480)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5487)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5493)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5500)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5506)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5520)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5524)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5533)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5565)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5572)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5579)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5590)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5597)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5605)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5610)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5616)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5623)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5631)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5636)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5644)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5653)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5659)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5668)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5672)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5681)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5690)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5694)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5700)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5707)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5716)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5723)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5730)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5739)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5747)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5756)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5763)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5772)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5779)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5783)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5792)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5801)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5807)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5814)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5818)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5824)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5831)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5837)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5841)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5850)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5859)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5863)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5874)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5881)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5888)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5897)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5902)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5912)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5916)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/yakuza.m68k.elf (PID: 5439)

Reads hosts file: /etc/hosts

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26

Source: global traffic	DNS traffic detected: DNS query: pirati.privatedns.org
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: yakuza.m68k.elf	String found in binary or memory: http://linux-it.abuser.eu/yak.sh;
Source: yakuza.m68k.elf	String found in binary or memory: https://youtu.be/dQw4w9WgXcQ
Source: yakuza.m68k.elf	String found in binary or memory: https://youtu.be/dQw4w9WgXcQNever

Source: unknown

Network traffic detected: HTTP traffic on port 48202 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: yakuza.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: 5439.1.00007f2d50001000.00007f2d5001e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: 5430.1.00007f2d50001000.00007f2d5001e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: Process Memory Space: yakuza.m68k.elf PID: 5430, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: Process Memory Space: yakuza.m68k.elf PID: 5439, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown

Source: yakuza.m68k.elf	ELF static info symbol of initial sample: passwords
Source: yakuza.m68k.elf	ELF static info symbol of initial sample: usernames

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: pkill -9 %s \|\| busybox pkill -9 %s
Source: Initial sample	String containing 'busybox' found: pkill -9 %s \|\| busybox pkill -9 %shistory -c;history -wcd /root;rm -f .bash_historycd /var/tmp; rm -f *NOTICE %s :MOVE <server>

Source: Initial sample	String containing potential weak password found: guest
Source: Initial sample	String containing potential weak password found: default
Source: Initial sample	String containing potential weak password found: admin
Source: Initial sample	String containing potential weak password found: supervisor
Source: Initial sample	String containing potential weak password found: service
Source: Initial sample	String containing potential weak password found: administrator
Source: Initial sample	String containing potential weak password found: support
Source: Initial sample	String containing potential weak password found: 123456
Source: Initial sample	String containing potential weak password found: password
Source: Initial sample	String containing potential weak password found: 12345

Source: yakuza.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: 5439.1.00007f2d50001000.00007f2d5001e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: 5430.1.00007f2d50001000.00007f2d5001e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: Process Memory Space: yakuza.m68k.elf PID: 5430, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: Process Memory Space: yakuza.m68k.elf PID: 5439, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16

Source: classification engine

Classification label: mal64.troj.linELF@0/0@3/0

Source: yakuza.m68k.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/m68k/crt1.S
Source: yakuza.m68k.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/m68k/crti.S
Source: yakuza.m68k.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/m68k/crtn.S
Source: yakuza.m68k.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/m68k/vfork.S

Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/230/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/230/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/231/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/231/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/232/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/232/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/233/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/233/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/234/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/234/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/236/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/236/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/237/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/237/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/238/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/238/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/239/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/239/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/5379/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/5379/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/914/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/914/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/917/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/917/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/13/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/5274/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/5274/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/14/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/14/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/15/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/15/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/16/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/16/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/17/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/17/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/18/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/18/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/19/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/19/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/240/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/240/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/3095/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/120/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/120/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/241/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/241/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/121/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/121/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/242/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/242/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/1/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/122/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/122/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/243/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/243/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/2/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/2/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/123/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/123/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/244/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/244/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/3/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/3/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/124/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/124/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/245/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/245/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/1588/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/125/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/125/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/4/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/4/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/246/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	File opened: /proc/246/cmdline	Jump to behavior

Source: /tmp/yakuza.m68k.elf (PID: 5440)	Shell command executed: sh -c "pkill -9 902i13 \|\| busybox pkill -9 902i13"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 5475)	Shell command executed: sh -c "pkill -9 BzSxLxBxeY \|\| busybox pkill -9 BzSxLxBxeY"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 5482)	Shell command executed: sh -c "pkill -9 HOHO-LUGO7 \|\| busybox pkill -9 HOHO-LUGO7"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 5491)	Shell command executed: sh -c "pkill -9 HOHO-U79OL \|\| busybox pkill -9 HOHO-U79OL"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 5495)	Shell command executed: sh -c "pkill -9 JuYfouyf87 \|\| busybox pkill -9 JuYfouyf87"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 5504)	Shell command executed: sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 5514)	Shell command executed: sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 5522)	Shell command executed: sh -c "pkill -9 LOLKIKEEEDDE \|\| busybox pkill -9 LOLKIKEEEDDE"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 5528)	Shell command executed: sh -c "pkill -9 ekjheory98e \|\| busybox pkill -9 ekjheory98e"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 5535)	Shell command executed: sh -c "pkill -9 scansh4 \|\| busybox pkill -9 scansh4"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 5560)	Shell command executed: sh -c "pkill -9 MDMA \|\| busybox pkill -9 MDMA"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 5567)	Shell command executed: sh -c "pkill -9 fdevalvex \|\| busybox pkill -9 fdevalvex"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 5574)	Shell command executed: sh -c "pkill -9 scanspc \|\| busybox pkill -9 scanspc"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 5584)	Shell command executed: sh -c "pkill -9 MELTEDNINJAREALZ \|\| busybox pkill -9 MELTEDNINJAREALZ"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 5592)	Shell command executed: sh -c "pkill -9 flexsonskids \|\| busybox pkill -9 flexsonskids"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 5601)	Shell command executed: sh -c "pkill -9 scanx86 \|\| busybox pkill -9 scanx86"
Source: /tmp/yakuza.m68k.elf (PID: 5608)	Shell command executed: sh -c "pkill -9 MISAKI-U79OL \|\| busybox pkill -9 MISAKI-U79OL"
Source: /tmp/yakuza.m68k.elf (PID: 5614)	Shell command executed: sh -c "pkill -9 foAxi102kxe \|\| busybox pkill -9 foAxi102kxe"
Source: /tmp/yakuza.m68k.elf (PID: 5618)	Shell command executed: sh -c "pkill -9 swodjwodjwoj \|\| busybox pkill -9 swodjwodjwoj"
Source: /tmp/yakuza.m68k.elf (PID: 5627)	Shell command executed: sh -c "pkill -9 MmKiy7f87l \|\| busybox pkill -9 MmKiy7f87l"
Source: /tmp/yakuza.m68k.elf (PID: 5634)	Shell command executed: sh -c "pkill -9 freecookiex86 \|\| busybox pkill -9 freecookiex86"
Source: /tmp/yakuza.m68k.elf (PID: 5638)	Shell command executed: sh -c "pkill -9 sysgpu \|\| busybox pkill -9 sysgpu"
Source: /tmp/yakuza.m68k.elf (PID: 5648)	Shell command executed: sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
Source: /tmp/yakuza.m68k.elf (PID: 5657)	Shell command executed: sh -c "pkill -9 frgege \|\| busybox pkill -9 frgege"
Source: /tmp/yakuza.m68k.elf (PID: 5663)	Shell command executed: sh -c "pkill -9 sysupdater \|\| busybox pkill -9 sysupdater"
Source: /tmp/yakuza.m68k.elf (PID: 5670)	Shell command executed: sh -c "pkill -9 0DnAzepd \|\| busybox pkill -9 0DnAzepd"
Source: /tmp/yakuza.m68k.elf (PID: 5676)	Shell command executed: sh -c "pkill -9 NiGGeRD0nks69 \|\| busybox pkill -9 NiGGeRD0nks69"
Source: /tmp/yakuza.m68k.elf (PID: 5684)	Shell command executed: sh -c "pkill -9 frgreu \|\| busybox pkill -9 frgreu"
Source: /tmp/yakuza.m68k.elf (PID: 5692)	Shell command executed: sh -c "pkill -9 telnetd \|\| busybox pkill -9 telnetd"
Source: /tmp/yakuza.m68k.elf (PID: 5698)	Shell command executed: sh -c "pkill -9 0x766f6964 \|\| busybox pkill -9 0x766f6964"
Source: /tmp/yakuza.m68k.elf (PID: 5702)	Shell command executed: sh -c "pkill -9 NiGGeRd0nks1337 \|\| busybox pkill -9 NiGGeRd0nks1337"
Source: /tmp/yakuza.m68k.elf (PID: 5711)	Shell command executed: sh -c "pkill -9 gaft \|\| busybox pkill -9 gaft"
Source: /tmp/yakuza.m68k.elf (PID: 5718)	Shell command executed: sh -c "pkill -9 urasgbsigboa \|\| busybox pkill -9 urasgbsigboa"
Source: /tmp/yakuza.m68k.elf (PID: 5725)	Shell command executed: sh -c "pkill -9 120i3UI49 \|\| busybox pkill -9 120i3UI49"
Source: /tmp/yakuza.m68k.elf (PID: 5734)	Shell command executed: sh -c "pkill -9 OaF3 \|\| busybox pkill -9 OaF3"
Source: /tmp/yakuza.m68k.elf (PID: 5741)	Shell command executed: sh -c "pkill -9 geae \|\| busybox pkill -9 geae"
Source: /tmp/yakuza.m68k.elf (PID: 5751)	Shell command executed: sh -c "pkill -9 vaiolmao \|\| busybox pkill -9 vaiolmao"
Source: /tmp/yakuza.m68k.elf (PID: 5758)	Shell command executed: sh -c "pkill -9 123123a \|\| busybox pkill -9 123123a"
Source: /tmp/yakuza.m68k.elf (PID: 5767)	Shell command executed: sh -c "pkill -9 Ofurain0n4H34D \|\| busybox pkill -9 Ofurain0n4H34D"
Source: /tmp/yakuza.m68k.elf (PID: 5774)	Shell command executed: sh -c "pkill -9 ggTrex \|\| busybox pkill -9 ggTrex"
Source: /tmp/yakuza.m68k.elf (PID: 5781)	Shell command executed: sh -c "pkill -9 wasads \|\| busybox pkill -9 wasads"
Source: /tmp/yakuza.m68k.elf (PID: 5787)	Shell command executed: sh -c "pkill -9 1293194hjXD \|\| busybox pkill -9 1293194hjXD"
Source: /tmp/yakuza.m68k.elf (PID: 5795)	Shell command executed: sh -c "pkill -9 OthLaLosn \|\| busybox pkill -9 OthLaLosn"
Source: /tmp/yakuza.m68k.elf (PID: 5805)	Shell command executed: sh -c "pkill -9 ggt \|\| busybox pkill -9 ggt"
Source: /tmp/yakuza.m68k.elf (PID: 5809)	Shell command executed: sh -c "pkill -9 wget-log \|\| busybox pkill -9 wget-log"
Source: /tmp/yakuza.m68k.elf (PID: 5816)	Shell command executed: sh -c "pkill -9 1337SoraLOADER \|\| busybox pkill -9 1337SoraLOADER"
Source: /tmp/yakuza.m68k.elf (PID: 5822)	Shell command executed: sh -c "pkill -9 SAIAKINA \|\| busybox pkill -9 SAIAKINA"
Source: /tmp/yakuza.m68k.elf (PID: 5826)	Shell command executed: sh -c "pkill -9 ggtq \|\| busybox pkill -9 ggtq"
Source: /tmp/yakuza.m68k.elf (PID: 5835)	Shell command executed: sh -c "pkill -9 1378bfp919GRB1Q2 \|\| busybox pkill -9 1378bfp919GRB1Q2"
Source: /tmp/yakuza.m68k.elf (PID: 5839)	Shell command executed: sh -c "pkill -9 SAIAKUSO \|\| busybox pkill -9 SAIAKUSO"
Source: /tmp/yakuza.m68k.elf (PID: 5844)	Shell command executed: sh -c "pkill -9 ggtr \|\| busybox pkill -9 ggtr"
Source: /tmp/yakuza.m68k.elf (PID: 5854)	Shell command executed: sh -c "pkill -9 14Fa \|\| busybox pkill -9 14Fa"
Source: /tmp/yakuza.m68k.elf (PID: 5861)	Shell command executed: sh -c "pkill -9 SEXSLAVE1337 \|\| busybox pkill -9 SEXSLAVE1337"
Source: /tmp/yakuza.m68k.elf (PID: 5869)	Shell command executed: sh -c "pkill -9 ggtt \|\| busybox pkill -9 ggtt"
Source: /tmp/yakuza.m68k.elf (PID: 5876)	Shell command executed: sh -c "pkill -9 1902a3u912u3u4 \|\| busybox pkill -9 1902a3u912u3u4"
Source: /tmp/yakuza.m68k.elf (PID: 5883)	Shell command executed: sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"
Source: /tmp/yakuza.m68k.elf (PID: 5892)	Shell command executed: sh -c "pkill -9 haetrghbr \|\| busybox pkill -9 haetrghbr"
Source: /tmp/yakuza.m68k.elf (PID: 5900)	Shell command executed: sh -c "pkill -9 19ju3d \|\| busybox pkill -9 19ju3d"
Source: /tmp/yakuza.m68k.elf (PID: 5906)	Shell command executed: sh -c "pkill -9 SORAojkf120 \|\| busybox pkill -9 SORAojkf120"
Source: /tmp/yakuza.m68k.elf (PID: 5914)	Shell command executed: sh -c "pkill -9 hehahejeje92 \|\| busybox pkill -9 hehahejeje92"

Source: /bin/sh (PID: 5445)	Pkill executable: /usr/bin/pkill -> pkill -9 902i13	Jump to behavior
Source: /bin/sh (PID: 5480)	Pkill executable: /usr/bin/pkill -> pkill -9 BzSxLxBxeY	Jump to behavior
Source: /bin/sh (PID: 5487)	Pkill executable: /usr/bin/pkill -> pkill -9 HOHO-LUGO7	Jump to behavior
Source: /bin/sh (PID: 5493)	Pkill executable: /usr/bin/pkill -> pkill -9 HOHO-U79OL	Jump to behavior
Source: /bin/sh (PID: 5500)	Pkill executable: /usr/bin/pkill -> pkill -9 JuYfouyf87	Jump to behavior
Source: /bin/sh (PID: 5506)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeR69xd	Jump to behavior
Source: /bin/sh (PID: 5520)	Pkill executable: /usr/bin/pkill -> pkill -9 SO190Ij1X	Jump to behavior
Source: /bin/sh (PID: 5524)	Pkill executable: /usr/bin/pkill -> pkill -9 LOLKIKEEEDDE	Jump to behavior
Source: /bin/sh (PID: 5533)	Pkill executable: /usr/bin/pkill -> pkill -9 ekjheory98e	Jump to behavior
Source: /bin/sh (PID: 5540)	Pkill executable: /usr/bin/pkill -> pkill -9 scansh4	Jump to behavior
Source: /bin/sh (PID: 5565)	Pkill executable: /usr/bin/pkill -> pkill -9 MDMA	Jump to behavior
Source: /bin/sh (PID: 5572)	Pkill executable: /usr/bin/pkill -> pkill -9 fdevalvex	Jump to behavior
Source: /bin/sh (PID: 5579)	Pkill executable: /usr/bin/pkill -> pkill -9 scanspc	Jump to behavior
Source: /bin/sh (PID: 5590)	Pkill executable: /usr/bin/pkill -> pkill -9 MELTEDNINJAREALZ	Jump to behavior
Source: /bin/sh (PID: 5597)	Pkill executable: /usr/bin/pkill -> pkill -9 flexsonskids	Jump to behavior
Source: /bin/sh (PID: 5605)	Pkill executable: /usr/bin/pkill -> pkill -9 scanx86
Source: /bin/sh (PID: 5610)	Pkill executable: /usr/bin/pkill -> pkill -9 MISAKI-U79OL
Source: /bin/sh (PID: 5616)	Pkill executable: /usr/bin/pkill -> pkill -9 foAxi102kxe
Source: /bin/sh (PID: 5623)	Pkill executable: /usr/bin/pkill -> pkill -9 swodjwodjwoj
Source: /bin/sh (PID: 5631)	Pkill executable: /usr/bin/pkill -> pkill -9 MmKiy7f87l
Source: /bin/sh (PID: 5636)	Pkill executable: /usr/bin/pkill -> pkill -9 freecookiex86
Source: /bin/sh (PID: 5644)	Pkill executable: /usr/bin/pkill -> pkill -9 sysgpu
Source: /bin/sh (PID: 5653)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeR69xd
Source: /bin/sh (PID: 5659)	Pkill executable: /usr/bin/pkill -> pkill -9 frgege
Source: /bin/sh (PID: 5668)	Pkill executable: /usr/bin/pkill -> pkill -9 sysupdater
Source: /bin/sh (PID: 5672)	Pkill executable: /usr/bin/pkill -> pkill -9 0DnAzepd
Source: /bin/sh (PID: 5681)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeRD0nks69
Source: /bin/sh (PID: 5690)	Pkill executable: /usr/bin/pkill -> pkill -9 frgreu
Source: /bin/sh (PID: 5694)	Pkill executable: /usr/bin/pkill -> pkill -9 telnetd
Source: /bin/sh (PID: 5700)	Pkill executable: /usr/bin/pkill -> pkill -9 0x766f6964
Source: /bin/sh (PID: 5707)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeRd0nks1337
Source: /bin/sh (PID: 5716)	Pkill executable: /usr/bin/pkill -> pkill -9 gaft
Source: /bin/sh (PID: 5723)	Pkill executable: /usr/bin/pkill -> pkill -9 urasgbsigboa
Source: /bin/sh (PID: 5730)	Pkill executable: /usr/bin/pkill -> pkill -9 120i3UI49
Source: /bin/sh (PID: 5739)	Pkill executable: /usr/bin/pkill -> pkill -9 OaF3
Source: /bin/sh (PID: 5747)	Pkill executable: /usr/bin/pkill -> pkill -9 geae
Source: /bin/sh (PID: 5756)	Pkill executable: /usr/bin/pkill -> pkill -9 vaiolmao
Source: /bin/sh (PID: 5763)	Pkill executable: /usr/bin/pkill -> pkill -9 123123a
Source: /bin/sh (PID: 5772)	Pkill executable: /usr/bin/pkill -> pkill -9 Ofurain0n4H34D
Source: /bin/sh (PID: 5779)	Pkill executable: /usr/bin/pkill -> pkill -9 ggTrex
Source: /bin/sh (PID: 5783)	Pkill executable: /usr/bin/pkill -> pkill -9 wasads
Source: /bin/sh (PID: 5792)	Pkill executable: /usr/bin/pkill -> pkill -9 1293194hjXD
Source: /bin/sh (PID: 5801)	Pkill executable: /usr/bin/pkill -> pkill -9 OthLaLosn
Source: /bin/sh (PID: 5807)	Pkill executable: /usr/bin/pkill -> pkill -9 ggt
Source: /bin/sh (PID: 5814)	Pkill executable: /usr/bin/pkill -> pkill -9 wget-log
Source: /bin/sh (PID: 5818)	Pkill executable: /usr/bin/pkill -> pkill -9 1337SoraLOADER
Source: /bin/sh (PID: 5824)	Pkill executable: /usr/bin/pkill -> pkill -9 SAIAKINA
Source: /bin/sh (PID: 5831)	Pkill executable: /usr/bin/pkill -> pkill -9 ggtq
Source: /bin/sh (PID: 5837)	Pkill executable: /usr/bin/pkill -> pkill -9 1378bfp919GRB1Q2
Source: /bin/sh (PID: 5841)	Pkill executable: /usr/bin/pkill -> pkill -9 SAIAKUSO
Source: /bin/sh (PID: 5850)	Pkill executable: /usr/bin/pkill -> pkill -9 ggtr
Source: /bin/sh (PID: 5859)	Pkill executable: /usr/bin/pkill -> pkill -9 14Fa
Source: /bin/sh (PID: 5863)	Pkill executable: /usr/bin/pkill -> pkill -9 SEXSLAVE1337
Source: /bin/sh (PID: 5874)	Pkill executable: /usr/bin/pkill -> pkill -9 ggtt
Source: /bin/sh (PID: 5881)	Pkill executable: /usr/bin/pkill -> pkill -9 1902a3u912u3u4
Source: /bin/sh (PID: 5888)	Pkill executable: /usr/bin/pkill -> pkill -9 SO190Ij1X
Source: /bin/sh (PID: 5897)	Pkill executable: /usr/bin/pkill -> pkill -9 haetrghbr
Source: /bin/sh (PID: 5902)	Pkill executable: /usr/bin/pkill -> pkill -9 19ju3d
Source: /bin/sh (PID: 5912)	Pkill executable: /usr/bin/pkill -> pkill -9 SORAojkf120
Source: /bin/sh (PID: 5916)	Pkill executable: /usr/bin/pkill -> pkill -9 hehahejeje92

Source: /usr/bin/pkill (PID: 5445)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5480)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5487)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5493)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5500)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5506)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5520)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5524)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5533)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5540)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5565)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5572)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5579)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5590)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5597)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5605)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5610)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5616)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5623)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5631)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5636)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5644)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5653)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5659)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5668)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5672)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5681)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5690)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5694)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5700)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5707)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5716)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5723)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5730)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5739)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5747)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5756)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5763)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5772)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5779)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5783)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5792)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5801)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5807)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5814)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5818)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5824)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5831)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5837)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5841)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5850)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5859)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5863)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5874)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5881)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5888)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5897)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5902)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5912)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5916)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/yakuza.m68k.elf (PID: 5430)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5472)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5481)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5488)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5494)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5501)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5507)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5521)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5527)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5534)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5557)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5566)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5573)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5582)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5591)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5600)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5607)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5611)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5617)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5624)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5633)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5637)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5647)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5654)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5660)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5669)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5673)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5682)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5691)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5697)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5701)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5708)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5717)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5724)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5733)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5740)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5748)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5757)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5764)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5773)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5780)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5786)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5794)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5802)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5808)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5815)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5821)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5825)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5832)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5838)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5843)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5853)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5860)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5866)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5875)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5882)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5891)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5899)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5903)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5913)	Queries kernel information via 'uname':

Source: yakuza.m68k.elf, 5430.1.00007ffc18999000.00007ffc189ba000.rw-.sdmp, yakuza.m68k.elf, 5439.1.00007ffc18999000.00007ffc189ba000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: yakuza.m68k.elf, 5430.1.00005567e3f49000.00005567e3fad000.rw-.sdmp, yakuza.m68k.elf, 5439.1.00005567e3f49000.00005567e3fad000.rw-.sdmp	Binary or memory string: gU!/etc/qemu-binfmt/m68k
Source: yakuza.m68k.elf, 5430.1.00005567e3f49000.00005567e3fad000.rw-.sdmp, yakuza.m68k.elf, 5439.1.00005567e3f49000.00005567e3fad000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k
Source: yakuza.m68k.elf, 5430.1.00007ffc18999000.00007ffc189ba000.rw-.sdmp, yakuza.m68k.elf, 5439.1.00007ffc18999000.00007ffc189ba000.rw-.sdmp	Binary or memory string: ov'NvEx86_64/usr/bin/qemu-m68k/tmp/yakuza.m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/yakuza.m68k.elf
Source: yakuza.m68k.elf, 5439.1.00007ffc18999000.00007ffc189ba000.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: yakuza.m68k.elf, type: SAMPLE
Source: Yara match	File source: 5439.1.00007f2d50001000.00007f2d5001e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5430.1.00007f2d50001000.00007f2d5001e000.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U;) Presto/2.7.62 Version/11.01
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; U; de; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.62
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0) Gecko/20110517 Firefox/5.0 Fennec/5.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (compatible; Teleca Q7; Brew 3.1.5; U; en) 480X800 LGE VX11000

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: yakuza.m68k.elf, type: SAMPLE
Source: Yara match	File source: 5439.1.00007f2d50001000.00007f2d5001e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5430.1.00007f2d50001000.00007f2d5001e000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	1 Brute Force	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
yakuza.m68k.elf	55%	ReversingLabs	Linux.Trojan.Tsunami

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high
pirati.privatedns.org	79.12.214.240	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://youtu.be/dQw4w9WgXcQ	yakuza.m68k.elf	false	high
http://linux-it.abuser.eu/yak.sh;	yakuza.m68k.elf	false	high
https://youtu.be/dQw4w9WgXcQNever	yakuza.m68k.elf	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.125.190.26	unknown	United Kingdom		41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.125.190.26	mpsl.elf	Get hash	malicious	Gafgyt	Browse
	yakuza.i586.elf	Get hash	malicious	Mirai	Browse
	x86_64.elf	Get hash	malicious	Gafgyt	Browse
	45.200.149.186-boatnet.arc-2024-12-28T01_22_59.elf	Get hash	malicious	Mirai	Browse
	109.176.30.237-boatnet.mpsl-2024-12-27T20_20_43.elf	Get hash	malicious	Mirai	Browse
	drp.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	ppc.elf	Get hash	malicious	Mirai	Browse
	arm6.nn.elf	Get hash	malicious	Okiru	Browse
	RpcSecurity.arm7.elf	Get hash	malicious	Mirai	Browse
	RpcSecurity.ppc.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pirati.privatedns.org	yakuza.i586.elf	Get hash	malicious	Mirai	Browse	79.12.214.240
	yakuza.sh.elf	Get hash	malicious	Mirai	Browse	79.12.214.240
	yakuza.sparc.elf	Get hash	malicious	Mirai	Browse	79.12.214.240
	yakuza.arm4.elf	Get hash	malicious	Mirai	Browse	79.12.214.240
	yakuza.mipsel.elf	Get hash	malicious	Mirai	Browse	79.12.214.240
	yakuza.arm7.elf	Get hash	malicious	Mirai	Browse	212.171.15.94
	yakuza.i686.elf	Get hash	malicious	Mirai	Browse	212.171.15.94
	yakuza.ppc.elf	Get hash	malicious	Mirai	Browse	212.171.15.94
daisy.ubuntu.com	yakuza.i586.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	yakuza.i686.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	arm6.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	45.200.149.186-boatnet.arm-2024-12-28T01_23_00.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	byte.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.24
	109.176.30.237-boatnet.mpsl-2024-12-27T20_20_43.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	byte.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	byte.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	byte.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	mpsl.elf	Get hash	malicious	Gafgyt	Browse	185.125.190.26
	yakuza.i586.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	arm6.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	arm4.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	yakuza.sh.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	yakuza.sparc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	yakuza.arm4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	yakuza.mipsel.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	yakuza.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	yakuza.ppc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.19331060709164
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	yakuza.m68k.elf
File size:	148'444 bytes
MD5:	7fe9c15baee6be765bd0bf853b5a405c
SHA1:	8f1b4ef4c0095a2982fa46d2c2841f9f5413b4de
SHA256:	dc49cb0df31d92a49ee37a6656b24d03d4b4abea44ad31c6b4c24c2d521432d1
SHA512:	16a835d64110d12ea2b7211cb3b071b3f4c91145cc5acc4945713652827d9d23344d06e3d7710c183977bbe6b7f5ea64dfe80c2a50b1f5e3c6aaa9e3f9fe9612
SSDEEP:	3072:pGPbysqwQ01TSKy+E1B0rui+cQSs62uS8TSorHvKWnDf49/1TpPI:Ybysq21ry+wB0ruqB2ATVrHvKWnDf4Jw
TLSH:	5CE33B82FD00DE76F41A967644D74B29B270AB624F531672731B39AADE372C0382BF45
File Content Preview:	.ELF.......................D...4...0.....4. ...(.................................. ........................\|...... .dt.Q............................NV..a....da...o\|N^NuNV..J9....f>"y.... QJ.g.X.#.....N."y.... QJ.f.A.....J.g.Hy....N.X.........N^NuNV..N^NuN

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	122160
Section Header Size:	40
Number of Section Headers:	15
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	0	0	2
.text	PROGBITS	0x800000a8	0xa8	0x16fa8	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x80017050	0x17050	0xe	0x0	0x6	AX	0	0	2
.rodata	PROGBITS	0x8001705e	0x1705e	0x5190	0x0	0x2	A	0	0	2
.eh_frame	PROGBITS	0x8001c1f0	0x1c1f0	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x8001e1f4	0x1c1f4	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x8001e1fc	0x1c1fc	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x8001e204	0x1c204	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x8001e208	0x1c208	0xd78	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x8001ef80	0x1cf80	0x77f0	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x1cf80	0xd4a	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1dcca	0x66	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1df88	0x39a0	0x10	0x0		14	324	4
.strtab	STRTAB	0x0	0x21928	0x2ab4	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0x1c1f4	0x1c1f4	6.2104	0x5	R E	0x2000	.init .text .fini .rodata .eh_frame
LOAD	0x1c1f4	0x8001e1f4	0x8001e1f4	0xd8c	0x857c	4.6915	0x6	RW	0x2000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80000094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x800000a8	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x80017050	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x8001705e	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x8001c1f0	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x8001e1f4	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x8001e1fc	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x8001e204	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x8001e208	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x8001ef80	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
C.89.5703	.symtab	0x80019262	312	OBJECT	<unknown>	DEFAULT	4
ClearHistory	.symtab	0x80005a2a	50	FUNC	<unknown>	DEFAULT	2
HTTP	.symtab	0x8000203e	274	FUNC	<unknown>	DEFAULT	2
Q	.symtab	0x8001f3b6	16384	OBJECT	<unknown>	DEFAULT	10
Send	.symtab	0x8000033a	78	FUNC	<unknown>	DEFAULT	2
UserAgents	.symtab	0x8001e53c	144	OBJECT	<unknown>	DEFAULT	9
_352	.symtab	0x80006ebc	8	FUNC	<unknown>	DEFAULT	2
_376	.symtab	0x80006e22	122	FUNC	<unknown>	DEFAULT	2
_433	.symtab	0x80006ec4	58	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_NICK	.symtab	0x80006efe	174	FUNC	<unknown>	DEFAULT	2
_PING	.symtab	0x80006e9c	32	FUNC	<unknown>	DEFAULT	2
_PRIVMSG	.symtab	0x8000639e	2692	FUNC	<unknown>	DEFAULT	2
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x8001e1f8	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x8001e1f4	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x8001ef24	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x8001baa8	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x8001ef2c	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x8001bda8	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x8001ec08	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x8001aa84	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x8001e200	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x8001e1fc	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x8001c1f0	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x8001c1f0	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x8001ef24	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x8001baa8	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x8001ef2c	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x8001bda8	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x8001ec08	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x8001aa84	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x8001ef28	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x8001ef30	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x8001ec0c	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x800082e0	16	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x800128bc	500	FUNC	<unknown>	HIDDEN	2
__GI___fputc_unlocked	.symtab	0x8000adf8	392	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x8000bcf0	36	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x8001154c	16	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x80007b30	188	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x80007c44	54	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x800112da	80	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x80010be4	106	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x80010d00	74	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x8000bd14	264	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x80011040	16	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x80015794	390	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x8000e8f0	50	FUNC	<unknown>	HIDDEN	2
__GI_asprintf	.symtab	0x80008604	48	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x8000fe68	28	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x8000fe68	28	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x8000e924	48	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x80015948	64	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x80007cba	16	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x80011050	78	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x80007ccc	60	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x8000e954	48	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x800110a0	72	FUNC	<unknown>	HIDDEN	2
__GI_endservent	.symtab	0x80013944	108	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x80025424	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x80010178	178	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x800110e8	84	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x800100fc	124	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x800082f0	416	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x80007b30	188	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x80007c44	54	FUNC	<unknown>	HIDDEN	2
__GI_fdopen	.symtab	0x800116b8	78	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x8000ab16	510	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x800128bc	500	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x8000a7c0	134	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x8000ad14	226	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x80008490	38	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x80007d08	56	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x800085d4	48	FUNC	<unknown>	HIDDEN	2
__GI_fputc	.symtab	0x8000a848	284	FUNC	<unknown>	HIDDEN	2
__GI_fputs	.symtab	0x8000a964	124	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x8000af80	80	FUNC	<unknown>	HIDDEN	2
__GI_freeaddrinfo	.symtab	0x8000d30c	44	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x800159e8	40	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x80015a98	346	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x8000afd0	162	FUNC	<unknown>	HIDDEN	2
__GI_getaddrinfo	.symtab	0x8000d338	764	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x800128bc	500	FUNC	<unknown>	HIDDEN	2
__GI_getcwd	.symtab	0x80007d40	298	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x80007e6c	52	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x8001113c	60	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x80011178	60	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x800111b4	60	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyaddr_r	.symtab	0x8000e3fc	1268	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x8000e01c	990	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x80015010	1164	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x80007ea0	42	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x80007ecc	56	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x80007f3c	90	FUNC	<unknown>	HIDDEN	2
__GI_getservbyname_r	.symtab	0x80013b4c	276	FUNC	<unknown>	HIDDEN	2
__GI_getservbyport	.symtab	0x80013b10	60	FUNC	<unknown>	HIDDEN	2
__GI_getservbyport_r	.symtab	0x80013a3c	212	FUNC	<unknown>	HIDDEN	2
__GI_getservent_r	.symtab	0x80013632	734	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x800111f0	60	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x80025428	4	OBJECT	<unknown>	HIDDEN	10
__GI_if_freenameindex	.symtab	0x80014048	72	FUNC	<unknown>	HIDDEN	2
__GI_if_nameindex	.symtab	0x80013de0	616	FUNC	<unknown>	HIDDEN	2
__GI_if_nametoindex	.symtab	0x80013d46	154	FUNC	<unknown>	HIDDEN	2
__GI_in6addr_loopback	.symtab	0x8001ba2c	16	OBJECT	<unknown>	HIDDEN	4
__GI_inet_addr	.symtab	0x8000dfec	48	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x80014090	362	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x8000dfcc	30	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x8000df2c	160	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x8000deba	112	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x8000d9c8	96	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x8000fb9e	330	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x80007f98	130	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x8000bfd4	52	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x80008064	20	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x8000e9c8	42	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x80016dda	108	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x80012ab0	348	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x8000b49e	240	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x800130cc	288	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x800131ec	42	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x80013218	358	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x8000b590	310	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x8001122c	78	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x800112da	80	FUNC	<unknown>	HIDDEN	2
__GI_perror	.symtab	0x800084b8	74	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x80011348	62	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x80008078	88	FUNC	<unknown>	HIDDEN	2
__GI_putc	.symtab	0x8000a848	284	FUNC	<unknown>	HIDDEN	2
__GI_putc_unlocked	.symtab	0x8000adf8	392	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x80016d5c	28	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x8000f5b8	94	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x8000f8ee	266	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x80015f88	274	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x80016e48	84	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x8000e9f4	56	FUNC	<unknown>	HIDDEN	2
__GI_rewind	.symtab	0x80015a10	134	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x80011388	106	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x800080d0	100	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x8000ea2c	56	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x8000ea64	70	FUNC	<unknown>	HIDDEN	2
__GI_setservent	.symtab	0x800139b0	140	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x80008134	56	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x8000eaac	64	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x8000f758	406	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x800154e0	232	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x800155c8	238	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x800113f4	160	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x8001022c	558	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x8000eaec	50	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x80008634	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x8000f9f8	422	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x8000be3c	120	FUNC	<unknown>	HIDDEN	2
__GI_strcasestr	.symtab	0x8000beb4	170	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x80013380	390	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x8000b6c8	110	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x8000b6c8	110	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x8000b738	92	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x8000bf60	80	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x8000b794	268	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x8001609c	310	FUNC	<unknown>	HIDDEN	2
__GI_strncmp	.symtab	0x8000b8a0	430	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x8000ba50	320	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x8000bb90	350	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x800135a4	86	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x800161d4	104	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x8000bfb0	36	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x80013508	154	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x8000fe84	34	FUNC	<unknown>	HIDDEN	2
__GI_strtoul	.symtab	0x8000fea8	32	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x8001045c	1782	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x8000c008	182	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x8000816c	62	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x8001150c	64	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x800082a0	64	FUNC	<unknown>	HIDDEN	2
__GI_vasprintf	.symtab	0x80008668	158	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x80010f94	38	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x800090c4	182	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x80008708	198	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x800114ee	30	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x80008228	34	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x8001155c	100	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x800115e8	206	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x800115c0	38	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x8000824c	84	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x8001e204	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x8001e204	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x80025418	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x8001ef08	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x800155c8	238	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x8001ef80	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x80010cbc	68	FUNC	<unknown>	DEFAULT	2
__check_pf	.symtab	0x8000c104	28	FUNC	<unknown>	DEFAULT	2
__check_suid	.symtab	0x80010c60	92	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x8001ef28	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x8001ef30	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x8001ec0c	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x80025468	4	OBJECT	<unknown>	DEFAULT	10
__data_start	.symtab	0x8001e210	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x8001670c	460	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x800141fc	340	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x8001642c	480	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x80014350	2224	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x8001701c	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x800000a8	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x8001e208	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x80016e9c	268	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x8001623c	494	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x8001660c	198	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x80025410	4	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x800082e0	16	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x80025408	4	OBJECT	<unknown>	HIDDEN	10
__fgetc_unlocked	.symtab	0x800128bc	500	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x8001e1f4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x8001e1f4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fputc_unlocked	.symtab	0x8000adf8	392	FUNC	<unknown>	DEFAULT	2
__free_to_heap	.symtab	0x8000edf4	342	FUNC	<unknown>	DEFAULT	2
__get_hosts_byaddr_r	.symtab	0x80014f7c	148	FUNC	<unknown>	HIDDEN	2
__get_hosts_byname_r	.symtab	0x80014f48	50	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x80007ea0	42	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x8000bcf0	36	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x8001154c	16	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_add_free_area	.symtab	0x8000f3d2	66	FUNC	<unknown>	DEFAULT	2
__heap_alloc	.symtab	0x8000f19e	150	FUNC	<unknown>	DEFAULT	2
__heap_alloc_at	.symtab	0x8000f2ce	144	FUNC	<unknown>	DEFAULT	2
__heap_delete	.symtab	0x8000ed9c	88	FUNC	<unknown>	DEFAULT	2
__heap_delete	.symtab	0x8000f104	88	FUNC	<unknown>	DEFAULT	2
__heap_delete	.symtab	0x8000f234	88	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x8000f414	404	FUNC	<unknown>	DEFAULT	2
__heap_free_area_alloc	.symtab	0x8000f15c	66	FUNC	<unknown>	DEFAULT	2
__heap_free_area_alloc	.symtab	0x8000f28c	66	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x8000f360	70	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x8000f3a6	44	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x8001e1f4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x8001e1f4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__initbuf	.symtab	0x800135fc	54	FUNC	<unknown>	DEFAULT	2
__length_dotted	.symtab	0x80016fa8	114	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x800166d4	56	FUNC	<unknown>	HIDDEN	2
__libc_accept	.symtab	0x8000e8f0	50	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x80007ccc	60	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x8000e954	48	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x8001132a	30	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x80007b30	188	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x80007c44	54	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x80007d08	56	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x80007ecc	56	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x80016dda	108	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x8001122c	78	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x800112da	80	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x80008078	88	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x80016e48	84	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x8000e9f4	56	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x800080d0	100	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x8000ea2c	56	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x8000ea64	70	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x800154e0	232	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x8002540c	4	OBJECT	<unknown>	DEFAULT	10
__libc_system	.symtab	0x8000fce8	382	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x80008228	34	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x8000824c	84	FUNC	<unknown>	DEFAULT	2
__malloc_from_heap	.symtab	0x8000eb20	466	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x8001ed4c	4	OBJECT	<unknown>	DEFAULT	9
__malloc_heap_lock	.symtab	0x800253f0	24	OBJECT	<unknown>	DEFAULT	10
__malloc_sbrk_lock	.symtab	0x800266ac	24	OBJECT	<unknown>	DEFAULT	10
__nameserver	.symtab	0x800266d4	12	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x800266e0	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x800168d8	72	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x80014c00	840	FUNC	<unknown>	HIDDEN	2
__opensock	.symtab	0x8001549c	66	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x80025414	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x8001e1f4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x8001e1f4	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x80010c4e	10	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x80010c4e	10	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x80010c4e	10	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x80010c4e	10	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x80010c4e	10	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x80010c58	8	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x80016d5c	28	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x80016920	1084	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x8001ef50	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x8002541c	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x800266c4	16	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x800266e4	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x80015708	68	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x8001574c	72	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x800156b8	80	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x80010fbc	74	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x8001ec1c	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x80015bf4	138	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x80011708	314	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x80015c80	352	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x80011844	518	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x80008f38	32	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3828	.symtab	0x8001ad9e	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x80015de0	90	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x80015f20	102	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x80015e3c	226	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x80011a4c	414	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x80009050	116	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x8001ec20	4	OBJECT	<unknown>	DEFAULT	9
__syscall_chdir	.symtab	0x80007c7c	62	FUNC	<unknown>	DEFAULT	2
__syscall_exit	.symtab	0x80011008	56	FUNC	<unknown>	DEFAULT	2
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64	.symtab	0x80007bec	88	FUNC	<unknown>	DEFAULT	2
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_kill	.symtab	0x8000801c	72	FUNC	<unknown>	DEFAULT	2
__syscall_llseek	.symtab	0x80016d78	98	FUNC	<unknown>	DEFAULT	2
__syscall_open	.symtab	0x8001127c	94	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x80015988	94	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_umask	.symtab	0x800081ac	88	FUNC	<unknown>	DEFAULT	2
__syscall_wait4	.symtab	0x80011494	90	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x80010be4	106	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x80010d00	74	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x80010d4a	584	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x8001ef20	4	OBJECT	<unknown>	HIDDEN	9
__vfork	.symtab	0x80010f94	38	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x8000bd14	264	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x8000917c	74	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x8001591c	44	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x80026768	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x8002676c	4	OBJECT	<unknown>	DEFAULT	10
_do_one_spec	.symtab	0x8000926e	2118	FUNC	<unknown>	DEFAULT	2
_edata	.symtab	0x8001ef80	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x80026770	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x80025424	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x80011040	16	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x80017050	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x800233dc	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x800091c6	168	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x80011ef4	2502	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x80025428	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x80000094	0	FUNC	<unknown>	DEFAULT	1
_is_equal_or_bigger_arg	.symtab	0x8000a0a8	102	FUNC	<unknown>	DEFAULT	2
_load_inttype	.symtab	0x80011bec	238	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x80009c48	208	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x8000a10e	1584	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x80009d18	108	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x80009d84	718	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x8000a054	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x80010c58	8	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x80010c58	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x800266e8	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x80000144	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x80008b10	960	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x80008ed0	104	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x8001ec24	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x8001ec28	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x8000a9e0	310	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x800233d8	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x8001ec40	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x800233d4	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x8001ec5c	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x80008f58	248	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x8001ec58	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x8000fec8	562	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x80011cdc	96	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x8001ae62	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x80011d3c	438	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x80009ab4	404	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wordcopy_bwd_aligned	.symtab	0x80012c0c	638	FUNC	<unknown>	DEFAULT	2
_wordcopy_bwd_dest_aligned	.symtab	0x80012e8a	578	FUNC	<unknown>	DEFAULT	2
_wordcopy_fwd_aligned	.symtab	0x8000b074	566	FUNC	<unknown>	DEFAULT	2
_wordcopy_fwd_dest_aligned	.symtab	0x8000b2aa	500	FUNC	<unknown>	DEFAULT	2
abort	.symtab	0x80015794	390	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
accept	.symtab	0x8000e8f0	50	FUNC	<unknown>	DEFAULT	2
accept.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
actualparent	.symtab	0x80025580	4	OBJECT	<unknown>	DEFAULT	10
addrconfig	.symtab	0x8000d268	164	FUNC	<unknown>	DEFAULT	2
advance_telstate	.symtab	0x80004260	84	FUNC	<unknown>	DEFAULT	2
advances	.symtab	0x8001ea6c	28	OBJECT	<unknown>	DEFAULT	9
advances2	.symtab	0x8001eacc	44	OBJECT	<unknown>	DEFAULT	9
ak47scan	.symtab	0x80005776	190	FUNC	<unknown>	DEFAULT	2
ak47scantoggle	.symtab	0x80005834	368	FUNC	<unknown>	DEFAULT	2
ak47telscan	.symtab	0x80004300	5238	FUNC	<unknown>	DEFAULT	2
append	.symtab	0x80006052	48	FUNC	<unknown>	DEFAULT	2
asprintf	.symtab	0x80008604	48	FUNC	<unknown>	DEFAULT	2
asprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x8000fe68	28	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x8000fe68	28	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x8000be1c	30	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x80025464	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.2790	.symtab	0x80025420	4	OBJECT	<unknown>	DEFAULT	10
bind	.symtab	0x8000e924	48	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
blacknurse	.symtab	0x800013ce	784	FUNC	<unknown>	DEFAULT	2
botkill	.symtab	0x800059a4	134	FUNC	<unknown>	DEFAULT	2
brk	.symtab	0x80015948	64	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x800155c8	238	FUNC	<unknown>	DEFAULT	2
buf.2603	.symtab	0x800253e0	16	OBJECT	<unknown>	DEFAULT	10
c	.symtab	0x8001eb08	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x80017046	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x800000f6	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x8000013c	0	FUNC	<unknown>	DEFAULT	2
capsaicin2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chan	.symtab	0x800266a4	4	OBJECT	<unknown>	DEFAULT	10
changeservers	.symtab	0x8001efa0	4	OBJECT	<unknown>	DEFAULT	10
chdir	.symtab	0x80007cba	16	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x80011050	78	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x80007ccc	60	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.2170	.symtab	0x8001ef80	1	OBJECT	<unknown>	DEFAULT	10
con	.symtab	0x80006fac	648	FUNC	<unknown>	DEFAULT	2
connect	.symtab	0x8000e954	48	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
contains_fail	.symtab	0x800040ae	26	FUNC	<unknown>	DEFAULT	2
contains_response	.symtab	0x800040c8	56	FUNC	<unknown>	DEFAULT	2
contains_string	.symtab	0x80004026	110	FUNC	<unknown>	DEFAULT	2
contains_success	.symtab	0x80004094	26	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x8001132a	30	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x8000017c	144	FUNC	<unknown>	DEFAULT	2
data_start	.symtab	0x8001e210	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
disable	.symtab	0x80000faa	268	FUNC	<unknown>	DEFAULT	2
disabled	.symtab	0x8001efa4	1	OBJECT	<unknown>	DEFAULT	10
dispass	.symtab	0x8002546c	256	OBJECT	<unknown>	DEFAULT	10
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dns	.symtab	0x80003312	602	FUNC	<unknown>	DEFAULT	2
dns_format	.symtab	0x80002cd2	170	FUNC	<unknown>	DEFAULT	2
dns_hdr_create	.symtab	0x80002d7c	104	FUNC	<unknown>	DEFAULT	2
dns_send	.symtab	0x80002de4	954	FUNC	<unknown>	DEFAULT	2
dnsflood	.symtab	0x8000319e	372	FUNC	<unknown>	DEFAULT	2
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
download	.symtab	0x80000978	1004	FUNC	<unknown>	DEFAULT	2
dup2	.symtab	0x800110a0	72	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
enable	.symtab	0x800010b6	218	FUNC	<unknown>	DEFAULT	2
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
endservent	.symtab	0x80013944	108	FUNC	<unknown>	DEFAULT	2
environ	.symtab	0x80025410	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x80025424	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execfile	.symtab	0x8002558c	256	OBJECT	<unknown>	DEFAULT	10
execl	.symtab	0x80010178	178	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x800110e8	84	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x800100fc	124	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x8001c104	108	OBJECT	<unknown>	DEFAULT	4
fails	.symtab	0x8001ea88	36	OBJECT	<unknown>	DEFAULT	9
fastflux	.symtab	0x800061fa	420	FUNC	<unknown>	DEFAULT	2
fclose	.symtab	0x800082f0	416	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x80007b30	188	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x80007c44	54	FUNC	<unknown>	DEFAULT	2
fdopen	.symtab	0x800116b8	78	FUNC	<unknown>	DEFAULT	2
fdopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
feof	.symtab	0x8000a740	126	FUNC	<unknown>	DEFAULT	2
feof.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fflush_unlocked	.symtab	0x8000ab16	510	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x800128bc	500	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x8000a7c0	134	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x8000ad14	226	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
filter	.symtab	0x80000476	88	FUNC	<unknown>	DEFAULT	2
fix_errno	.symtab	0x80010fac	0	NOTYPE	<unknown>	DEFAULT	2
flooders	.symtab	0x8001eb18	176	OBJECT	<unknown>	DEFAULT	9
fmt	.symtab	0x8001c0f0	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x80008490	38	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x80007d08	56	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fprintf	.symtab	0x800085d4	48	FUNC	<unknown>	DEFAULT	2
fprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputc	.symtab	0x8000a848	284	FUNC	<unknown>	DEFAULT	2
fputc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputc_unlocked	.symtab	0x8000adf8	392	FUNC	<unknown>	DEFAULT	2
fputc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs	.symtab	0x8000a964	124	FUNC	<unknown>	DEFAULT	2
fputs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x8000af80	80	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x800000fe	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x8000ef4a	32	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
freeaddrinfo	.symtab	0x8000d30c	44	FUNC	<unknown>	DEFAULT	2
fseek	.symtab	0x800159e8	40	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x800159e8	40	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x80015a98	346	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x8000afd0	162	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gaih	.symtab	0x8001b9bc	24	OBJECT	<unknown>	DEFAULT	4
gaih_inet	.symtab	0x8000c216	4178	FUNC	<unknown>	DEFAULT	2
gaih_inet_serv	.symtab	0x8000c120	246	FUNC	<unknown>	DEFAULT	2
gaih_inet_typeproto	.symtab	0x8001b9d4	35	OBJECT	<unknown>	DEFAULT	4
get	.symtab	0x80000d64	252	FUNC	<unknown>	DEFAULT	2
getBuild	.symtab	0x8000016c	16	FUNC	<unknown>	DEFAULT	2
getDatIP	.symtab	0x80003a96	1126	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x80001dcc	56	FUNC	<unknown>	DEFAULT	2
getPublicIP	.symtab	0x8000611c	136	FUNC	<unknown>	DEFAULT	2
get_hosts_byaddr_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_telstate_host	.symtab	0x8000423c	36	FUNC	<unknown>	DEFAULT	2
getaddrinfo	.symtab	0x8000d338	764	FUNC	<unknown>	DEFAULT	2
getaddrinfo.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x800128bc	500	FUNC	<unknown>	DEFAULT	2
getcwd	.symtab	0x80007d40	298	FUNC	<unknown>	DEFAULT	2
getcwd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x80007e6c	52	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x8001113c	60	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x80011178	60	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x800111b4	60	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyaddr_r	.symtab	0x8000e3fc	1268	FUNC	<unknown>	DEFAULT	2
gethostbyaddr_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x8000e01c	990	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x80015010	1164	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getmyip	.symtab	0x800061a4	86	FUNC	<unknown>	DEFAULT	2
getpagesize	.symtab	0x80007ea0	42	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x80007ecc	56	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x80007f04	56	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x80007f3c	90	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getservbyname	.symtab	0x80013c60	60	FUNC	<unknown>	DEFAULT	2
getservbyname_r	.symtab	0x80013b4c	276	FUNC	<unknown>	DEFAULT	2
getservbyport	.symtab	0x80013b10	60	FUNC	<unknown>	DEFAULT	2
getservbyport_r	.symtab	0x80013a3c	212	FUNC	<unknown>	DEFAULT	2
getservent	.symtab	0x80013910	52	FUNC	<unknown>	DEFAULT	2
getservent_r	.symtab	0x80013632	734	FUNC	<unknown>	DEFAULT	2
getservice.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x8000e984	66	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x800111f0	60	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x80025428	4	OBJECT	<unknown>	DEFAULT	10
have_current_got	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
have_current_got	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
have_current_got	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
head	.symtab	0x80026694	4	OBJECT	<unknown>	DEFAULT	10
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_alloc_at.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
help	.symtab	0x80005aba	1114	FUNC	<unknown>	DEFAULT	2
histClear	.symtab	0x800060f6	38	FUNC	<unknown>	DEFAULT	2
hold	.symtab	0x80002c0c	198	FUNC	<unknown>	DEFAULT	2
host2ip	.symtab	0x80001190	150	FUNC	<unknown>	DEFAULT	2
htonl	.symtab	0x8000c0e2	12	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x8000c0ee	22	FUNC	<unknown>	DEFAULT	2
i.5393	.symtab	0x8001f3b2	4	OBJECT	<unknown>	DEFAULT	10
i.5435	.symtab	0x8001eb0c	4	OBJECT	<unknown>	DEFAULT	9
ident	.symtab	0x80025570	4	OBJECT	<unknown>	DEFAULT	10
identd	.symtab	0x80000574	614	FUNC	<unknown>	DEFAULT	2
if_freenameindex	.symtab	0x80014048	72	FUNC	<unknown>	DEFAULT	2
if_index.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
if_indextoname	.symtab	0x80013c9c	170	FUNC	<unknown>	DEFAULT	2
if_nameindex	.symtab	0x80013de0	616	FUNC	<unknown>	DEFAULT	2
if_nametoindex	.symtab	0x80013d46	154	FUNC	<unknown>	DEFAULT	2
in6_addr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
in6addr_any	.symtab	0x8001ba1c	16	OBJECT	<unknown>	DEFAULT	4
in6addr_loopback	.symtab	0x8001ba2c	16	OBJECT	<unknown>	DEFAULT	4
in_cksum	.symtab	0x80000824	164	FUNC	<unknown>	DEFAULT	2
index	.symtab	0x80013380	390	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x8000dfec	48	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x80014090	362	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x8000dfcc	30	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x8000df2c	160	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x8000deba	112	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x8000da28	464	FUNC	<unknown>	DEFAULT	2
inet_ntop6	.symtab	0x8000dbf8	706	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x8000d9c8	96	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x8000d634	282	FUNC	<unknown>	DEFAULT	2
inet_pton6	.symtab	0x8000d74e	634	FUNC	<unknown>	DEFAULT	2
infected	.symtab	0x8001eb00	8	OBJECT	<unknown>	DEFAULT	9
init_rand	.symtab	0x80001226	144	FUNC	<unknown>	DEFAULT	2
initial_fa	.symtab	0x8001ed50	260	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x8000f68a	118	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x8000fb9e	330	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x80007f98	130	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x8000bfd4	52	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ismaster	.symtab	0x80006082	116	FUNC	<unknown>	DEFAULT	2
junk	.symtab	0x8000263a	198	FUNC	<unknown>	DEFAULT	2
key	.symtab	0x8002669c	4	OBJECT	<unknown>	DEFAULT	10
kill	.symtab	0x80008064	20	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killall	.symtab	0x80005f14	208	FUNC	<unknown>	DEFAULT	2
killd	.symtab	0x80005fe4	110	FUNC	<unknown>	DEFAULT	2
knownBots	.symtab	0x8001e234	776	OBJECT	<unknown>	DEFAULT	9
legit	.symtab	0x8001eaf8	8	OBJECT	<unknown>	DEFAULT	9
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/m68k/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/m68k/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/m68k/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/m68k/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
limiter	.symtab	0x80025574	4	OBJECT	<unknown>	DEFAULT	10
listFork	.symtab	0x80001a30	188	FUNC	<unknown>	DEFAULT	2
listen	.symtab	0x8000e9c8	42	FUNC	<unknown>	DEFAULT	2
listen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x80016dda	108	FUNC	<unknown>	DEFAULT	2
main	.symtab	0x8000732a	2054	FUNC	<unknown>	DEFAULT	2
makeFukdString	.symtab	0x80007234	146	FUNC	<unknown>	DEFAULT	2
makeRandomShit	.symtab	0x800016de	136	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x8000ecf2	168	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
masters	.symtab	0x8001e224	12	OBJECT	<unknown>	DEFAULT	9
memchr	.symtab	0x80012ab0	348	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x8000b49e	240	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x800130cc	288	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x800131ec	42	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x80013218	358	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x8000b590	310	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mfork	.symtab	0x80000388	238	FUNC	<unknown>	DEFAULT	2
move	.symtab	0x80005a5c	94	FUNC	<unknown>	DEFAULT	2
msgs	.symtab	0x8001ebc8	64	OBJECT	<unknown>	DEFAULT	9
mygethostbyname	.symtab	0x800008c8	176	FUNC	<unknown>	DEFAULT	2
mylock	.symtab	0x800233b8	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x8001ee54	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x8001ef34	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x80025448	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x8001ef68	24	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x8001122c	78	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
negotiate	.symtab	0x80003efc	298	FUNC	<unknown>	DEFAULT	2
next_start.1067	.symtab	0x800253dc	4	OBJECT	<unknown>	DEFAULT	10
nick	.symtab	0x80025578	4	OBJECT	<unknown>	DEFAULT	10
nickc	.symtab	0x80000e80	136	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x8000c0c0	12	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x8000c0cc	22	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
nummasters	.symtab	0x8001e220	4	OBJECT	<unknown>	DEFAULT	9
numpids	.symtab	0x8001efae	4	OBJECT	<unknown>	DEFAULT	10
numservers	.symtab	0x8001e214	4	OBJECT	<unknown>	DEFAULT	9
object.2251	.symtab	0x8001ef82	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x800112da	80	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opensock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
p.2168	.symtab	0x8001e20c	0	OBJECT	<unknown>	DEFAULT	9
passwords	.symtab	0x8001e81c	592	OBJECT	<unknown>	DEFAULT	9
pclose	.symtab	0x800087d0	270	FUNC	<unknown>	DEFAULT	2
perror	.symtab	0x800084b8	74	FUNC	<unknown>	DEFAULT	2
perror.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pid	.symtab	0x8002556c	4	OBJECT	<unknown>	DEFAULT	10
pids	.symtab	0x800266a8	4	OBJECT	<unknown>	DEFAULT	10
pipe	.symtab	0x80011348	62	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
poll	.symtab	0x80008078	88	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
popen	.symtab	0x800088de	560	FUNC	<unknown>	DEFAULT	2
popen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
popen_list	.symtab	0x800233d0	4	OBJECT	<unknown>	DEFAULT	10
poww	.symtab	0x800007da	74	FUNC	<unknown>	DEFAULT	2
pps	.symtab	0x8002568c	4	OBJECT	<unknown>	DEFAULT	10
prefix.4042	.symtab	0x8001adc3	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x800037be	688	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x8000356c	68	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x80003686	312	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x800035b0	214	FUNC	<unknown>	DEFAULT	2
putc	.symtab	0x8000a848	284	FUNC	<unknown>	DEFAULT	2
putc_unlocked	.symtab	0x8000adf8	392	FUNC	<unknown>	DEFAULT	2
puts	.symtab	0x80008504	172	FUNC	<unknown>	DEFAULT	2
puts.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
qual_chars.4045	.symtab	0x8001add6	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x80016d5c	28	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x8000f5a8	14	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x800012b6	280	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x8000f5b8	94	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x8001ba66	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x8000f8ee	266	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randstring	.symtab	0x800004ce	166	FUNC	<unknown>	DEFAULT	2
randtbl	.symtab	0x8001ee88	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x80015f88	274	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x80016e48	84	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_until_response	.symtab	0x800041b4	136	FUNC	<unknown>	DEFAULT	2
read_with_timeout	.symtab	0x80004100	180	FUNC	<unknown>	DEFAULT	2
realloc	.symtab	0x8000ef6c	408	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realrand	.symtab	0x80000f08	70	FUNC	<unknown>	DEFAULT	2
recv	.symtab	0x8000e9f4	56	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rekdevice	.symtab	0x8001e230	4	OBJECT	<unknown>	DEFAULT	9
reset_telstate	.symtab	0x800042b4	32	FUNC	<unknown>	DEFAULT	2
rewind	.symtab	0x80015a10	134	FUNC	<unknown>	DEFAULT	2
rewind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rnd	.symtab	0x800266a0	4	OBJECT	<unknown>	DEFAULT	10
rndnick	.symtab	0x80000f4e	92	FUNC	<unknown>	DEFAULT	2
rseed	.symtab	0x80025694	4096	OBJECT	<unknown>	DEFAULT	10
rsi	.symtab	0x80025584	4	OBJECT	<unknown>	DEFAULT	10
sbrk	.symtab	0x80011388	106	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x8001ef9c	4	OBJECT	<unknown>	DEFAULT	10
sclose	.symtab	0x800042d4	44	FUNC	<unknown>	DEFAULT	2
select	.symtab	0x800080d0	100	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x8000ea2c	56	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendHOLD	.symtab	0x80002700	1292	FUNC	<unknown>	DEFAULT	2
sendHTTP	.symtab	0x80001ec6	376	FUNC	<unknown>	DEFAULT	2
sendJUNK	.symtab	0x80002150	1258	FUNC	<unknown>	DEFAULT	2
sendSTD	.symtab	0x80001aec	736	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x8000ea64	70	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
serv	.symtab	0x80025434	16	OBJECT	<unknown>	DEFAULT	10
serv_stayopen	.symtab	0x80025444	4	OBJECT	<unknown>	DEFAULT	10
servbuf	.symtab	0x8002542c	4	OBJECT	<unknown>	DEFAULT	10
server	.symtab	0x80025690	4	OBJECT	<unknown>	DEFAULT	10
servers	.symtab	0x8001e218	8	OBJECT	<unknown>	DEFAULT	9
servf	.symtab	0x80025430	4	OBJECT	<unknown>	DEFAULT	10
setservent	.symtab	0x800139b0	140	FUNC	<unknown>	DEFAULT	2
setsid	.symtab	0x80008134	56	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x8000eaac	64	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x8000f616	116	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x8000f758	406	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x800154e0	232	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x800155c8	238	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x800113f4	160	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x8001022c	558	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleeptime	.symtab	0x8001eb10	4	OBJECT	<unknown>	DEFAULT	9
sock	.symtab	0x8002557c	4	OBJECT	<unknown>	DEFAULT	10
socket	.symtab	0x8000eaec	50	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x80001e04	194	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4044	.symtab	0x8001adea	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4041	.symtab	0x8001adcf	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4041	.symtab	0x8001ae13	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4040	.symtab	0x8001ae28	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4043	.symtab	0x8001adfa	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4042	.symtab	0x8001ae0a	9	OBJECT	<unknown>	DEFAULT	4
spoofs	.symtab	0x8001efa6	4	OBJECT	<unknown>	DEFAULT	10
spoofsm	.symtab	0x8001efaa	4	OBJECT	<unknown>	DEFAULT	10
sprintf	.symtab	0x80008634	52	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x8000f700	88	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x8000f700	88	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x8000f9f8	422	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x8001ef4c	2	OBJECT	<unknown>	DEFAULT	9
static_ns	.symtab	0x80025460	4	OBJECT	<unknown>	DEFAULT	10
stderr	.symtab	0x8001ec18	4	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x8001ec10	4	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x8001ec14	4	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x8000be3c	120	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcasestr	.symtab	0x8000beb4	170	FUNC	<unknown>	DEFAULT	2
strcasestr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x80013380	390	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x8000b6c8	110	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x8000b6c8	110	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x8000b738	92	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x8000bf60	80	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x8000bd14	264	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x8000b794	268	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncat	.symtab	0x8001609c	310	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncmp	.symtab	0x8000b8a0	430	FUNC	<unknown>	DEFAULT	2
strncmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x8000ba50	320	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x8000bb90	350	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x800135a4	86	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x800161d4	104	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x8000bfb0	36	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x80013508	154	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x8000fe84	34	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoul	.symtab	0x8000fea8	32	FUNC	<unknown>	DEFAULT	2
strtoul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strwildmatch	.symtab	0x8000020c	302	FUNC	<unknown>	DEFAULT	2
successes	.symtab	0x8001eaac	32	OBJECT	<unknown>	DEFAULT	9
sysconf	.symtab	0x8001045c	1782	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
system	.symtab	0x8000fce8	382	FUNC	<unknown>	DEFAULT	2
system.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x80003a6e	40	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x8000c008	182	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tehport	.symtab	0x80026698	4	OBJECT	<unknown>	DEFAULT	10
textBuffer.4875	.symtab	0x8001efb2	1024	OBJECT	<unknown>	DEFAULT	10
thanks	.symtab	0x8001eb14	4	OBJECT	<unknown>	DEFAULT	9
time	.symtab	0x8000816c	62	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x8001150c	64	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
touchMyself	.symtab	0x800072c6	100	FUNC	<unknown>	DEFAULT	2
toupper	.symtab	0x800082a0	64	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
type_codes	.symtab	0x8001ae30	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x8001ae48	12	OBJECT	<unknown>	DEFAULT	4
umask	.symtab	0x80008204	36	FUNC	<unknown>	DEFAULT	2
umask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown	.symtab	0x80001766	714	FUNC	<unknown>	DEFAULT	2
unknown.1089	.symtab	0x8001ae54	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x8001ee6c	28	OBJECT	<unknown>	DEFAULT	9
user	.symtab	0x80025588	4	OBJECT	<unknown>	DEFAULT	10
usernames	.symtab	0x8001e5cc	592	OBJECT	<unknown>	DEFAULT	9
usleep	.symtab	0x80010b54	142	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vasprintf	.symtab	0x80008668	158	FUNC	<unknown>	DEFAULT	2
vasprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
version	.symtab	0x80000e60	32	FUNC	<unknown>	DEFAULT	2
vfork	.symtab	0x80010f94	38	FUNC	<unknown>	DEFAULT	2
vfprintf	.symtab	0x800090c4	182	FUNC	<unknown>	DEFAULT	2
vfprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vsnprintf	.symtab	0x80008708	198	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vsprintf	.symtab	0x800085b0	34	FUNC	<unknown>	DEFAULT	2
vsprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x800114ee	30	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x80008228	34	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x8001155c	100	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x800115e8	206	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x800115c0	38	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x8000824c	84	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3095	.symtab	0x8001ba0b	17	OBJECT	<unknown>	DEFAULT	4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 14:51:58.858434916 CET	48202	443	192.168.2.13	185.125.190.26
Dec 28, 2024 14:52:29.578473091 CET	48202	443	192.168.2.13	185.125.190.26

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 14:51:45.343996048 CET	54687	53	192.168.2.13	8.8.8.8
Dec 28, 2024 14:51:45.849608898 CET	53	54687	8.8.8.8	192.168.2.13
Dec 28, 2024 14:51:47.409998894 CET	56376	53	192.168.2.13	8.8.8.8
Dec 28, 2024 14:51:47.410068035 CET	57750	53	192.168.2.13	8.8.8.8
Dec 28, 2024 14:51:47.532701969 CET	53	56376	8.8.8.8	192.168.2.13
Dec 28, 2024 14:51:47.532727003 CET	53	57750	8.8.8.8	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 28, 2024 14:51:45.343996048 CET	192.168.2.13	8.8.8.8	0xeb10	Standard query (0)	pirati.privatedns.org	A (IP address)	IN (0x0001)	false
Dec 28, 2024 14:51:47.409998894 CET	192.168.2.13	8.8.8.8	0x57a0	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 14:51:47.410068035 CET	192.168.2.13	8.8.8.8	0xe7f0	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 28, 2024 14:51:45.849608898 CET	8.8.8.8	192.168.2.13	0xeb10	No error (0)	pirati.privatedns.org	79.12.214.240	A (IP address)	IN (0x0001)	false
Dec 28, 2024 14:51:47.532701969 CET	8.8.8.8	192.168.2.13	0x57a0	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Dec 28, 2024 14:51:47.532701969 CET	8.8.8.8	192.168.2.13	0x57a0	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: yakuza.m68k.elf PID: 5430, Parent PID: 5357

General

Start time (UTC):	13:51:44
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	/tmp/yakuza.m68k.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 5432, Parent PID: 5430

General

Start time (UTC):	13:51:44
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 5438, Parent PID: 5432

General

Start time (UTC):	13:51:44
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 5439, Parent PID: 5432

General

Start time (UTC):	13:51:44
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 5440, Parent PID: 5432

General

Start time (UTC):	13:51:44
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 5440, Parent PID: 5432

General

Start time (UTC):	13:51:44
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 902i13 \|\| busybox pkill -9 902i13"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5445, Parent PID: 5440

General

Start time (UTC):	13:51:44
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5445, Parent PID: 5440

General

Start time (UTC):	13:51:44
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 902i13
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5472, Parent PID: 5440

General

Start time (UTC):	13:51:46
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5472, Parent PID: 5440

General

Start time (UTC):	13:51:46
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 902i13
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 5475, Parent PID: 5432

General

Start time (UTC):	13:51:47
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 5475, Parent PID: 5432

General

Start time (UTC):	13:51:47
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 BzSxLxBxeY \|\| busybox pkill -9 BzSxLxBxeY"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5480, Parent PID: 5475

General

Start time (UTC):	13:51:48
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5480, Parent PID: 5475

General

Start time (UTC):	13:51:48
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 BzSxLxBxeY
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5481, Parent PID: 5475

General

Start time (UTC):	13:51:49
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5481, Parent PID: 5475

General

Start time (UTC):	13:51:49
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 BzSxLxBxeY
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 5482, Parent PID: 5432

General

Start time (UTC):	13:51:50
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 5482, Parent PID: 5432

General

Start time (UTC):	13:51:50
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 HOHO-LUGO7 \|\| busybox pkill -9 HOHO-LUGO7"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5487, Parent PID: 5482

General

Start time (UTC):	13:51:50
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5487, Parent PID: 5482

General

Start time (UTC):	13:51:50
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 HOHO-LUGO7
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5488, Parent PID: 5482

General

Start time (UTC):	13:51:52
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5488, Parent PID: 5482

General

Start time (UTC):	13:51:52
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 HOHO-LUGO7
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 5491, Parent PID: 5432

General

Start time (UTC):	13:51:53
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 5491, Parent PID: 5432

General

Start time (UTC):	13:51:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 HOHO-U79OL \|\| busybox pkill -9 HOHO-U79OL"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5493, Parent PID: 5491

General

Start time (UTC):	13:51:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5493, Parent PID: 5491

General

Start time (UTC):	13:51:53
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 HOHO-U79OL
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5494, Parent PID: 5491

General

Start time (UTC):	13:51:54
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5494, Parent PID: 5491

General

Start time (UTC):	13:51:54
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 HOHO-U79OL
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 5495, Parent PID: 5432

General

Start time (UTC):	13:51:55
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 5495, Parent PID: 5432

General

Start time (UTC):	13:51:55
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 JuYfouyf87 \|\| busybox pkill -9 JuYfouyf87"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5500, Parent PID: 5495

General

Start time (UTC):	13:51:55
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5500, Parent PID: 5495

General

Start time (UTC):	13:51:55
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 JuYfouyf87
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5501, Parent PID: 5495

General

Start time (UTC):	13:51:56
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5501, Parent PID: 5495

General

Start time (UTC):	13:51:56
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 JuYfouyf87
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 5504, Parent PID: 5432

General

Start time (UTC):	13:51:57
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 5504, Parent PID: 5432

General

Start time (UTC):	13:51:57
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5506, Parent PID: 5504

General

Start time (UTC):	13:51:57
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5506, Parent PID: 5504

General

Start time (UTC):	13:51:57
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeR69xd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5507, Parent PID: 5504

General

Start time (UTC):	13:51:58
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5507, Parent PID: 5504

General

Start time (UTC):	13:51:58
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeR69xd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 5514, Parent PID: 5432

General

Start time (UTC):	13:51:59
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 5514, Parent PID: 5432

General

Start time (UTC):	13:51:59
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5520, Parent PID: 5514

General

Start time (UTC):	13:51:59
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5520, Parent PID: 5514

General

Start time (UTC):	13:51:59
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SO190Ij1X
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5521, Parent PID: 5514

General

Start time (UTC):	13:52:00
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5521, Parent PID: 5514

General

Start time (UTC):	13:52:00
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SO190Ij1X
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 5522, Parent PID: 5432

General

Start time (UTC):	13:52:01
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 5522, Parent PID: 5432

General

Start time (UTC):	13:52:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 LOLKIKEEEDDE \|\| busybox pkill -9 LOLKIKEEEDDE"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5524, Parent PID: 5522

General

Start time (UTC):	13:52:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5524, Parent PID: 5522

General

Start time (UTC):	13:52:01
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 LOLKIKEEEDDE
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5527, Parent PID: 5522

General

Start time (UTC):	13:52:02
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5527, Parent PID: 5522

General

Start time (UTC):	13:52:02
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 LOLKIKEEEDDE
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 5528, Parent PID: 5432

General

Start time (UTC):	13:52:03
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 5528, Parent PID: 5432

General

Start time (UTC):	13:52:03
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ekjheory98e \|\| busybox pkill -9 ekjheory98e"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5533, Parent PID: 5528

General

Start time (UTC):	13:52:03
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5533, Parent PID: 5528

General

Start time (UTC):	13:52:03
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ekjheory98e
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5534, Parent PID: 5528

General

Start time (UTC):	13:52:04
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5534, Parent PID: 5528

General

Start time (UTC):	13:52:04
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ekjheory98e
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 5535, Parent PID: 5432

General

Start time (UTC):	13:52:05
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 5535, Parent PID: 5432

General

Start time (UTC):	13:52:05
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scansh4 \|\| busybox pkill -9 scansh4"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5540, Parent PID: 5535

General

Start time (UTC):	13:52:05
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5540, Parent PID: 5535

General

Start time (UTC):	13:52:05
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 scansh4
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5557, Parent PID: 5535

General

Start time (UTC):	13:52:06
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5557, Parent PID: 5535

General

Start time (UTC):	13:52:06
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scansh4
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 5560, Parent PID: 5432

General

Start time (UTC):	13:52:07
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 5560, Parent PID: 5432

General

Start time (UTC):	13:52:07
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MDMA \|\| busybox pkill -9 MDMA"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5565, Parent PID: 5560

General

Start time (UTC):	13:52:07
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5565, Parent PID: 5560

General

Start time (UTC):	13:52:07
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MDMA
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5566, Parent PID: 5560

General

Start time (UTC):	13:52:09
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5566, Parent PID: 5560

General

Start time (UTC):	13:52:09
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MDMA
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 5567, Parent PID: 5432

General

Start time (UTC):	13:52:10
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 5567, Parent PID: 5432

General

Start time (UTC):	13:52:10
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 fdevalvex \|\| busybox pkill -9 fdevalvex"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5572, Parent PID: 5567

General

Start time (UTC):	13:52:10
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5572, Parent PID: 5567

General

Start time (UTC):	13:52:10
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 fdevalvex
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5573, Parent PID: 5567

General

Start time (UTC):	13:52:11
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5573, Parent PID: 5567

General

Start time (UTC):	13:52:11
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 fdevalvex
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 5574, Parent PID: 5432

General

Start time (UTC):	13:52:12
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 5574, Parent PID: 5432

General

Start time (UTC):	13:52:12
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scanspc \|\| busybox pkill -9 scanspc"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5579, Parent PID: 5574

General

Start time (UTC):	13:52:12
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5579, Parent PID: 5574

General

Start time (UTC):	13:52:12
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 scanspc
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5582, Parent PID: 5574

General

Start time (UTC):	13:52:13
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5582, Parent PID: 5574

General

Start time (UTC):	13:52:13
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scanspc
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 5584, Parent PID: 5432

General

Start time (UTC):	13:52:14
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 5584, Parent PID: 5432

General

Start time (UTC):	13:52:14
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MELTEDNINJAREALZ \|\| busybox pkill -9 MELTEDNINJAREALZ"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5590, Parent PID: 5584

General

Start time (UTC):	13:52:14
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5590, Parent PID: 5584

General

Start time (UTC):	13:52:14
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MELTEDNINJAREALZ
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5591, Parent PID: 5584

General

Start time (UTC):	13:52:15
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5591, Parent PID: 5584

General

Start time (UTC):	13:52:15
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MELTEDNINJAREALZ
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 5592, Parent PID: 5432

General

Start time (UTC):	13:52:16
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 5592, Parent PID: 5432

General

Start time (UTC):	13:52:16
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 flexsonskids \|\| busybox pkill -9 flexsonskids"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5597, Parent PID: 5592

General

Start time (UTC):	13:52:16
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5597, Parent PID: 5592

General

Start time (UTC):	13:52:16
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 flexsonskids
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5600, Parent PID: 5592

General

Start time (UTC):	13:52:17
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5600, Parent PID: 5592

General

Start time (UTC):	13:52:17
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 flexsonskids
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5601, Parent PID: 5432

General

Start time (UTC):	13:52:18
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5601, Parent PID: 5432

General

Start time (UTC):	13:52:18
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scanx86 \|\| busybox pkill -9 scanx86"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5605, Parent PID: 5601

General

Start time (UTC):	13:52:18
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5605, Parent PID: 5601

General

Start time (UTC):	13:52:18
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 scanx86
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5607, Parent PID: 5601

General

Start time (UTC):	13:52:19
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5607, Parent PID: 5601

General

Start time (UTC):	13:52:19
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scanx86
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5608, Parent PID: 5432

General

Start time (UTC):	13:52:20
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5608, Parent PID: 5432

General

Start time (UTC):	13:52:20
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MISAKI-U79OL \|\| busybox pkill -9 MISAKI-U79OL"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5610, Parent PID: 5608

General

Start time (UTC):	13:52:20
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5610, Parent PID: 5608

General

Start time (UTC):	13:52:20
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MISAKI-U79OL
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5611, Parent PID: 5608

General

Start time (UTC):	13:52:22
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5611, Parent PID: 5608

General

Start time (UTC):	13:52:22
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MISAKI-U79OL
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5614, Parent PID: 5432

General

Start time (UTC):	13:52:23
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5614, Parent PID: 5432

General

Start time (UTC):	13:52:23
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 foAxi102kxe \|\| busybox pkill -9 foAxi102kxe"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5616, Parent PID: 5614

General

Start time (UTC):	13:52:23
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5616, Parent PID: 5614

General

Start time (UTC):	13:52:23
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 foAxi102kxe
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5617, Parent PID: 5614

General

Start time (UTC):	13:52:24
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5617, Parent PID: 5614

General

Start time (UTC):	13:52:24
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 foAxi102kxe
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5618, Parent PID: 5432

General

Start time (UTC):	13:52:25
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5618, Parent PID: 5432

General

Start time (UTC):	13:52:25
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 swodjwodjwoj \|\| busybox pkill -9 swodjwodjwoj"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5623, Parent PID: 5618

General

Start time (UTC):	13:52:25
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5623, Parent PID: 5618

General

Start time (UTC):	13:52:25
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 swodjwodjwoj
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5624, Parent PID: 5618

General

Start time (UTC):	13:52:26
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5624, Parent PID: 5618

General

Start time (UTC):	13:52:26
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 swodjwodjwoj
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5627, Parent PID: 5432

General

Start time (UTC):	13:52:27
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5627, Parent PID: 5432

General

Start time (UTC):	13:52:27
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MmKiy7f87l \|\| busybox pkill -9 MmKiy7f87l"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5631, Parent PID: 5627

General

Start time (UTC):	13:52:27
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5631, Parent PID: 5627

General

Start time (UTC):	13:52:27
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MmKiy7f87l
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5633, Parent PID: 5627

General

Start time (UTC):	13:52:28
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5633, Parent PID: 5627

General

Start time (UTC):	13:52:28
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MmKiy7f87l
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5634, Parent PID: 5432

General

Start time (UTC):	13:52:29
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5634, Parent PID: 5432

General

Start time (UTC):	13:52:29
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 freecookiex86 \|\| busybox pkill -9 freecookiex86"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5636, Parent PID: 5634

General

Start time (UTC):	13:52:29
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5636, Parent PID: 5634

General

Start time (UTC):	13:52:29
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 freecookiex86
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5637, Parent PID: 5634

General

Start time (UTC):	13:52:30
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5637, Parent PID: 5634

General

Start time (UTC):	13:52:30
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 freecookiex86
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5638, Parent PID: 5432

General

Start time (UTC):	13:52:31
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5638, Parent PID: 5432

General

Start time (UTC):	13:52:31
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 sysgpu \|\| busybox pkill -9 sysgpu"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5644, Parent PID: 5638

General

Start time (UTC):	13:52:31
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5644, Parent PID: 5638

General

Start time (UTC):	13:52:31
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 sysgpu
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5647, Parent PID: 5638

General

Start time (UTC):	13:52:32
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5647, Parent PID: 5638

General

Start time (UTC):	13:52:32
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 sysgpu
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5648, Parent PID: 5432

General

Start time (UTC):	13:52:33
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5648, Parent PID: 5432

General

Start time (UTC):	13:52:33
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5653, Parent PID: 5648

General

Start time (UTC):	13:52:33
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5653, Parent PID: 5648

General

Start time (UTC):	13:52:33
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeR69xd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5654, Parent PID: 5648

General

Start time (UTC):	13:52:35
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5654, Parent PID: 5648

General

Start time (UTC):	13:52:35
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeR69xd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5657, Parent PID: 5432

General

Start time (UTC):	13:52:36
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5657, Parent PID: 5432

General

Start time (UTC):	13:52:36
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 frgege \|\| busybox pkill -9 frgege"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5659, Parent PID: 5657

General

Start time (UTC):	13:52:36
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5659, Parent PID: 5657

General

Start time (UTC):	13:52:36
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 frgege
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5660, Parent PID: 5657

General

Start time (UTC):	13:52:37
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5660, Parent PID: 5657

General

Start time (UTC):	13:52:37
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 frgege
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5663, Parent PID: 5432

General

Start time (UTC):	13:52:38
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5663, Parent PID: 5432

General

Start time (UTC):	13:52:38
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 sysupdater \|\| busybox pkill -9 sysupdater"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5668, Parent PID: 5663

General

Start time (UTC):	13:52:38
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5668, Parent PID: 5663

General

Start time (UTC):	13:52:38
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 sysupdater
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5669, Parent PID: 5663

General

Start time (UTC):	13:52:39
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5669, Parent PID: 5663

General

Start time (UTC):	13:52:39
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 sysupdater
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5670, Parent PID: 5432

General

Start time (UTC):	13:52:40
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5670, Parent PID: 5432

General

Start time (UTC):	13:52:40
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 0DnAzepd \|\| busybox pkill -9 0DnAzepd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5672, Parent PID: 5670

General

Start time (UTC):	13:52:40
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5672, Parent PID: 5670

General

Start time (UTC):	13:52:40
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 0DnAzepd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5673, Parent PID: 5670

General

Start time (UTC):	13:52:41
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5673, Parent PID: 5670

General

Start time (UTC):	13:52:41
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 0DnAzepd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5676, Parent PID: 5432

General

Start time (UTC):	13:52:42
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5676, Parent PID: 5432

General

Start time (UTC):	13:52:42
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeRD0nks69 \|\| busybox pkill -9 NiGGeRD0nks69"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5681, Parent PID: 5676

General

Start time (UTC):	13:52:42
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5681, Parent PID: 5676

General

Start time (UTC):	13:52:42
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeRD0nks69
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5682, Parent PID: 5676

General

Start time (UTC):	13:52:43
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5682, Parent PID: 5676

General

Start time (UTC):	13:52:43
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeRD0nks69
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5684, Parent PID: 5432

General

Start time (UTC):	13:52:44
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5684, Parent PID: 5432

General

Start time (UTC):	13:52:44
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 frgreu \|\| busybox pkill -9 frgreu"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5690, Parent PID: 5684

General

Start time (UTC):	13:52:44
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5690, Parent PID: 5684

General

Start time (UTC):	13:52:44
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 frgreu
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5691, Parent PID: 5684

General

Start time (UTC):	13:52:45
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5691, Parent PID: 5684

General

Start time (UTC):	13:52:45
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 frgreu
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5692, Parent PID: 5432

General

Start time (UTC):	13:52:46
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5692, Parent PID: 5432

General

Start time (UTC):	13:52:46
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 telnetd \|\| busybox pkill -9 telnetd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5694, Parent PID: 5692

General

Start time (UTC):	13:52:46
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5694, Parent PID: 5692

General

Start time (UTC):	13:52:46
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 telnetd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5697, Parent PID: 5692

General

Start time (UTC):	13:52:47
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5697, Parent PID: 5692

General

Start time (UTC):	13:52:47
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 telnetd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5698, Parent PID: 5432

General

Start time (UTC):	13:52:48
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5698, Parent PID: 5432

General

Start time (UTC):	13:52:48
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 0x766f6964 \|\| busybox pkill -9 0x766f6964"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5700, Parent PID: 5698

General

Start time (UTC):	13:52:48
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5700, Parent PID: 5698

General

Start time (UTC):	13:52:48
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 0x766f6964
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5701, Parent PID: 5698

General

Start time (UTC):	13:52:49
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5701, Parent PID: 5698

General

Start time (UTC):	13:52:49
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 0x766f6964
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5702, Parent PID: 5432

General

Start time (UTC):	13:52:50
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5702, Parent PID: 5432

General

Start time (UTC):	13:52:50
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeRd0nks1337 \|\| busybox pkill -9 NiGGeRd0nks1337"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5707, Parent PID: 5702

General

Start time (UTC):	13:52:50
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5707, Parent PID: 5702

General

Start time (UTC):	13:52:50
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeRd0nks1337
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5708, Parent PID: 5702

General

Start time (UTC):	13:52:51
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5708, Parent PID: 5702

General

Start time (UTC):	13:52:51
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeRd0nks1337
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5711, Parent PID: 5432

General

Start time (UTC):	13:52:52
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5711, Parent PID: 5432

General

Start time (UTC):	13:52:52
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 gaft \|\| busybox pkill -9 gaft"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5716, Parent PID: 5711

General

Start time (UTC):	13:52:52
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5716, Parent PID: 5711

General

Start time (UTC):	13:52:52
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 gaft
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5717, Parent PID: 5711

General

Start time (UTC):	13:52:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5717, Parent PID: 5711

General

Start time (UTC):	13:52:53
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 gaft
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5718, Parent PID: 5432

General

Start time (UTC):	13:52:55
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5718, Parent PID: 5432

General

Start time (UTC):	13:52:55
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 urasgbsigboa \|\| busybox pkill -9 urasgbsigboa"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5723, Parent PID: 5718

General

Start time (UTC):	13:52:55
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5723, Parent PID: 5718

General

Start time (UTC):	13:52:55
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 urasgbsigboa
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5724, Parent PID: 5718

General

Start time (UTC):	13:52:56
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5724, Parent PID: 5718

General

Start time (UTC):	13:52:56
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 urasgbsigboa
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5725, Parent PID: 5432

General

Start time (UTC):	13:52:57
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5725, Parent PID: 5432

General

Start time (UTC):	13:52:57
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 120i3UI49 \|\| busybox pkill -9 120i3UI49"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5730, Parent PID: 5725

General

Start time (UTC):	13:52:57
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5730, Parent PID: 5725

General

Start time (UTC):	13:52:57
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 120i3UI49
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5733, Parent PID: 5725

General

Start time (UTC):	13:52:58
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5733, Parent PID: 5725

General

Start time (UTC):	13:52:58
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 120i3UI49
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5734, Parent PID: 5432

General

Start time (UTC):	13:52:59
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5734, Parent PID: 5432

General

Start time (UTC):	13:52:59
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 OaF3 \|\| busybox pkill -9 OaF3"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5739, Parent PID: 5734

General

Start time (UTC):	13:52:59
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5739, Parent PID: 5734

General

Start time (UTC):	13:52:59
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 OaF3
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5740, Parent PID: 5734

General

Start time (UTC):	13:53:00
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5740, Parent PID: 5734

General

Start time (UTC):	13:53:00
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 OaF3
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5741, Parent PID: 5432

General

Start time (UTC):	13:53:01
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5741, Parent PID: 5432

General

Start time (UTC):	13:53:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 geae \|\| busybox pkill -9 geae"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5747, Parent PID: 5741

General

Start time (UTC):	13:53:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5747, Parent PID: 5741

General

Start time (UTC):	13:53:01
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 geae
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5748, Parent PID: 5741

General

Start time (UTC):	13:53:02
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5748, Parent PID: 5741

General

Start time (UTC):	13:53:02
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 geae
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5751, Parent PID: 5432

General

Start time (UTC):	13:53:03
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5751, Parent PID: 5432

General

Start time (UTC):	13:53:03
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 vaiolmao \|\| busybox pkill -9 vaiolmao"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5756, Parent PID: 5751

General

Start time (UTC):	13:53:03
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5756, Parent PID: 5751

General

Start time (UTC):	13:53:03
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 vaiolmao
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5757, Parent PID: 5751

General

Start time (UTC):	13:53:04
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5757, Parent PID: 5751

General

Start time (UTC):	13:53:04
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 vaiolmao
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5758, Parent PID: 5432

General

Start time (UTC):	13:53:05
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5758, Parent PID: 5432

General

Start time (UTC):	13:53:05
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 123123a \|\| busybox pkill -9 123123a"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5763, Parent PID: 5758

General

Start time (UTC):	13:53:05
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5763, Parent PID: 5758

General

Start time (UTC):	13:53:05
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 123123a
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5764, Parent PID: 5758

General

Start time (UTC):	13:53:06
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5764, Parent PID: 5758

General

Start time (UTC):	13:53:06
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 123123a
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5767, Parent PID: 5432

General

Start time (UTC):	13:53:07
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5767, Parent PID: 5432

General

Start time (UTC):	13:53:07
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 Ofurain0n4H34D \|\| busybox pkill -9 Ofurain0n4H34D"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5772, Parent PID: 5767

General

Start time (UTC):	13:53:07
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5772, Parent PID: 5767

General

Start time (UTC):	13:53:07
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 Ofurain0n4H34D
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5773, Parent PID: 5767

General

Start time (UTC):	13:53:08
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5773, Parent PID: 5767

General

Start time (UTC):	13:53:08
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 Ofurain0n4H34D
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5774, Parent PID: 5432

General

Start time (UTC):	13:53:09
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5774, Parent PID: 5432

General

Start time (UTC):	13:53:09
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggTrex \|\| busybox pkill -9 ggTrex"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5779, Parent PID: 5774

General

Start time (UTC):	13:53:09
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5779, Parent PID: 5774

General

Start time (UTC):	13:53:09
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggTrex
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5780, Parent PID: 5774

General

Start time (UTC):	13:53:10
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5780, Parent PID: 5774

General

Start time (UTC):	13:53:10
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggTrex
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5781, Parent PID: 5432

General

Start time (UTC):	13:53:11
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5781, Parent PID: 5432

General

Start time (UTC):	13:53:11
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 wasads \|\| busybox pkill -9 wasads"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5783, Parent PID: 5781

General

Start time (UTC):	13:53:11
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5783, Parent PID: 5781

General

Start time (UTC):	13:53:11
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 wasads
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5786, Parent PID: 5781

General

Start time (UTC):	13:53:12
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5786, Parent PID: 5781

General

Start time (UTC):	13:53:12
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 wasads
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5787, Parent PID: 5432

General

Start time (UTC):	13:53:13
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5787, Parent PID: 5432

General

Start time (UTC):	13:53:13
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1293194hjXD \|\| busybox pkill -9 1293194hjXD"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5792, Parent PID: 5787

General

Start time (UTC):	13:53:13
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5792, Parent PID: 5787

General

Start time (UTC):	13:53:13
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1293194hjXD
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5794, Parent PID: 5787

General

Start time (UTC):	13:53:14
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5794, Parent PID: 5787

General

Start time (UTC):	13:53:14
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1293194hjXD
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5795, Parent PID: 5432

General

Start time (UTC):	13:53:15
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5795, Parent PID: 5432

General

Start time (UTC):	13:53:15
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 OthLaLosn \|\| busybox pkill -9 OthLaLosn"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5801, Parent PID: 5795

General

Start time (UTC):	13:53:15
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5801, Parent PID: 5795

General

Start time (UTC):	13:53:15
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 OthLaLosn
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5802, Parent PID: 5795

General

Start time (UTC):	13:53:16
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5802, Parent PID: 5795

General

Start time (UTC):	13:53:16
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 OthLaLosn
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5805, Parent PID: 5432

General

Start time (UTC):	13:53:17
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5805, Parent PID: 5432

General

Start time (UTC):	13:53:17
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggt \|\| busybox pkill -9 ggt"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5807, Parent PID: 5805

General

Start time (UTC):	13:53:17
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5807, Parent PID: 5805

General

Start time (UTC):	13:53:17
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggt
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5808, Parent PID: 5805

General

Start time (UTC):	13:53:18
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5808, Parent PID: 5805

General

Start time (UTC):	13:53:18
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggt
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5809, Parent PID: 5432

General

Start time (UTC):	13:53:19
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5809, Parent PID: 5432

General

Start time (UTC):	13:53:19
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 wget-log \|\| busybox pkill -9 wget-log"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5814, Parent PID: 5809

General

Start time (UTC):	13:53:19
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5814, Parent PID: 5809

General

Start time (UTC):	13:53:19
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 wget-log
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5815, Parent PID: 5809

General

Start time (UTC):	13:53:20
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5815, Parent PID: 5809

General

Start time (UTC):	13:53:20
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 wget-log
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5816, Parent PID: 5432

General

Start time (UTC):	13:53:21
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5816, Parent PID: 5432

General

Start time (UTC):	13:53:21
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1337SoraLOADER \|\| busybox pkill -9 1337SoraLOADER"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5818, Parent PID: 5816

General

Start time (UTC):	13:53:21
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5818, Parent PID: 5816

General

Start time (UTC):	13:53:21
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1337SoraLOADER
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5821, Parent PID: 5816

General

Start time (UTC):	13:53:22
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5821, Parent PID: 5816

General

Start time (UTC):	13:53:22
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1337SoraLOADER
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5822, Parent PID: 5432

General

Start time (UTC):	13:53:23
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5822, Parent PID: 5432

General

Start time (UTC):	13:53:23
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SAIAKINA \|\| busybox pkill -9 SAIAKINA"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5824, Parent PID: 5822

General

Start time (UTC):	13:53:23
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5824, Parent PID: 5822

General

Start time (UTC):	13:53:23
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SAIAKINA
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5825, Parent PID: 5822

General

Start time (UTC):	13:53:24
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5825, Parent PID: 5822

General

Start time (UTC):	13:53:24
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SAIAKINA
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5826, Parent PID: 5432

General

Start time (UTC):	13:53:25
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5826, Parent PID: 5432

General

Start time (UTC):	13:53:25
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggtq \|\| busybox pkill -9 ggtq"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5831, Parent PID: 5826

General

Start time (UTC):	13:53:25
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5831, Parent PID: 5826

General

Start time (UTC):	13:53:25
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggtq
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5832, Parent PID: 5826

General

Start time (UTC):	13:53:26
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5832, Parent PID: 5826

General

Start time (UTC):	13:53:26
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggtq
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5835, Parent PID: 5432

General

Start time (UTC):	13:53:27
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5835, Parent PID: 5432

General

Start time (UTC):	13:53:27
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1378bfp919GRB1Q2 \|\| busybox pkill -9 1378bfp919GRB1Q2"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5837, Parent PID: 5835

General

Start time (UTC):	13:53:27
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5837, Parent PID: 5835

General

Start time (UTC):	13:53:27
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1378bfp919GRB1Q2
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5838, Parent PID: 5835

General

Start time (UTC):	13:53:28
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5838, Parent PID: 5835

General

Start time (UTC):	13:53:28
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1378bfp919GRB1Q2
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5839, Parent PID: 5432

General

Start time (UTC):	13:53:29
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5839, Parent PID: 5432

General

Start time (UTC):	13:53:29
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SAIAKUSO \|\| busybox pkill -9 SAIAKUSO"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5841, Parent PID: 5839

General

Start time (UTC):	13:53:29
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5841, Parent PID: 5839

General

Start time (UTC):	13:53:29
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SAIAKUSO
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5843, Parent PID: 5839

General

Start time (UTC):	13:53:30
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5843, Parent PID: 5839

General

Start time (UTC):	13:53:30
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SAIAKUSO
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5844, Parent PID: 5432

General

Start time (UTC):	13:53:31
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5844, Parent PID: 5432

General

Start time (UTC):	13:53:31
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggtr \|\| busybox pkill -9 ggtr"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5850, Parent PID: 5844

General

Start time (UTC):	13:53:31
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5850, Parent PID: 5844

General

Start time (UTC):	13:53:31
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggtr
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5853, Parent PID: 5844

General

Start time (UTC):	13:53:32
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5853, Parent PID: 5844

General

Start time (UTC):	13:53:32
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggtr
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5854, Parent PID: 5432

General

Start time (UTC):	13:53:33
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5854, Parent PID: 5432

General

Start time (UTC):	13:53:33
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 14Fa \|\| busybox pkill -9 14Fa"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5859, Parent PID: 5854

General

Start time (UTC):	13:53:33
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5859, Parent PID: 5854

General

Start time (UTC):	13:53:33
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 14Fa
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5860, Parent PID: 5854

General

Start time (UTC):	13:53:34
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5860, Parent PID: 5854

General

Start time (UTC):	13:53:34
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 14Fa
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5861, Parent PID: 5432

General

Start time (UTC):	13:53:35
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5861, Parent PID: 5432

General

Start time (UTC):	13:53:35
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SEXSLAVE1337 \|\| busybox pkill -9 SEXSLAVE1337"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5863, Parent PID: 5861

General

Start time (UTC):	13:53:35
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5863, Parent PID: 5861

General

Start time (UTC):	13:53:35
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SEXSLAVE1337
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5866, Parent PID: 5861

General

Start time (UTC):	13:53:36
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5866, Parent PID: 5861

General

Start time (UTC):	13:53:36
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SEXSLAVE1337
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5869, Parent PID: 5432

General

Start time (UTC):	13:53:37
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5869, Parent PID: 5432

General

Start time (UTC):	13:53:37
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggtt \|\| busybox pkill -9 ggtt"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5874, Parent PID: 5869

General

Start time (UTC):	13:53:37
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5874, Parent PID: 5869

General

Start time (UTC):	13:53:37
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggtt
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5875, Parent PID: 5869

General

Start time (UTC):	13:53:38
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5875, Parent PID: 5869

General

Start time (UTC):	13:53:38
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggtt
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5876, Parent PID: 5432

General

Start time (UTC):	13:53:39
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5876, Parent PID: 5432

General

Start time (UTC):	13:53:39
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1902a3u912u3u4 \|\| busybox pkill -9 1902a3u912u3u4"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5881, Parent PID: 5876

General

Start time (UTC):	13:53:39
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5881, Parent PID: 5876

General

Start time (UTC):	13:53:39
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1902a3u912u3u4
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5882, Parent PID: 5876

General

Start time (UTC):	13:53:40
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5882, Parent PID: 5876

General

Start time (UTC):	13:53:40
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1902a3u912u3u4
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5883, Parent PID: 5432

General

Start time (UTC):	13:53:41
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5883, Parent PID: 5432

General

Start time (UTC):	13:53:41
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5888, Parent PID: 5883

General

Start time (UTC):	13:53:41
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5888, Parent PID: 5883

General

Start time (UTC):	13:53:41
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SO190Ij1X
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5891, Parent PID: 5883

General

Start time (UTC):	13:53:42
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5891, Parent PID: 5883

General

Start time (UTC):	13:53:42
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SO190Ij1X
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5892, Parent PID: 5432

General

Start time (UTC):	13:53:43
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5892, Parent PID: 5432

General

Start time (UTC):	13:53:43
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 haetrghbr \|\| busybox pkill -9 haetrghbr"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5897, Parent PID: 5892

General

Start time (UTC):	13:53:43
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5897, Parent PID: 5892

General

Start time (UTC):	13:53:43
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 haetrghbr
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5899, Parent PID: 5892

General

Start time (UTC):	13:53:44
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5899, Parent PID: 5892

General

Start time (UTC):	13:53:44
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 haetrghbr
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5900, Parent PID: 5432

General

Start time (UTC):	13:53:45
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5900, Parent PID: 5432

General

Start time (UTC):	13:53:45
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 19ju3d \|\| busybox pkill -9 19ju3d"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5902, Parent PID: 5900

General

Start time (UTC):	13:53:45
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5902, Parent PID: 5900

General

Start time (UTC):	13:53:45
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 19ju3d
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5903, Parent PID: 5900

General

Start time (UTC):	13:53:46
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5903, Parent PID: 5900

General

Start time (UTC):	13:53:46
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 19ju3d
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5906, Parent PID: 5432

General

Start time (UTC):	13:53:47
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5906, Parent PID: 5432

General

Start time (UTC):	13:53:47
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SORAojkf120 \|\| busybox pkill -9 SORAojkf120"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5912, Parent PID: 5906

General

Start time (UTC):	13:53:47
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5912, Parent PID: 5906

General

Start time (UTC):	13:53:47
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SORAojkf120
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5913, Parent PID: 5906

General

Start time (UTC):	13:53:48
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5913, Parent PID: 5906

General

Start time (UTC):	13:53:48
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SORAojkf120
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 5914, Parent PID: 5432

General

Start time (UTC):	13:53:49
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 5914, Parent PID: 5432

General

Start time (UTC):	13:53:49
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 hehahejeje92 \|\| busybox pkill -9 hehahejeje92"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5916, Parent PID: 5914

General

Start time (UTC):	13:53:49
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5916, Parent PID: 5914

General

Start time (UTC):	13:53:49
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 hehahejeje92
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.
Tactics:	Credential Access
Data Sources:	Application Log: Application Log Content, Command: Command Execution, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report yakuza.m68k.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: yakuza.m68k.elf PID: 5430, Parent PID: 5357

General

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 5432, Parent PID: 5430

General

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 5438, Parent PID: 5432

General

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 5439, Parent PID: 5432

General

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 5440, Parent PID: 5432

General

Chronological Activities

Linux Analysis Report
yakuza.m68k.elf