Edit tour

Linux Analysis Report
yakuza.arm6.elf

Overview

General Information

Sample name:	yakuza.arm6.elf
Analysis ID:	1581676
MD5:	872d29d9c1877a52fb8967c1f6750c58
SHA1:	383b5271bfdc4f531c0e34fe4646ac53f8affb3a
SHA256:	88ceff95966f1e21694dbba2204aa1573ebe548eb1785a7977a14b509eeeb64d
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "kill" or "pkill" command typically used to terminate processes

Reads CPU information from /sys indicative of miner or evasive malware

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample contains strings indicative of password brute-forcing capabilities

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581676
Start date and time:	2024-12-28 15:01:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	yakuza.arm6.elf
Detection:	MAL
Classification:	mal64.troj.linELF@0/0@3/0

Warnings

Report size exceeded maximum capacity and may have missing behavior information.

Runtime Messages

Command:	/tmp/yakuza.arm6.elf
PID:	5431
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	CAPSAICIN
Standard Error:

Process Tree

system is lnxubuntu20

yakuza.arm6.elf (PID: 5431, Parent: 5356, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/yakuza.arm6.elf

yakuza.arm6.elf New Fork (PID: 5433, Parent: 5431)

yakuza.arm6.elf New Fork (PID: 5435, Parent: 5433)

yakuza.arm6.elf New Fork (PID: 5439, Parent: 5433)

yakuza.arm6.elf New Fork (PID: 5446, Parent: 5433)

sh (PID: 5446, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 902i13 || busybox pkill -9 902i13"

sh New Fork (PID: 5452, Parent: 5446)

pkill (PID: 5452, Parent: 5446, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 902i13

sh New Fork (PID: 5481, Parent: 5446)

busybox (PID: 5481, Parent: 5446, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 902i13

yakuza.arm6.elf New Fork (PID: 5482, Parent: 5433)

sh (PID: 5482, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 BzSxLxBxeY || busybox pkill -9 BzSxLxBxeY"

sh New Fork (PID: 5487, Parent: 5482)

pkill (PID: 5487, Parent: 5482, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 BzSxLxBxeY

sh New Fork (PID: 5490, Parent: 5482)

busybox (PID: 5490, Parent: 5482, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 BzSxLxBxeY

yakuza.arm6.elf New Fork (PID: 5491, Parent: 5433)

sh (PID: 5491, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 HOHO-LUGO7 || busybox pkill -9 HOHO-LUGO7"

sh New Fork (PID: 5497, Parent: 5491)

pkill (PID: 5497, Parent: 5491, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 HOHO-LUGO7

sh New Fork (PID: 5504, Parent: 5491)

busybox (PID: 5504, Parent: 5491, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 HOHO-LUGO7

yakuza.arm6.elf New Fork (PID: 5505, Parent: 5433)

sh (PID: 5505, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 HOHO-U79OL || busybox pkill -9 HOHO-U79OL"

sh New Fork (PID: 5507, Parent: 5505)

pkill (PID: 5507, Parent: 5505, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 HOHO-U79OL

sh New Fork (PID: 5510, Parent: 5505)

busybox (PID: 5510, Parent: 5505, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 HOHO-U79OL

yakuza.arm6.elf New Fork (PID: 5511, Parent: 5433)

sh (PID: 5511, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 JuYfouyf87 || busybox pkill -9 JuYfouyf87"

sh New Fork (PID: 5516, Parent: 5511)

pkill (PID: 5516, Parent: 5511, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 JuYfouyf87

sh New Fork (PID: 5517, Parent: 5511)

busybox (PID: 5517, Parent: 5511, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 JuYfouyf87

yakuza.arm6.elf New Fork (PID: 5518, Parent: 5433)

sh (PID: 5518, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"

sh New Fork (PID: 5520, Parent: 5518)

pkill (PID: 5520, Parent: 5518, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeR69xd

sh New Fork (PID: 5521, Parent: 5518)

busybox (PID: 5521, Parent: 5518, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeR69xd

yakuza.arm6.elf New Fork (PID: 5524, Parent: 5433)

sh (PID: 5524, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SO190Ij1X || busybox pkill -9 SO190Ij1X"

sh New Fork (PID: 5529, Parent: 5524)

pkill (PID: 5529, Parent: 5524, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SO190Ij1X

sh New Fork (PID: 5530, Parent: 5524)

busybox (PID: 5530, Parent: 5524, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SO190Ij1X

yakuza.arm6.elf New Fork (PID: 5531, Parent: 5433)

sh (PID: 5531, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 LOLKIKEEEDDE || busybox pkill -9 LOLKIKEEEDDE"

sh New Fork (PID: 5536, Parent: 5531)

pkill (PID: 5536, Parent: 5531, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 LOLKIKEEEDDE

sh New Fork (PID: 5537, Parent: 5531)

busybox (PID: 5537, Parent: 5531, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 LOLKIKEEEDDE

yakuza.arm6.elf New Fork (PID: 5558, Parent: 5433)

sh (PID: 5558, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ekjheory98e || busybox pkill -9 ekjheory98e"

sh New Fork (PID: 5563, Parent: 5558)

pkill (PID: 5563, Parent: 5558, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ekjheory98e

sh New Fork (PID: 5565, Parent: 5558)

busybox (PID: 5565, Parent: 5558, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ekjheory98e

yakuza.arm6.elf New Fork (PID: 5566, Parent: 5433)

sh (PID: 5566, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scansh4 || busybox pkill -9 scansh4"

sh New Fork (PID: 5572, Parent: 5566)

pkill (PID: 5572, Parent: 5566, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scansh4

sh New Fork (PID: 5573, Parent: 5566)

busybox (PID: 5573, Parent: 5566, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scansh4

yakuza.arm6.elf New Fork (PID: 5574, Parent: 5433)

sh (PID: 5574, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MDMA || busybox pkill -9 MDMA"

sh New Fork (PID: 5576, Parent: 5574)

pkill (PID: 5576, Parent: 5574, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MDMA

sh New Fork (PID: 5579, Parent: 5574)

busybox (PID: 5579, Parent: 5574, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MDMA

yakuza.arm6.elf New Fork (PID: 5580, Parent: 5433)

sh (PID: 5580, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 fdevalvex || busybox pkill -9 fdevalvex"

sh New Fork (PID: 5585, Parent: 5580)

pkill (PID: 5585, Parent: 5580, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 fdevalvex

sh New Fork (PID: 5586, Parent: 5580)

busybox (PID: 5586, Parent: 5580, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 fdevalvex

yakuza.arm6.elf New Fork (PID: 5587, Parent: 5433)

sh (PID: 5587, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scanspc || busybox pkill -9 scanspc"

sh New Fork (PID: 5592, Parent: 5587)

pkill (PID: 5592, Parent: 5587, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scanspc

sh New Fork (PID: 5595, Parent: 5587)

busybox (PID: 5595, Parent: 5587, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scanspc

yakuza.arm6.elf New Fork (PID: 5596, Parent: 5433)

sh (PID: 5596, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MELTEDNINJAREALZ || busybox pkill -9 MELTEDNINJAREALZ"

sh New Fork (PID: 5601, Parent: 5596)

pkill (PID: 5601, Parent: 5596, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MELTEDNINJAREALZ

sh New Fork (PID: 5602, Parent: 5596)

busybox (PID: 5602, Parent: 5596, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MELTEDNINJAREALZ

yakuza.arm6.elf New Fork (PID: 5603, Parent: 5433)

sh (PID: 5603, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 flexsonskids || busybox pkill -9 flexsonskids"

sh New Fork (PID: 5605, Parent: 5603)

pkill (PID: 5605, Parent: 5603, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 flexsonskids

sh New Fork (PID: 5606, Parent: 5603)

busybox (PID: 5606, Parent: 5603, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 flexsonskids

yakuza.arm6.elf New Fork (PID: 5609, Parent: 5433)

sh (PID: 5609, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scanx86 || busybox pkill -9 scanx86"

sh New Fork (PID: 5611, Parent: 5609)

pkill (PID: 5611, Parent: 5609, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scanx86

sh New Fork (PID: 5612, Parent: 5609)

busybox (PID: 5612, Parent: 5609, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scanx86

yakuza.arm6.elf New Fork (PID: 5613, Parent: 5433)

sh (PID: 5613, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MISAKI-U79OL || busybox pkill -9 MISAKI-U79OL"

sh New Fork (PID: 5615, Parent: 5613)

pkill (PID: 5615, Parent: 5613, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MISAKI-U79OL

sh New Fork (PID: 5616, Parent: 5613)

busybox (PID: 5616, Parent: 5613, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MISAKI-U79OL

yakuza.arm6.elf New Fork (PID: 5619, Parent: 5433)

sh (PID: 5619, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 foAxi102kxe || busybox pkill -9 foAxi102kxe"

sh New Fork (PID: 5625, Parent: 5619)

pkill (PID: 5625, Parent: 5619, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 foAxi102kxe

sh New Fork (PID: 5626, Parent: 5619)

busybox (PID: 5626, Parent: 5619, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 foAxi102kxe

yakuza.arm6.elf New Fork (PID: 5627, Parent: 5433)

sh (PID: 5627, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 swodjwodjwoj || busybox pkill -9 swodjwodjwoj"

sh New Fork (PID: 5632, Parent: 5627)

pkill (PID: 5632, Parent: 5627, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 swodjwodjwoj

sh New Fork (PID: 5633, Parent: 5627)

busybox (PID: 5633, Parent: 5627, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 swodjwodjwoj

yakuza.arm6.elf New Fork (PID: 5634, Parent: 5433)

sh (PID: 5634, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MmKiy7f87l || busybox pkill -9 MmKiy7f87l"

sh New Fork (PID: 5636, Parent: 5634)

pkill (PID: 5636, Parent: 5634, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MmKiy7f87l

sh New Fork (PID: 5639, Parent: 5634)

busybox (PID: 5639, Parent: 5634, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MmKiy7f87l

yakuza.arm6.elf New Fork (PID: 5640, Parent: 5433)

sh (PID: 5640, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 freecookiex86 || busybox pkill -9 freecookiex86"

sh New Fork (PID: 5645, Parent: 5640)

pkill (PID: 5645, Parent: 5640, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 freecookiex86

sh New Fork (PID: 5646, Parent: 5640)

busybox (PID: 5646, Parent: 5640, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 freecookiex86

yakuza.arm6.elf New Fork (PID: 5647, Parent: 5433)

sh (PID: 5647, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 sysgpu || busybox pkill -9 sysgpu"

sh New Fork (PID: 5649, Parent: 5647)

pkill (PID: 5649, Parent: 5647, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 sysgpu

sh New Fork (PID: 5654, Parent: 5647)

busybox (PID: 5654, Parent: 5647, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 sysgpu

yakuza.arm6.elf New Fork (PID: 5656, Parent: 5433)

sh (PID: 5656, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"

sh New Fork (PID: 5662, Parent: 5656)

pkill (PID: 5662, Parent: 5656, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeR69xd

sh New Fork (PID: 5663, Parent: 5656)

busybox (PID: 5663, Parent: 5656, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeR69xd

yakuza.arm6.elf New Fork (PID: 5664, Parent: 5433)

sh (PID: 5664, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 frgege || busybox pkill -9 frgege"

sh New Fork (PID: 5669, Parent: 5664)

pkill (PID: 5669, Parent: 5664, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 frgege

sh New Fork (PID: 5670, Parent: 5664)

busybox (PID: 5670, Parent: 5664, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 frgege

yakuza.arm6.elf New Fork (PID: 5673, Parent: 5433)

sh (PID: 5673, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 sysupdater || busybox pkill -9 sysupdater"

sh New Fork (PID: 5675, Parent: 5673)

pkill (PID: 5675, Parent: 5673, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 sysupdater

sh New Fork (PID: 5676, Parent: 5673)

busybox (PID: 5676, Parent: 5673, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 sysupdater

yakuza.arm6.elf New Fork (PID: 5677, Parent: 5433)

sh (PID: 5677, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 0DnAzepd || busybox pkill -9 0DnAzepd"

sh New Fork (PID: 5682, Parent: 5677)

pkill (PID: 5682, Parent: 5677, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 0DnAzepd

sh New Fork (PID: 5683, Parent: 5677)

busybox (PID: 5683, Parent: 5677, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 0DnAzepd

yakuza.arm6.elf New Fork (PID: 5686, Parent: 5433)

sh (PID: 5686, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeRD0nks69 || busybox pkill -9 NiGGeRD0nks69"

sh New Fork (PID: 5691, Parent: 5686)

pkill (PID: 5691, Parent: 5686, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeRD0nks69

sh New Fork (PID: 5692, Parent: 5686)

busybox (PID: 5692, Parent: 5686, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeRD0nks69

yakuza.arm6.elf New Fork (PID: 5693, Parent: 5433)

sh (PID: 5693, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 frgreu || busybox pkill -9 frgreu"

sh New Fork (PID: 5697, Parent: 5693)

pkill (PID: 5697, Parent: 5693, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 frgreu

sh New Fork (PID: 5699, Parent: 5693)

busybox (PID: 5699, Parent: 5693, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 frgreu

yakuza.arm6.elf New Fork (PID: 5700, Parent: 5433)

sh (PID: 5700, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 telnetd || busybox pkill -9 telnetd"

sh New Fork (PID: 5702, Parent: 5700)

pkill (PID: 5702, Parent: 5700, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 telnetd

sh New Fork (PID: 5705, Parent: 5700)

busybox (PID: 5705, Parent: 5700, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 telnetd

yakuza.arm6.elf New Fork (PID: 5706, Parent: 5433)

sh (PID: 5706, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 0x766f6964 || busybox pkill -9 0x766f6964"

sh New Fork (PID: 5712, Parent: 5706)

pkill (PID: 5712, Parent: 5706, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 0x766f6964

sh New Fork (PID: 5713, Parent: 5706)

busybox (PID: 5713, Parent: 5706, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 0x766f6964

yakuza.arm6.elf New Fork (PID: 5714, Parent: 5433)

sh (PID: 5714, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeRd0nks1337 || busybox pkill -9 NiGGeRd0nks1337"

sh New Fork (PID: 5719, Parent: 5714)

pkill (PID: 5719, Parent: 5714, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeRd0nks1337

sh New Fork (PID: 5722, Parent: 5714)

busybox (PID: 5722, Parent: 5714, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeRd0nks1337

yakuza.arm6.elf New Fork (PID: 5723, Parent: 5433)

sh (PID: 5723, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 gaft || busybox pkill -9 gaft"

sh New Fork (PID: 5728, Parent: 5723)

pkill (PID: 5728, Parent: 5723, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 gaft

sh New Fork (PID: 5729, Parent: 5723)

busybox (PID: 5729, Parent: 5723, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 gaft

yakuza.arm6.elf New Fork (PID: 5730, Parent: 5433)

sh (PID: 5730, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 urasgbsigboa || busybox pkill -9 urasgbsigboa"

sh New Fork (PID: 5732, Parent: 5730)

pkill (PID: 5732, Parent: 5730, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 urasgbsigboa

sh New Fork (PID: 5735, Parent: 5730)

busybox (PID: 5735, Parent: 5730, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 urasgbsigboa

yakuza.arm6.elf New Fork (PID: 5736, Parent: 5433)

sh (PID: 5736, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 120i3UI49 || busybox pkill -9 120i3UI49"

sh New Fork (PID: 5741, Parent: 5736)

pkill (PID: 5741, Parent: 5736, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 120i3UI49

sh New Fork (PID: 5742, Parent: 5736)

busybox (PID: 5742, Parent: 5736, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 120i3UI49

yakuza.arm6.elf New Fork (PID: 5743, Parent: 5433)

sh (PID: 5743, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 OaF3 || busybox pkill -9 OaF3"

sh New Fork (PID: 5748, Parent: 5743)

pkill (PID: 5748, Parent: 5743, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 OaF3

sh New Fork (PID: 5749, Parent: 5743)

busybox (PID: 5749, Parent: 5743, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 OaF3

yakuza.arm6.elf New Fork (PID: 5752, Parent: 5433)

sh (PID: 5752, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 geae || busybox pkill -9 geae"

sh New Fork (PID: 5757, Parent: 5752)

pkill (PID: 5757, Parent: 5752, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 geae

sh New Fork (PID: 5759, Parent: 5752)

busybox (PID: 5759, Parent: 5752, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 geae

yakuza.arm6.elf New Fork (PID: 5760, Parent: 5433)

sh (PID: 5760, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 vaiolmao || busybox pkill -9 vaiolmao"

sh New Fork (PID: 5766, Parent: 5760)

pkill (PID: 5766, Parent: 5760, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 vaiolmao

sh New Fork (PID: 5767, Parent: 5760)

busybox (PID: 5767, Parent: 5760, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 vaiolmao

yakuza.arm6.elf New Fork (PID: 5768, Parent: 5433)

sh (PID: 5768, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 123123a || busybox pkill -9 123123a"

sh New Fork (PID: 5773, Parent: 5768)

pkill (PID: 5773, Parent: 5768, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 123123a

sh New Fork (PID: 5776, Parent: 5768)

busybox (PID: 5776, Parent: 5768, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 123123a

yakuza.arm6.elf New Fork (PID: 5777, Parent: 5433)

sh (PID: 5777, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 Ofurain0n4H34D || busybox pkill -9 Ofurain0n4H34D"

sh New Fork (PID: 5782, Parent: 5777)

pkill (PID: 5782, Parent: 5777, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 Ofurain0n4H34D

sh New Fork (PID: 5783, Parent: 5777)

busybox (PID: 5783, Parent: 5777, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 Ofurain0n4H34D

yakuza.arm6.elf New Fork (PID: 5784, Parent: 5433)

sh (PID: 5784, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggTrex || busybox pkill -9 ggTrex"

sh New Fork (PID: 5786, Parent: 5784)

pkill (PID: 5786, Parent: 5784, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggTrex

sh New Fork (PID: 5787, Parent: 5784)

busybox (PID: 5787, Parent: 5784, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggTrex

yakuza.arm6.elf New Fork (PID: 5790, Parent: 5433)

sh (PID: 5790, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 wasads || busybox pkill -9 wasads"

sh New Fork (PID: 5792, Parent: 5790)

pkill (PID: 5792, Parent: 5790, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 wasads

sh New Fork (PID: 5793, Parent: 5790)

busybox (PID: 5793, Parent: 5790, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 wasads

yakuza.arm6.elf New Fork (PID: 5794, Parent: 5433)

sh (PID: 5794, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1293194hjXD || busybox pkill -9 1293194hjXD"

sh New Fork (PID: 5796, Parent: 5794)

pkill (PID: 5796, Parent: 5794, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1293194hjXD

sh New Fork (PID: 5797, Parent: 5794)

busybox (PID: 5797, Parent: 5794, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1293194hjXD

yakuza.arm6.elf New Fork (PID: 5800, Parent: 5433)

sh (PID: 5800, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 OthLaLosn || busybox pkill -9 OthLaLosn"

sh New Fork (PID: 5802, Parent: 5800)

pkill (PID: 5802, Parent: 5800, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 OthLaLosn

sh New Fork (PID: 5803, Parent: 5800)

busybox (PID: 5803, Parent: 5800, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 OthLaLosn

yakuza.arm6.elf New Fork (PID: 5804, Parent: 5433)

sh (PID: 5804, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggt || busybox pkill -9 ggt"

sh New Fork (PID: 5810, Parent: 5804)

pkill (PID: 5810, Parent: 5804, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggt

sh New Fork (PID: 5811, Parent: 5804)

busybox (PID: 5811, Parent: 5804, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggt

yakuza.arm6.elf New Fork (PID: 5812, Parent: 5433)

sh (PID: 5812, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 wget-log || busybox pkill -9 wget-log"

sh New Fork (PID: 5817, Parent: 5812)

pkill (PID: 5817, Parent: 5812, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 wget-log

sh New Fork (PID: 5820, Parent: 5812)

busybox (PID: 5820, Parent: 5812, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 wget-log

yakuza.arm6.elf New Fork (PID: 5821, Parent: 5433)

sh (PID: 5821, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1337SoraLOADER || busybox pkill -9 1337SoraLOADER"

sh New Fork (PID: 5826, Parent: 5821)

pkill (PID: 5826, Parent: 5821, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1337SoraLOADER

sh New Fork (PID: 5827, Parent: 5821)

busybox (PID: 5827, Parent: 5821, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1337SoraLOADER

yakuza.arm6.elf New Fork (PID: 5828, Parent: 5433)

sh (PID: 5828, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SAIAKINA || busybox pkill -9 SAIAKINA"

sh New Fork (PID: 5833, Parent: 5828)

pkill (PID: 5833, Parent: 5828, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SAIAKINA

sh New Fork (PID: 5834, Parent: 5828)

busybox (PID: 5834, Parent: 5828, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SAIAKINA

yakuza.arm6.elf New Fork (PID: 5837, Parent: 5433)

sh (PID: 5837, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggtq || busybox pkill -9 ggtq"

sh New Fork (PID: 5842, Parent: 5837)

pkill (PID: 5842, Parent: 5837, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggtq

sh New Fork (PID: 5843, Parent: 5837)

busybox (PID: 5843, Parent: 5837, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggtq

yakuza.arm6.elf New Fork (PID: 5844, Parent: 5433)

sh (PID: 5844, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1378bfp919GRB1Q2 || busybox pkill -9 1378bfp919GRB1Q2"

sh New Fork (PID: 5846, Parent: 5844)

pkill (PID: 5846, Parent: 5844, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1378bfp919GRB1Q2

sh New Fork (PID: 5847, Parent: 5844)

busybox (PID: 5847, Parent: 5844, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1378bfp919GRB1Q2

yakuza.arm6.elf New Fork (PID: 5848, Parent: 5433)

sh (PID: 5848, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SAIAKUSO || busybox pkill -9 SAIAKUSO"

sh New Fork (PID: 5850, Parent: 5848)

pkill (PID: 5850, Parent: 5848, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SAIAKUSO

sh New Fork (PID: 5856, Parent: 5848)

busybox (PID: 5856, Parent: 5848, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SAIAKUSO

yakuza.arm6.elf New Fork (PID: 5857, Parent: 5433)

sh (PID: 5857, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggtr || busybox pkill -9 ggtr"

sh New Fork (PID: 5863, Parent: 5857)

pkill (PID: 5863, Parent: 5857, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggtr

sh New Fork (PID: 5864, Parent: 5857)

busybox (PID: 5864, Parent: 5857, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggtr

yakuza.arm6.elf New Fork (PID: 5865, Parent: 5433)

sh (PID: 5865, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 14Fa || busybox pkill -9 14Fa"

sh New Fork (PID: 5869, Parent: 5865)

pkill (PID: 5869, Parent: 5865, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 14Fa

sh New Fork (PID: 5873, Parent: 5865)

busybox (PID: 5873, Parent: 5865, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 14Fa

yakuza.arm6.elf New Fork (PID: 5874, Parent: 5433)

sh (PID: 5874, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SEXSLAVE1337 || busybox pkill -9 SEXSLAVE1337"

sh New Fork (PID: 5879, Parent: 5874)

pkill (PID: 5879, Parent: 5874, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SEXSLAVE1337

sh New Fork (PID: 5880, Parent: 5874)

busybox (PID: 5880, Parent: 5874, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SEXSLAVE1337

yakuza.arm6.elf New Fork (PID: 5881, Parent: 5433)

sh (PID: 5881, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggtt || busybox pkill -9 ggtt"

sh New Fork (PID: 5885, Parent: 5881)

pkill (PID: 5885, Parent: 5881, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggtt

sh New Fork (PID: 5887, Parent: 5881)

busybox (PID: 5887, Parent: 5881, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggtt

yakuza.arm6.elf New Fork (PID: 5890, Parent: 5433)

sh (PID: 5890, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1902a3u912u3u4 || busybox pkill -9 1902a3u912u3u4"

sh New Fork (PID: 5895, Parent: 5890)

pkill (PID: 5895, Parent: 5890, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1902a3u912u3u4

sh New Fork (PID: 5896, Parent: 5890)

busybox (PID: 5896, Parent: 5890, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1902a3u912u3u4

yakuza.arm6.elf New Fork (PID: 5897, Parent: 5433)

sh (PID: 5897, Parent: 5433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SO190Ij1X || busybox pkill -9 SO190Ij1X"

sh New Fork (PID: 5902, Parent: 5897)

pkill (PID: 5902, Parent: 5897, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SO190Ij1X

sh New Fork (PID: 5903, Parent: 5897)

busybox (PID: 5903, Parent: 5897, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SO190Ij1X

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
yakuza.arm6.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
yakuza.arm6.elf	Linux_Trojan_Gafgyt_6a510422	unknown	unknown	0x416:$a: 0B E5 24 30 1B E5 2C 30 0B E5 1C 00 00 EA 18 30 1B E5 00 30
yakuza.arm6.elf	Linux_Trojan_Gafgyt_d2953f92	unknown	unknown	0x326:$a: 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00
yakuza.arm6.elf	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x1a84d:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x1aee5:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20

Memory Dumps

Source	Rule	Description	Author	Strings
5435.1.00007fffcdd15000.00007fffcdd36000.rw-.sdmp	Linux_Trojan_Gafgyt_d2953f92	unknown	unknown	0x1ee56:$a: 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00
5439.1.00007fffcdd15000.00007fffcdd36000.rw-.sdmp	Linux_Trojan_Gafgyt_d2953f92	unknown	unknown	0x1ee56:$a: 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00
5431.1.00007fffcdd15000.00007fffcdd36000.rw-.sdmp	Linux_Trojan_Gafgyt_d2953f92	unknown	unknown	0x1ee56:$a: 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00
5431.1.00007f8568017000.00007f8568035000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5431.1.00007f8568017000.00007f8568035000.r-x.sdmp	Linux_Trojan_Gafgyt_6a510422	unknown	unknown	0x416:$a: 0B E5 24 30 1B E5 2C 30 0B E5 1C 00 00 EA 18 30 1B E5 00 30
5431.1.00007f8568017000.00007f8568035000.r-x.sdmp	Linux_Trojan_Gafgyt_d2953f92	unknown	unknown	0x326:$a: 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00
5431.1.00007f8568017000.00007f8568035000.r-x.sdmp	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x1a84d:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x1aee5:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
5439.1.00007f8568017000.00007f8568035000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5439.1.00007f8568017000.00007f8568035000.r-x.sdmp	Linux_Trojan_Gafgyt_6a510422	unknown	unknown	0x416:$a: 0B E5 24 30 1B E5 2C 30 0B E5 1C 00 00 EA 18 30 1B E5 00 30
5439.1.00007f8568017000.00007f8568035000.r-x.sdmp	Linux_Trojan_Gafgyt_d2953f92	unknown	unknown	0x326:$a: 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00
5439.1.00007f8568017000.00007f8568035000.r-x.sdmp	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x1a84d:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x1aee5:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
5435.1.00007f8568017000.00007f8568035000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5435.1.00007f8568017000.00007f8568035000.r-x.sdmp	Linux_Trojan_Gafgyt_6a510422	unknown	unknown	0x416:$a: 0B E5 24 30 1B E5 2C 30 0B E5 1C 00 00 EA 18 30 1B E5 00 30
5435.1.00007f8568017000.00007f8568035000.r-x.sdmp	Linux_Trojan_Gafgyt_d2953f92	unknown	unknown	0x326:$a: 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00
5435.1.00007f8568017000.00007f8568035000.r-x.sdmp	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x1a84d:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x1aee5:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
Process Memory Space: yakuza.arm6.elf PID: 5431	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x126a7:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x127b9:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x12d94:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
Process Memory Space: yakuza.arm6.elf PID: 5435	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x15da4:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x15eb6:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x16491:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
Process Memory Space: yakuza.arm6.elf PID: 5439	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x1336f:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x13481:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x13a5c:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
Click to see the 13 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: yakuza.arm6.elf	ReversingLabs: Detection: 57%
Source: yakuza.arm6.elf	Virustotal: Detection: 50%			Perma Link

Source: /usr/bin/pkill (PID: 5452)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5487)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5497)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5507)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5516)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5520)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5529)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5536)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5563)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5572)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5576)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5585)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5592)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5601)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5605)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5611)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5615)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5625)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5632)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5636)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5645)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5649)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5662)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5669)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5675)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5682)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5691)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5697)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5702)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5712)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5719)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5728)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5732)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5741)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5748)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5757)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5766)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5773)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5782)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5786)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5792)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5796)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5802)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5810)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5817)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5826)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5833)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5842)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5846)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5850)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5863)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5869)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5879)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5885)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5895)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5902)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/yakuza.arm6.elf (PID: 5439)

Reads hosts file: /etc/hosts

Jump to behavior

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: pirati.privatedns.org
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: yakuza.arm6.elf	String found in binary or memory: http://linux-it.abuser.eu/yak.sh;
Source: yakuza.arm6.elf	String found in binary or memory: https://youtu.be/dQw4w9WgXcQ
Source: yakuza.arm6.elf	String found in binary or memory: https://youtu.be/dQw4w9WgXcQNever

System Summary

Malicious sample detected (through community Yara rule)

Source: yakuza.arm6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6a510422 Author: unknown
Source: yakuza.arm6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d2953f92 Author: unknown
Source: yakuza.arm6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: 5435.1.00007fffcdd15000.00007fffcdd36000.rw-.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 Author: unknown
Source: 5439.1.00007fffcdd15000.00007fffcdd36000.rw-.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 Author: unknown
Source: 5431.1.00007fffcdd15000.00007fffcdd36000.rw-.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 Author: unknown
Source: 5431.1.00007f8568017000.00007f8568035000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 Author: unknown
Source: 5431.1.00007f8568017000.00007f8568035000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 Author: unknown
Source: 5431.1.00007f8568017000.00007f8568035000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: 5439.1.00007f8568017000.00007f8568035000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 Author: unknown
Source: 5439.1.00007f8568017000.00007f8568035000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 Author: unknown
Source: 5439.1.00007f8568017000.00007f8568035000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: 5435.1.00007f8568017000.00007f8568035000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 Author: unknown
Source: 5435.1.00007f8568017000.00007f8568035000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 Author: unknown
Source: 5435.1.00007f8568017000.00007f8568035000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: Process Memory Space: yakuza.arm6.elf PID: 5431, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: Process Memory Space: yakuza.arm6.elf PID: 5435, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: Process Memory Space: yakuza.arm6.elf PID: 5439, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: pkill -9 %s \|\| busybox pkill -9 %s
Source: Initial sample	String containing 'busybox' found: pkill -9 %s \|\| busybox pkill -9 %shistory -c;history -wcd /root;rm -f .bash_historycd /var/tmp; rm -f *NOTICE %s :MOVE <server>

Source: Initial sample	String containing potential weak password found: guest
Source: Initial sample	String containing potential weak password found: default
Source: Initial sample	String containing potential weak password found: admin
Source: Initial sample	String containing potential weak password found: supervisor
Source: Initial sample	String containing potential weak password found: service
Source: Initial sample	String containing potential weak password found: administrator
Source: Initial sample	String containing potential weak password found: support
Source: Initial sample	String containing potential weak password found: 123456
Source: Initial sample	String containing potential weak password found: password
Source: Initial sample	String containing potential weak password found: 12345

Source: yakuza.arm6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_6a510422 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 8ee116ff41236771cdc8dc4b796c3b211502413ae631d5b5aedbbaa2eccc3b75, id = 6a510422-3662-4fdb-9c03-0101f16e87cd, last_modified = 2021-09-16
Source: yakuza.arm6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d2953f92 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc, id = d2953f92-62ee-428d-88c5-723914c88c6e, last_modified = 2021-09-16
Source: yakuza.arm6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: 5435.1.00007fffcdd15000.00007fffcdd36000.rw-.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc, id = d2953f92-62ee-428d-88c5-723914c88c6e, last_modified = 2021-09-16
Source: 5439.1.00007fffcdd15000.00007fffcdd36000.rw-.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc, id = d2953f92-62ee-428d-88c5-723914c88c6e, last_modified = 2021-09-16
Source: 5431.1.00007fffcdd15000.00007fffcdd36000.rw-.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc, id = d2953f92-62ee-428d-88c5-723914c88c6e, last_modified = 2021-09-16
Source: 5431.1.00007f8568017000.00007f8568035000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 8ee116ff41236771cdc8dc4b796c3b211502413ae631d5b5aedbbaa2eccc3b75, id = 6a510422-3662-4fdb-9c03-0101f16e87cd, last_modified = 2021-09-16
Source: 5431.1.00007f8568017000.00007f8568035000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc, id = d2953f92-62ee-428d-88c5-723914c88c6e, last_modified = 2021-09-16
Source: 5431.1.00007f8568017000.00007f8568035000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: 5439.1.00007f8568017000.00007f8568035000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 8ee116ff41236771cdc8dc4b796c3b211502413ae631d5b5aedbbaa2eccc3b75, id = 6a510422-3662-4fdb-9c03-0101f16e87cd, last_modified = 2021-09-16
Source: 5439.1.00007f8568017000.00007f8568035000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc, id = d2953f92-62ee-428d-88c5-723914c88c6e, last_modified = 2021-09-16
Source: 5439.1.00007f8568017000.00007f8568035000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: 5435.1.00007f8568017000.00007f8568035000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_6a510422 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 8ee116ff41236771cdc8dc4b796c3b211502413ae631d5b5aedbbaa2eccc3b75, id = 6a510422-3662-4fdb-9c03-0101f16e87cd, last_modified = 2021-09-16
Source: 5435.1.00007f8568017000.00007f8568035000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d2953f92 severity = 100, os = linux, arch_context = x86, creation_date = 2021-06-28, scan_context = file, memory, reference = 14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc, id = d2953f92-62ee-428d-88c5-723914c88c6e, last_modified = 2021-09-16
Source: 5435.1.00007f8568017000.00007f8568035000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: Process Memory Space: yakuza.arm6.elf PID: 5431, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: Process Memory Space: yakuza.arm6.elf PID: 5435, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: Process Memory Space: yakuza.arm6.elf PID: 5439, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16

Source: classification engine

Classification label: mal64.troj.linELF@0/0@3/0

Source: yakuza.arm6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: yakuza.arm6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: yakuza.arm6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: yakuza.arm6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: yakuza.arm6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: yakuza.arm6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm
Source: yakuza.arm6.elf	ELF static info symbol of initial sample: /home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm

Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/230/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/230/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/110/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/110/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/231/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/231/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/111/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/111/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/232/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/232/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/112/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/112/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/233/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/233/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/113/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/113/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/234/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/234/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/114/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/114/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/235/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/235/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/115/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/115/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/236/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/236/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/116/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/116/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/237/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/237/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/117/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/117/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/238/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/238/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/118/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/118/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/239/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/239/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/119/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/119/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/914/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/914/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/10/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/10/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/917/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/917/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/11/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/11/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/12/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/12/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/5273/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/5273/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/13/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/13/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/14/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/14/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/15/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/15/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/16/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/16/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/17/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/17/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/18/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/18/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/19/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/19/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/240/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/240/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/3095/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/3095/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/120/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/120/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/241/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/241/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/121/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/121/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/242/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/242/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/1/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/1/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/122/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/122/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/243/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/243/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/2/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/2/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/123/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/123/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/244/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/244/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/3/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/3/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/124/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/124/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/245/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/245/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/1588/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/1588/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/125/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/125/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/4/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/4/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/246/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/246/cmdline
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/126/status
Source: /usr/bin/pkill (PID: 5782)	File opened: /proc/126/cmdline

Source: /tmp/yakuza.arm6.elf (PID: 5446)	Shell command executed: sh -c "pkill -9 902i13 \|\| busybox pkill -9 902i13"	Jump to behavior
Source: /tmp/yakuza.arm6.elf (PID: 5482)	Shell command executed: sh -c "pkill -9 BzSxLxBxeY \|\| busybox pkill -9 BzSxLxBxeY"	Jump to behavior
Source: /tmp/yakuza.arm6.elf (PID: 5491)	Shell command executed: sh -c "pkill -9 HOHO-LUGO7 \|\| busybox pkill -9 HOHO-LUGO7"	Jump to behavior
Source: /tmp/yakuza.arm6.elf (PID: 5505)	Shell command executed: sh -c "pkill -9 HOHO-U79OL \|\| busybox pkill -9 HOHO-U79OL"	Jump to behavior
Source: /tmp/yakuza.arm6.elf (PID: 5511)	Shell command executed: sh -c "pkill -9 JuYfouyf87 \|\| busybox pkill -9 JuYfouyf87"	Jump to behavior
Source: /tmp/yakuza.arm6.elf (PID: 5518)	Shell command executed: sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"	Jump to behavior
Source: /tmp/yakuza.arm6.elf (PID: 5524)	Shell command executed: sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"	Jump to behavior
Source: /tmp/yakuza.arm6.elf (PID: 5531)	Shell command executed: sh -c "pkill -9 LOLKIKEEEDDE \|\| busybox pkill -9 LOLKIKEEEDDE"	Jump to behavior
Source: /tmp/yakuza.arm6.elf (PID: 5558)	Shell command executed: sh -c "pkill -9 ekjheory98e \|\| busybox pkill -9 ekjheory98e"	Jump to behavior
Source: /tmp/yakuza.arm6.elf (PID: 5566)	Shell command executed: sh -c "pkill -9 scansh4 \|\| busybox pkill -9 scansh4"	Jump to behavior
Source: /tmp/yakuza.arm6.elf (PID: 5574)	Shell command executed: sh -c "pkill -9 MDMA \|\| busybox pkill -9 MDMA"	Jump to behavior
Source: /tmp/yakuza.arm6.elf (PID: 5580)	Shell command executed: sh -c "pkill -9 fdevalvex \|\| busybox pkill -9 fdevalvex"	Jump to behavior
Source: /tmp/yakuza.arm6.elf (PID: 5587)	Shell command executed: sh -c "pkill -9 scanspc \|\| busybox pkill -9 scanspc"	Jump to behavior
Source: /tmp/yakuza.arm6.elf (PID: 5596)	Shell command executed: sh -c "pkill -9 MELTEDNINJAREALZ \|\| busybox pkill -9 MELTEDNINJAREALZ"	Jump to behavior
Source: /tmp/yakuza.arm6.elf (PID: 5603)	Shell command executed: sh -c "pkill -9 flexsonskids \|\| busybox pkill -9 flexsonskids"	Jump to behavior
Source: /tmp/yakuza.arm6.elf (PID: 5609)	Shell command executed: sh -c "pkill -9 scanx86 \|\| busybox pkill -9 scanx86"
Source: /tmp/yakuza.arm6.elf (PID: 5613)	Shell command executed: sh -c "pkill -9 MISAKI-U79OL \|\| busybox pkill -9 MISAKI-U79OL"
Source: /tmp/yakuza.arm6.elf (PID: 5619)	Shell command executed: sh -c "pkill -9 foAxi102kxe \|\| busybox pkill -9 foAxi102kxe"
Source: /tmp/yakuza.arm6.elf (PID: 5627)	Shell command executed: sh -c "pkill -9 swodjwodjwoj \|\| busybox pkill -9 swodjwodjwoj"
Source: /tmp/yakuza.arm6.elf (PID: 5634)	Shell command executed: sh -c "pkill -9 MmKiy7f87l \|\| busybox pkill -9 MmKiy7f87l"
Source: /tmp/yakuza.arm6.elf (PID: 5640)	Shell command executed: sh -c "pkill -9 freecookiex86 \|\| busybox pkill -9 freecookiex86"
Source: /tmp/yakuza.arm6.elf (PID: 5647)	Shell command executed: sh -c "pkill -9 sysgpu \|\| busybox pkill -9 sysgpu"
Source: /tmp/yakuza.arm6.elf (PID: 5656)	Shell command executed: sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
Source: /tmp/yakuza.arm6.elf (PID: 5664)	Shell command executed: sh -c "pkill -9 frgege \|\| busybox pkill -9 frgege"
Source: /tmp/yakuza.arm6.elf (PID: 5673)	Shell command executed: sh -c "pkill -9 sysupdater \|\| busybox pkill -9 sysupdater"
Source: /tmp/yakuza.arm6.elf (PID: 5677)	Shell command executed: sh -c "pkill -9 0DnAzepd \|\| busybox pkill -9 0DnAzepd"
Source: /tmp/yakuza.arm6.elf (PID: 5686)	Shell command executed: sh -c "pkill -9 NiGGeRD0nks69 \|\| busybox pkill -9 NiGGeRD0nks69"
Source: /tmp/yakuza.arm6.elf (PID: 5693)	Shell command executed: sh -c "pkill -9 frgreu \|\| busybox pkill -9 frgreu"
Source: /tmp/yakuza.arm6.elf (PID: 5700)	Shell command executed: sh -c "pkill -9 telnetd \|\| busybox pkill -9 telnetd"
Source: /tmp/yakuza.arm6.elf (PID: 5706)	Shell command executed: sh -c "pkill -9 0x766f6964 \|\| busybox pkill -9 0x766f6964"
Source: /tmp/yakuza.arm6.elf (PID: 5714)	Shell command executed: sh -c "pkill -9 NiGGeRd0nks1337 \|\| busybox pkill -9 NiGGeRd0nks1337"
Source: /tmp/yakuza.arm6.elf (PID: 5723)	Shell command executed: sh -c "pkill -9 gaft \|\| busybox pkill -9 gaft"
Source: /tmp/yakuza.arm6.elf (PID: 5730)	Shell command executed: sh -c "pkill -9 urasgbsigboa \|\| busybox pkill -9 urasgbsigboa"
Source: /tmp/yakuza.arm6.elf (PID: 5736)	Shell command executed: sh -c "pkill -9 120i3UI49 \|\| busybox pkill -9 120i3UI49"
Source: /tmp/yakuza.arm6.elf (PID: 5743)	Shell command executed: sh -c "pkill -9 OaF3 \|\| busybox pkill -9 OaF3"
Source: /tmp/yakuza.arm6.elf (PID: 5752)	Shell command executed: sh -c "pkill -9 geae \|\| busybox pkill -9 geae"
Source: /tmp/yakuza.arm6.elf (PID: 5760)	Shell command executed: sh -c "pkill -9 vaiolmao \|\| busybox pkill -9 vaiolmao"
Source: /tmp/yakuza.arm6.elf (PID: 5768)	Shell command executed: sh -c "pkill -9 123123a \|\| busybox pkill -9 123123a"
Source: /tmp/yakuza.arm6.elf (PID: 5777)	Shell command executed: sh -c "pkill -9 Ofurain0n4H34D \|\| busybox pkill -9 Ofurain0n4H34D"
Source: /tmp/yakuza.arm6.elf (PID: 5784)	Shell command executed: sh -c "pkill -9 ggTrex \|\| busybox pkill -9 ggTrex"
Source: /tmp/yakuza.arm6.elf (PID: 5790)	Shell command executed: sh -c "pkill -9 wasads \|\| busybox pkill -9 wasads"
Source: /tmp/yakuza.arm6.elf (PID: 5794)	Shell command executed: sh -c "pkill -9 1293194hjXD \|\| busybox pkill -9 1293194hjXD"
Source: /tmp/yakuza.arm6.elf (PID: 5800)	Shell command executed: sh -c "pkill -9 OthLaLosn \|\| busybox pkill -9 OthLaLosn"
Source: /tmp/yakuza.arm6.elf (PID: 5804)	Shell command executed: sh -c "pkill -9 ggt \|\| busybox pkill -9 ggt"
Source: /tmp/yakuza.arm6.elf (PID: 5812)	Shell command executed: sh -c "pkill -9 wget-log \|\| busybox pkill -9 wget-log"
Source: /tmp/yakuza.arm6.elf (PID: 5821)	Shell command executed: sh -c "pkill -9 1337SoraLOADER \|\| busybox pkill -9 1337SoraLOADER"
Source: /tmp/yakuza.arm6.elf (PID: 5828)	Shell command executed: sh -c "pkill -9 SAIAKINA \|\| busybox pkill -9 SAIAKINA"
Source: /tmp/yakuza.arm6.elf (PID: 5837)	Shell command executed: sh -c "pkill -9 ggtq \|\| busybox pkill -9 ggtq"
Source: /tmp/yakuza.arm6.elf (PID: 5844)	Shell command executed: sh -c "pkill -9 1378bfp919GRB1Q2 \|\| busybox pkill -9 1378bfp919GRB1Q2"
Source: /tmp/yakuza.arm6.elf (PID: 5848)	Shell command executed: sh -c "pkill -9 SAIAKUSO \|\| busybox pkill -9 SAIAKUSO"
Source: /tmp/yakuza.arm6.elf (PID: 5857)	Shell command executed: sh -c "pkill -9 ggtr \|\| busybox pkill -9 ggtr"
Source: /tmp/yakuza.arm6.elf (PID: 5865)	Shell command executed: sh -c "pkill -9 14Fa \|\| busybox pkill -9 14Fa"
Source: /tmp/yakuza.arm6.elf (PID: 5874)	Shell command executed: sh -c "pkill -9 SEXSLAVE1337 \|\| busybox pkill -9 SEXSLAVE1337"
Source: /tmp/yakuza.arm6.elf (PID: 5881)	Shell command executed: sh -c "pkill -9 ggtt \|\| busybox pkill -9 ggtt"
Source: /tmp/yakuza.arm6.elf (PID: 5890)	Shell command executed: sh -c "pkill -9 1902a3u912u3u4 \|\| busybox pkill -9 1902a3u912u3u4"
Source: /tmp/yakuza.arm6.elf (PID: 5897)	Shell command executed: sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"

Source: /bin/sh (PID: 5452)	Pkill executable: /usr/bin/pkill -> pkill -9 902i13	Jump to behavior
Source: /bin/sh (PID: 5487)	Pkill executable: /usr/bin/pkill -> pkill -9 BzSxLxBxeY	Jump to behavior
Source: /bin/sh (PID: 5497)	Pkill executable: /usr/bin/pkill -> pkill -9 HOHO-LUGO7	Jump to behavior
Source: /bin/sh (PID: 5507)	Pkill executable: /usr/bin/pkill -> pkill -9 HOHO-U79OL	Jump to behavior
Source: /bin/sh (PID: 5516)	Pkill executable: /usr/bin/pkill -> pkill -9 JuYfouyf87	Jump to behavior
Source: /bin/sh (PID: 5520)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeR69xd	Jump to behavior
Source: /bin/sh (PID: 5529)	Pkill executable: /usr/bin/pkill -> pkill -9 SO190Ij1X	Jump to behavior
Source: /bin/sh (PID: 5536)	Pkill executable: /usr/bin/pkill -> pkill -9 LOLKIKEEEDDE	Jump to behavior
Source: /bin/sh (PID: 5563)	Pkill executable: /usr/bin/pkill -> pkill -9 ekjheory98e	Jump to behavior
Source: /bin/sh (PID: 5572)	Pkill executable: /usr/bin/pkill -> pkill -9 scansh4	Jump to behavior
Source: /bin/sh (PID: 5576)	Pkill executable: /usr/bin/pkill -> pkill -9 MDMA	Jump to behavior
Source: /bin/sh (PID: 5585)	Pkill executable: /usr/bin/pkill -> pkill -9 fdevalvex	Jump to behavior
Source: /bin/sh (PID: 5592)	Pkill executable: /usr/bin/pkill -> pkill -9 scanspc	Jump to behavior
Source: /bin/sh (PID: 5601)	Pkill executable: /usr/bin/pkill -> pkill -9 MELTEDNINJAREALZ	Jump to behavior
Source: /bin/sh (PID: 5605)	Pkill executable: /usr/bin/pkill -> pkill -9 flexsonskids	Jump to behavior
Source: /bin/sh (PID: 5611)	Pkill executable: /usr/bin/pkill -> pkill -9 scanx86
Source: /bin/sh (PID: 5615)	Pkill executable: /usr/bin/pkill -> pkill -9 MISAKI-U79OL
Source: /bin/sh (PID: 5625)	Pkill executable: /usr/bin/pkill -> pkill -9 foAxi102kxe
Source: /bin/sh (PID: 5632)	Pkill executable: /usr/bin/pkill -> pkill -9 swodjwodjwoj
Source: /bin/sh (PID: 5636)	Pkill executable: /usr/bin/pkill -> pkill -9 MmKiy7f87l
Source: /bin/sh (PID: 5645)	Pkill executable: /usr/bin/pkill -> pkill -9 freecookiex86
Source: /bin/sh (PID: 5649)	Pkill executable: /usr/bin/pkill -> pkill -9 sysgpu
Source: /bin/sh (PID: 5662)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeR69xd
Source: /bin/sh (PID: 5669)	Pkill executable: /usr/bin/pkill -> pkill -9 frgege
Source: /bin/sh (PID: 5675)	Pkill executable: /usr/bin/pkill -> pkill -9 sysupdater
Source: /bin/sh (PID: 5682)	Pkill executable: /usr/bin/pkill -> pkill -9 0DnAzepd
Source: /bin/sh (PID: 5691)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeRD0nks69
Source: /bin/sh (PID: 5697)	Pkill executable: /usr/bin/pkill -> pkill -9 frgreu
Source: /bin/sh (PID: 5702)	Pkill executable: /usr/bin/pkill -> pkill -9 telnetd
Source: /bin/sh (PID: 5712)	Pkill executable: /usr/bin/pkill -> pkill -9 0x766f6964
Source: /bin/sh (PID: 5719)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeRd0nks1337
Source: /bin/sh (PID: 5728)	Pkill executable: /usr/bin/pkill -> pkill -9 gaft
Source: /bin/sh (PID: 5732)	Pkill executable: /usr/bin/pkill -> pkill -9 urasgbsigboa
Source: /bin/sh (PID: 5741)	Pkill executable: /usr/bin/pkill -> pkill -9 120i3UI49
Source: /bin/sh (PID: 5748)	Pkill executable: /usr/bin/pkill -> pkill -9 OaF3
Source: /bin/sh (PID: 5757)	Pkill executable: /usr/bin/pkill -> pkill -9 geae
Source: /bin/sh (PID: 5766)	Pkill executable: /usr/bin/pkill -> pkill -9 vaiolmao
Source: /bin/sh (PID: 5773)	Pkill executable: /usr/bin/pkill -> pkill -9 123123a
Source: /bin/sh (PID: 5782)	Pkill executable: /usr/bin/pkill -> pkill -9 Ofurain0n4H34D
Source: /bin/sh (PID: 5786)	Pkill executable: /usr/bin/pkill -> pkill -9 ggTrex
Source: /bin/sh (PID: 5792)	Pkill executable: /usr/bin/pkill -> pkill -9 wasads
Source: /bin/sh (PID: 5796)	Pkill executable: /usr/bin/pkill -> pkill -9 1293194hjXD
Source: /bin/sh (PID: 5802)	Pkill executable: /usr/bin/pkill -> pkill -9 OthLaLosn
Source: /bin/sh (PID: 5810)	Pkill executable: /usr/bin/pkill -> pkill -9 ggt
Source: /bin/sh (PID: 5817)	Pkill executable: /usr/bin/pkill -> pkill -9 wget-log
Source: /bin/sh (PID: 5826)	Pkill executable: /usr/bin/pkill -> pkill -9 1337SoraLOADER
Source: /bin/sh (PID: 5833)	Pkill executable: /usr/bin/pkill -> pkill -9 SAIAKINA
Source: /bin/sh (PID: 5842)	Pkill executable: /usr/bin/pkill -> pkill -9 ggtq
Source: /bin/sh (PID: 5846)	Pkill executable: /usr/bin/pkill -> pkill -9 1378bfp919GRB1Q2
Source: /bin/sh (PID: 5850)	Pkill executable: /usr/bin/pkill -> pkill -9 SAIAKUSO
Source: /bin/sh (PID: 5863)	Pkill executable: /usr/bin/pkill -> pkill -9 ggtr
Source: /bin/sh (PID: 5869)	Pkill executable: /usr/bin/pkill -> pkill -9 14Fa
Source: /bin/sh (PID: 5879)	Pkill executable: /usr/bin/pkill -> pkill -9 SEXSLAVE1337
Source: /bin/sh (PID: 5885)	Pkill executable: /usr/bin/pkill -> pkill -9 ggtt
Source: /bin/sh (PID: 5895)	Pkill executable: /usr/bin/pkill -> pkill -9 1902a3u912u3u4
Source: /bin/sh (PID: 5902)	Pkill executable: /usr/bin/pkill -> pkill -9 SO190Ij1X

Source: /usr/bin/pkill (PID: 5452)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5487)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5497)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5507)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5516)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5520)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5529)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5536)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5563)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5572)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5576)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5585)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5592)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5601)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5605)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5611)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5615)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5625)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5632)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5636)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5645)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5649)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5662)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5669)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5675)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5682)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5691)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5697)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5702)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5712)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5719)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5728)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5732)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5741)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5748)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5757)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5766)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5773)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5782)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5786)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5792)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5796)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5802)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5810)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5817)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5826)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5833)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5842)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5846)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5850)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5863)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5869)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5879)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5885)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5895)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5902)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/yakuza.arm6.elf (PID: 5431)	Queries kernel information via 'uname':	Jump to behavior
Source: /tmp/yakuza.arm6.elf (PID: 5439)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5481)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5490)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5504)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5510)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5517)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5521)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5530)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5537)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5565)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5573)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5579)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5586)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5595)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5602)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5606)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5612)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5616)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5626)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5633)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5639)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5646)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5654)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5663)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5670)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5676)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5683)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5692)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5699)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5705)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5713)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5722)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5729)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5735)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5742)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5749)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5759)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5767)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5776)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5783)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5787)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5793)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5797)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5803)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5811)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5820)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5827)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5834)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5843)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5847)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5856)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5864)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5873)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5880)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5887)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5896)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5903)	Queries kernel information via 'uname':

Source: yakuza.arm6.elf, 5431.1.000055fbab66b000.000055fbab799000.rw-.sdmp, yakuza.arm6.elf, 5435.1.000055fbab66b000.000055fbab799000.rw-.sdmp, yakuza.arm6.elf, 5439.1.000055fbab66b000.000055fbab799000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: yakuza.arm6.elf, 5431.1.00007fffcdd15000.00007fffcdd36000.rw-.sdmp, yakuza.arm6.elf, 5435.1.00007fffcdd15000.00007fffcdd36000.rw-.sdmp, yakuza.arm6.elf, 5439.1.00007fffcdd15000.00007fffcdd36000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/yakuza.arm6.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/yakuza.arm6.elf
Source: yakuza.arm6.elf, 5431.1.000055fbab66b000.000055fbab799000.rw-.sdmp, yakuza.arm6.elf, 5435.1.000055fbab66b000.000055fbab799000.rw-.sdmp, yakuza.arm6.elf, 5439.1.000055fbab66b000.000055fbab799000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: yakuza.arm6.elf, 5431.1.00007fffcdd15000.00007fffcdd36000.rw-.sdmp, yakuza.arm6.elf, 5435.1.00007fffcdd15000.00007fffcdd36000.rw-.sdmp, yakuza.arm6.elf, 5439.1.00007fffcdd15000.00007fffcdd36000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: yakuza.arm6.elf, 5435.1.00007fffcdd15000.00007fffcdd36000.rw-.sdmp, yakuza.arm6.elf, 5439.1.00007fffcdd15000.00007fffcdd36000.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: yakuza.arm6.elf, type: SAMPLE
Source: Yara match	File source: 5431.1.00007f8568017000.00007f8568035000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5439.1.00007f8568017000.00007f8568035000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5435.1.00007f8568017000.00007f8568035000.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U;) Presto/2.7.62 Version/11.01
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; U; de; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.62
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0) Gecko/20110517 Firefox/5.0 Fennec/5.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (compatible; Teleca Q7; Brew 3.1.5; U; en) 480X800 LGE VX11000

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: yakuza.arm6.elf, type: SAMPLE
Source: Yara match	File source: 5431.1.00007f8568017000.00007f8568035000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5439.1.00007f8568017000.00007f8568035000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5435.1.00007f8568017000.00007f8568035000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Disable or Modify Tools	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	1 Brute Force	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
yakuza.arm6.elf	58%	ReversingLabs	Linux.Trojan.Tsunami
yakuza.arm6.elf	50%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high
pirati.privatedns.org	79.12.214.240	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://youtu.be/dQw4w9WgXcQ	yakuza.arm6.elf	false	high
http://linux-it.abuser.eu/yak.sh;	yakuza.arm6.elf	false	high
https://youtu.be/dQw4w9WgXcQNever	yakuza.arm6.elf	false	high

World Map of Contacted IPs

⊘No contacted IP infos

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pirati.privatedns.org	yakuza.x86.elf	Get hash	malicious	Mirai	Browse	79.12.214.240
	yakuza.m68k.elf	Get hash	malicious	Mirai	Browse	79.12.214.240
	yakuza.i586.elf	Get hash	malicious	Mirai	Browse	79.12.214.240
	yakuza.sh.elf	Get hash	malicious	Mirai	Browse	79.12.214.240
	yakuza.sparc.elf	Get hash	malicious	Mirai	Browse	79.12.214.240
	yakuza.arm4.elf	Get hash	malicious	Mirai	Browse	79.12.214.240
	yakuza.mipsel.elf	Get hash	malicious	Mirai	Browse	79.12.214.240
	yakuza.arm7.elf	Get hash	malicious	Mirai	Browse	212.171.15.94
	yakuza.i686.elf	Get hash	malicious	Mirai	Browse	212.171.15.94
	yakuza.ppc.elf	Get hash	malicious	Mirai	Browse	212.171.15.94
daisy.ubuntu.com	yakuza.x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	yakuza.m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	yakuza.i586.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	yakuza.i686.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	arm6.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	45.200.149.186-boatnet.arm-2024-12-28T01_23_00.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	byte.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.24
	109.176.30.237-boatnet.mpsl-2024-12-27T20_20_43.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	byte.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.072405398129657
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	yakuza.arm6.elf
File size:	168'471 bytes
MD5:	872d29d9c1877a52fb8967c1f6750c58
SHA1:	383b5271bfdc4f531c0e34fe4646ac53f8affb3a
SHA256:	88ceff95966f1e21694dbba2204aa1573ebe548eb1785a7977a14b509eeeb64d
SHA512:	c001c55825e8452249fc7aae4d1cf484c10dc65823b4e14d09a656467014b40e7874fbcc0b802e64d2ad81f6d2c0034a422f5842ccd27932ad7795d315e06aa0
SSDEEP:	3072:zAW+1ji/bdZZAQUHLAXhUcaUhf81EA2glaOELPdzTy1EV7kKsD1e9LDGozmyX98F:AAXlayf8GfOCzL7kK799zmyX98RZoCd
TLSH:	8EF33A05D9509777C1E32BFBF7AA928E33231BA4938B33255A286FB41B8179D1E3D111
File Content Preview:	.ELF..............(.........4...........4. ...(........p.....U...U......................................................................$...........Q.td..................................-...L..................G.F.G.F.G.F.G.F G.F(G.F0G.F8G.F@G.FHG.FPG.FXG.

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x81b0
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	130720
Section Header Size:	40
Number of Section Headers:	25
Header String Table Index:	22

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80b4	0xb4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80d0	0xd0	0x17ef8	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1ffc8	0x17fc8	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1ffd8	0x17fd8	0x55bc	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x25594	0x1d594	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x255ac	0x1d5ac	0x10	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x2d5bc	0x1d5bc	0x4	0x0	0x3	WA	0	0	4
.init_array	INIT_ARRAY	0x2d5c0	0x1d5c0	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x2d5c4	0x1d5c4	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2d5c8	0x1d5c8	0x4	0x0	0x3	WA	0	0	4
.data.rel.ro	PROGBITS	0x2d5cc	0x1d5cc	0x18	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x2d5e4	0x1d5e4	0x80	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x2d664	0x1d664	0xc70	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x2e2d4	0x1e2d4	0x7b0c	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x1e2d4	0xe02	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1f0d8	0xe0	0x0	0x0		0	0	8
.debug_info	PROGBITS	0x0	0x1f1b8	0x4b0	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1f668	0x8c	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1f6f4	0x655	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1fd4c	0x58	0x0	0x0		0	0	4
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x1fda4	0x10	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1fdb4	0xea	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x20288	0x5f70	0x10	0x0		24	824	4
.strtab	STRTAB	0x0	0x261f8	0x301f	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x1d5ac	0x255ac	0x255ac	0x10	0x10	2.4056	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x1d5bc	0x1d5bc	6.2011	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x1d5bc	0x2d5bc	0x2d5bc	0xd18	0x8824	4.4017	0x6	RW	0x8000	.eh_frame .init_array .fini_array .jcr .data.rel.ro .got .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80b4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x80d0	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1ffc8	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x1ffd8	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x25594	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x255ac	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x2d5bc	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x2d5c0	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x2d5c4	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x2d5c8	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x2d5cc	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x2d5e4	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x2d664	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x2e2d4	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	21
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	22
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	23
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
$a	.symtab	0x80b4	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1ffc8	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x80c0	0	NOTYPE	<unknown>	DEFAULT	1
$a	.symtab	0x1ffd4	0	NOTYPE	<unknown>	DEFAULT	3
$a	.symtab	0x810c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x81ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8210	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8514	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8684	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8820	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8bf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x8e48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x943c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9578	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x95b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9678	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9778	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x98b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x99d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9a9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9b74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9cb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x9f84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa050	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa3a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa4d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xa854	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xab88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xacd8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb300	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xb994	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xbad0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc354	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xc664	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xce3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd39c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd640	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd678	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xd8c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xdc80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf37c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf47c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf62c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf6cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf708	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xf79c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfb2c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfc64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfcf8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfd48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfe0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xfe50	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0xff64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10134	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10dd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10e78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10eb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x10f3c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1104c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x113a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11474	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x11fe4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x120f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1223c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12250	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12264	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12298	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12384	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x123ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x123c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x123f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12424	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12440	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12480	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x124b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x124e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12514	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12548	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12620	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12654	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12688	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x126dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1271c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12750	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12780	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1279c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12950	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12970	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x129e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ac4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12ae8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b18	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12b7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12c04	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12cb8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x12df0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x130b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x133bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13424	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13458	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1352c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1355c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13640	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13e00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ea0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x13ee4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14094	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x140e8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14658	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x146fc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x147b8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x148ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14960	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ae8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14cf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14d94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14e9c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14ed4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x14f90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15030	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15090	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x150d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1519c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x152d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1538c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x153d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15440	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15540	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x155c4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x155f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1561c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x15698	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x156f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x162a0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x165b0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1689c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16c64	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d0c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x16d34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17020	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x172c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x172f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17330	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17368	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x173ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x173e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17418	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17450	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17490	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x174d4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1750c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17528	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x17ec0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18274	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18714	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18754	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1887c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18894	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18938	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x189f0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ab0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18b54	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18c38	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18cc8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18da0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18e84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ea4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18ec0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x18edc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1909c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19154	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19200	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1934c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19924	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x199d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19a20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ae0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19b34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19ba0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19e74	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x19fd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a038	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a0c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a0cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a0e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a120	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a154	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a188	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a1bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a21c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a250	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a264	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a298	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a2cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a2e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a2f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a360	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a374	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a3a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a3dc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a41c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a450	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a47c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a4b4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a5ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a67c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a728	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a7c0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a8ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1a8c8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ac6c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1acc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ace4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ad94	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1add0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ae84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1afc4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b094	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b104	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b130	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1b28c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ba80	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bb5c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1bc90	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c120	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c210	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c288	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c2cc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c37c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c45c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c4a8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c4f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c51c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c608	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c6f8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c738	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c784	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c840	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1c90c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ca84	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cb98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cbfc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cd44	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cda8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cdf4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ce88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1cf00	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d0ac	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d0f4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d1ec	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1d2e4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dacc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1db20	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1db78	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1dfd4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e06c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e104	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e150	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e448	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e480	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e538	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e5a4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e6d8	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e710	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e75c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e77c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e788	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e7e0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1e858	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ea88	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eae0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ec24	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ec48	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ed98	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1edf0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eeb4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1eee4	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ef7c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1efc0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1efd0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f0bc	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f170	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f1d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f200	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f404	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f438	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f46c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f4d0	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f57c	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1f998	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1fe34	0	NOTYPE	<unknown>	DEFAULT	2
$a	.symtab	0x1ff74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8144	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d5c4	0	NOTYPE	<unknown>	DEFAULT	9
$d	.symtab	0x819c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d5c0	0	NOTYPE	<unknown>	DEFAULT	8
$d	.symtab	0x2d668	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x81e0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d66c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x820c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8510	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8670	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x881c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8be8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x8e44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x942c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9564	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x95b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9668	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x976c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9894	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x99b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9a90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9b6c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9cac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x9f70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa04c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa398	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xa4cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x22520	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0xa840	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xab74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xacd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb2f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xb98c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xbacc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc33c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xc658	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xce38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd394	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd63c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd674	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xd8bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xdc60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf334	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf478	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf5fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf6c4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf6fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xf790	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfab4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfc58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfcec	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfd44	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfe08	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xfe4c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0xff5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10118	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10d70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10e5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10eb0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x10f38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11048	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1138c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11470	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x11f74	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x123a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12778	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2e060	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x12794	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12930	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x129d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12aac	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x12dd4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1308c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13388	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1341c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13450	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13518	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2e09c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2e068	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x24160	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1362c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x13de0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14090	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x140dc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14628	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2e1a4	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x146e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x147a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14898	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1494c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14abc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x14cd0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15194	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x153cc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15438	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15534	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x155bc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x15694	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16278	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x165a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2d5cc	0	NOTYPE	<unknown>	DEFAULT	11
$d	.symtab	0x16890	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16c58	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x16d04	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17010	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x172f4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1732c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17364	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x173a8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17414	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1744c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1748c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x174d0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17508	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x17ea4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2e1a8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x18258	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x186f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1874c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18868	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2e1c0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1891c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x189d4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18a94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18b38	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2e1d8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2e270	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x18c30	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18cc4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18d94	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x18e7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x24e18	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x19094	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19134	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2e284	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x191fc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19328	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19900	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x199c8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19a1c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19acc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19b2c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19b90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x19e34	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2e29c	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x19fc0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a0b4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a358	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2e2a8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x2e2b0	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1a598	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a674	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1a724	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x25494	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1a898	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x3476c	0	NOTYPE	<unknown>	DEFAULT	14
$d	.symtab	0x1a8c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ac64	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ba60	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x254c8	0	NOTYPE	<unknown>	DEFAULT	4
$d	.symtab	0x1bb48	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1bc80	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c208	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c374	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c454	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c600	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c6f0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c77c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c820	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1c8e8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ca5c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cb7c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cbf0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cd28	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cd9c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cde8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x2e2b8	0	NOTYPE	<unknown>	DEFAULT	13
$d	.symtab	0x1ce84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1cefc	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d0a4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1d1e4	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1da90	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1db18	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1db70	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1df8c	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e054	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e530	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e6c0	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e704	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1e754	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1ed84	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f1f8	0	NOTYPE	<unknown>	DEFAULT	2
$d	.symtab	0x1f3f8	0	NOTYPE	<unknown>	DEFAULT	2
$t	.symtab	0x80d0	0	NOTYPE	<unknown>	DEFAULT	2
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
/home/landley/work/ab7/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
C.1.3506	.symtab	0x25494	24	OBJECT	<unknown>	DEFAULT	4
C.72.5750	.symtab	0x21ea5	36	OBJECT	<unknown>	DEFAULT	4
C.90.5968	.symtab	0x22520	312	OBJECT	<unknown>	DEFAULT	4
C.96.6062	.symtab	0x226cc	12	OBJECT	<unknown>	DEFAULT	4
ClearHistory	.symtab	0xf6cc	60	FUNC	<unknown>	DEFAULT	2
HTTP	.symtab	0xab88	336	FUNC	<unknown>	DEFAULT	2
Laligned	.symtab	0x15058	0	NOTYPE	<unknown>	DEFAULT	2
Llastword	.symtab	0x15074	0	NOTYPE	<unknown>	DEFAULT	2
Q	.symtab	0x2e70c	16384	OBJECT	<unknown>	DEFAULT	14
Send	.symtab	0x84ac	104	FUNC	<unknown>	DEFAULT	2
UserAgents	.symtab	0x2d994	144	OBJECT	<unknown>	DEFAULT	13
_352	.symtab	0x10eb4	40	FUNC	<unknown>	DEFAULT	2
_376	.symtab	0x10dd0	168	FUNC	<unknown>	DEFAULT	2
_433	.symtab	0x10edc	96	FUNC	<unknown>	DEFAULT	2
_Exit	.symtab	0x1a450	44	FUNC	<unknown>	DEFAULT	2
_GLOBAL_OFFSET_TABLE_	.symtab	0x2d5e4	0	OBJECT	<unknown>	HIDDEN	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_NICK	.symtab	0x10f3c	272	FUNC	<unknown>	DEFAULT	2
_PING	.symtab	0x10e78	60	FUNC	<unknown>	DEFAULT	2
_PRIVMSG	.symtab	0x10134	3228	FUNC	<unknown>	DEFAULT	2
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b	.symtab	0x2e2a8	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x24e92	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x2e2b0	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x25192	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x2e060	4	OBJECT	<unknown>	DEFAULT	13
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x23e44	768	OBJECT	<unknown>	DEFAULT	4
__EH_FRAME_BEGIN__	.symtab	0x2d5bc	0	OBJECT	<unknown>	DEFAULT	7
__FRAME_END__	.symtab	0x2d5bc	0	OBJECT	<unknown>	DEFAULT	7
__GI___C_ctype_b	.symtab	0x2e2a8	4	OBJECT	<unknown>	HIDDEN	13
__GI___C_ctype_tolower	.symtab	0x2e2b0	4	OBJECT	<unknown>	HIDDEN	13
__GI___C_ctype_toupper	.symtab	0x2e060	4	OBJECT	<unknown>	HIDDEN	13
__GI___ctype_b	.symtab	0x2e2ac	4	OBJECT	<unknown>	HIDDEN	13
__GI___ctype_tolower	.symtab	0x2e2b4	4	OBJECT	<unknown>	HIDDEN	13
__GI___ctype_toupper	.symtab	0x2e064	4	OBJECT	<unknown>	HIDDEN	13
__GI___errno_location	.symtab	0x12780	28	FUNC	<unknown>	HIDDEN	2
__GI___fcntl_nocancel	.symtab	0x125b4	108	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1bb5c	300	FUNC	<unknown>	HIDDEN	2
__GI___fputc_unlocked	.symtab	0x14d94	264	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x1538c	24	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x1a8ac	28	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x12548	108	FUNC	<unknown>	HIDDEN	2
__GI___sigaddset	.symtab	0x1e55c	36	FUNC	<unknown>	HIDDEN	2
__GI___sigdelset	.symtab	0x1e580	36	FUNC	<unknown>	HIDDEN	2
__GI___sigismember	.symtab	0x1e538	36	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x19a64	124	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x19b34	108	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x15440	256	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x1a450	44	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x18754	296	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x172c0	56	FUNC	<unknown>	HIDDEN	2
__GI_asprintf	.symtab	0x12b18	48	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x18e84	32	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x172f8	56	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x1e710	76	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x12480	52	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x1a264	52	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x1271c	52	FUNC	<unknown>	HIDDEN	2
__GI_closedir	.symtab	0x1a4b4	248	FUNC	<unknown>	HIDDEN	2
__GI_config_close	.symtab	0x1abf0	52	FUNC	<unknown>	HIDDEN	2
__GI_config_open	.symtab	0x1ac24	72	FUNC	<unknown>	HIDDEN	2
__GI_config_read	.symtab	0x1a8c8	808	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x17330	56	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x1a154	52	FUNC	<unknown>	HIDDEN	2
__GI_endservent	.symtab	0x1c784	188	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x3476c	4	OBJECT	<unknown>	HIDDEN	14
__GI_execl	.symtab	0x19924	172	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x1a188	52	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x1909c	184	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x1279c	436	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x12548	108	FUNC	<unknown>	HIDDEN	2
__GI_fdopen	.symtab	0x1ad94	60	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x14ae8	524	FUNC	<unknown>	HIDDEN	2
__GI_fgetc	.symtab	0x1ba80	220	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1bb5c	300	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x146fc	188	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x14cf4	160	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x12950	32	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x123f0	52	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x12ae8	48	FUNC	<unknown>	HIDDEN	2
__GI_fputc	.symtab	0x147b8	244	FUNC	<unknown>	HIDDEN	2
__GI_fputc_unlocked	.symtab	0x14d94	264	FUNC	<unknown>	HIDDEN	2
__GI_fputs	.symtab	0x148ac	180	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x14e9c	56	FUNC	<unknown>	HIDDEN	2
__GI_freeaddrinfo	.symtab	0x162a0	36	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x1ec24	36	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x1ec48	336	FUNC	<unknown>	HIDDEN	2
__GI_fstat	.symtab	0x1e788	88	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x14ed4	176	FUNC	<unknown>	HIDDEN	2
__GI_getaddrinfo	.symtab	0x162c4	748	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1bb5c	300	FUNC	<unknown>	HIDDEN	2
__GI_getcwd	.symtab	0x12298	236	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x124b4	44	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x1a2cc	20	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x1a2e0	20	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x1a360	20	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyaddr_r	.symtab	0x16d34	748	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x17020	672	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x1e150	760	FUNC	<unknown>	HIDDEN	2
__GI_gethostname	.symtab	0x1e7e0	120	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x12384	40	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x123ac	20	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x1a298	52	FUNC	<unknown>	HIDDEN	2
__GI_getservbyname_r	.symtab	0x1cbfc	328	FUNC	<unknown>	HIDDEN	2
__GI_getservbyport	.symtab	0x1cb98	100	FUNC	<unknown>	HIDDEN	2
__GI_getservbyport_r	.symtab	0x1ca84	276	FUNC	<unknown>	HIDDEN	2
__GI_getservent_r	.symtab	0x1c90c	376	FUNC	<unknown>	HIDDEN	2
__GI_gettimeofday	.symtab	0x12514	52	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x1a250	20	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x34770	4	OBJECT	<unknown>	HIDDEN	14
__GI_htonl	.symtab	0x156a8	32	FUNC	<unknown>	HIDDEN	2
__GI_htons	.symtab	0x15698	16	FUNC	<unknown>	HIDDEN	2
__GI_if_freenameindex	.symtab	0x1d0ac	72	FUNC	<unknown>	HIDDEN	2
__GI_if_nameindex	.symtab	0x1cf00	428	FUNC	<unknown>	HIDDEN	2
__GI_if_nametoindex	.symtab	0x1ce88	120	FUNC	<unknown>	HIDDEN	2
__GI_in6addr_loopback	.symtab	0x24dd8	16	OBJECT	<unknown>	HIDDEN	4
__GI_inet_addr	.symtab	0x16d0c	40	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x1d0f4	248	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x16cf0	28	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x16c64	140	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x169e0	644	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x16680	540	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x18da0	228	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x12688	84	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x155f8	36	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x124e0	52	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x173ac	52	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x1f46c	100	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x1c120	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x150c0	4	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x1efc0	4	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x1c4f8	36	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x1c37c	224	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x14f90	156	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x19fd0	104	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x1a3dc	64	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x1a374	52	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x1a3a8	52	FUNC	<unknown>	HIDDEN	2
__GI_ntohl	.symtab	0x156d8	32	FUNC	<unknown>	HIDDEN	2
__GI_ntohs	.symtab	0x156c8	16	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x1a1bc	96	FUNC	<unknown>	HIDDEN	2
__GI_opendir	.symtab	0x1a67c	172	FUNC	<unknown>	HIDDEN	2
__GI_perror	.symtab	0x12970	116	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x1a21c	52	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x12264	52	FUNC	<unknown>	HIDDEN	2
__GI_putc	.symtab	0x147b8	244	FUNC	<unknown>	HIDDEN	2
__GI_putc_unlocked	.symtab	0x14d94	264	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x1750c	28	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x18894	164	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x18c38	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x1c2cc	176	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x1f438	52	FUNC	<unknown>	HIDDEN	2
__GI_readdir64	.symtab	0x1a7c0	236	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x173e0	56	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x1a2f4	108	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x12440	64	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x17418	56	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x17450	64	FUNC	<unknown>	HIDDEN	2
__GI_setservent	.symtab	0x1c840	204	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x12654	52	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x17490	68	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x18b54	228	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x1a038	136	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x1e480	184	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x1a47c	56	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x19154	172	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x174d4	56	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x12b48	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x18cc8	216	FUNC	<unknown>	HIDDEN	2
__GI_stat	.symtab	0x1ea88	88	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x153d4	108	FUNC	<unknown>	HIDDEN	2
__GI_strcasestr	.symtab	0x15540	132	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x1c608	240	FUNC	<unknown>	HIDDEN	2
__GI_strchrnul	.symtab	0x1c51c	236	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x150a0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x150a0	28	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x152ac	36	FUNC	<unknown>	HIDDEN	2
__GI_strcspn	.symtab	0x1c288	68	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x155c4	52	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x15030	96	FUNC	<unknown>	HIDDEN	2
__GI_strncmp	.symtab	0x1519c	272	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x152d0	188	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x150d0	204	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x1c6f8	64	FUNC	<unknown>	HIDDEN	2
__GI_strrchr	.symtab	0x1c4a8	80	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x1c45c	76	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x153a4	48	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x1c210	120	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x18ea4	28	FUNC	<unknown>	HIDDEN	2
__GI_strtoul	.symtab	0x18ec0	28	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x1934c	1496	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1561c	124	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x123c0	48	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x12750	48	FUNC	<unknown>	HIDDEN	2
__GI_uname	.symtab	0x1f404	52	FUNC	<unknown>	HIDDEN	2
__GI_vasprintf	.symtab	0x12b7c	136	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x1a0e0	64	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x1355c	228	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x12c04	180	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x1a120	52	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x12424	28	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x1ac6c	84	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x1ace4	176	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x1acc0	36	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x12620	52	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x2d5c8	0	OBJECT	<unknown>	DEFAULT	10
__JCR_LIST__	.symtab	0x2d5c8	0	OBJECT	<unknown>	DEFAULT	10
__adddf3	.symtab	0x1f588	784	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmpeq	.symtab	0x1fee4	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdcmple	.symtab	0x1fee4	24	FUNC	<unknown>	HIDDEN	2
__aeabi_cdrcmple	.symtab	0x1fec8	52	FUNC	<unknown>	HIDDEN	2
__aeabi_d2uiz	.symtab	0x1ff74	84	FUNC	<unknown>	HIDDEN	2
__aeabi_dadd	.symtab	0x1f588	784	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpeq	.symtab	0x1fefc	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpge	.symtab	0x1ff44	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmpgt	.symtab	0x1ff5c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmple	.symtab	0x1ff2c	24	FUNC	<unknown>	HIDDEN	2
__aeabi_dcmplt	.symtab	0x1ff14	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ddiv	.symtab	0x1fc28	524	FUNC	<unknown>	HIDDEN	2
__aeabi_dmul	.symtab	0x1f998	656	FUNC	<unknown>	HIDDEN	2
__aeabi_drsub	.symtab	0x1f57c	0	FUNC	<unknown>	HIDDEN	2
__aeabi_dsub	.symtab	0x1f584	788	FUNC	<unknown>	HIDDEN	2
__aeabi_f2d	.symtab	0x1f8e4	64	FUNC	<unknown>	HIDDEN	2
__aeabi_i2d	.symtab	0x1f8bc	40	FUNC	<unknown>	HIDDEN	2
__aeabi_idiv	.symtab	0x120f8	0	FUNC	<unknown>	HIDDEN	2
__aeabi_idivmod	.symtab	0x12224	24	FUNC	<unknown>	HIDDEN	2
__aeabi_l2d	.symtab	0x1f938	96	FUNC	<unknown>	HIDDEN	2
__aeabi_ui2d	.symtab	0x1f898	36	FUNC	<unknown>	HIDDEN	2
__aeabi_uidiv	.symtab	0x11fe4	0	FUNC	<unknown>	HIDDEN	2
__aeabi_uidivmod	.symtab	0x120e0	24	FUNC	<unknown>	HIDDEN	2
__aeabi_ul2d	.symtab	0x1f924	116	FUNC	<unknown>	HIDDEN	2
__aeabi_unwind_cpp_pr0	.symtab	0x1e77c	4	FUNC	<unknown>	DEFAULT	2
__aeabi_unwind_cpp_pr1	.symtab	0x1e780	4	FUNC	<unknown>	DEFAULT	2
__aeabi_unwind_cpp_pr2	.symtab	0x1e784	4	FUNC	<unknown>	DEFAULT	2
__app_fini	.symtab	0x34764	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x2e284	24	OBJECT	<unknown>	DEFAULT	13
__bss_end__	.symtab	0x35de0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start	.symtab	0x2e2d4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__bss_start__	.symtab	0x2e2d4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x19ae0	84	FUNC	<unknown>	DEFAULT	2
__close_nameservers	.symtab	0x1dfd4	152	FUNC	<unknown>	HIDDEN	2
__cmpdf2	.symtab	0x1fe44	132	FUNC	<unknown>	HIDDEN	2
__ctype_b	.symtab	0x2e2ac	4	OBJECT	<unknown>	DEFAULT	13
__ctype_tolower	.symtab	0x2e2b4	4	OBJECT	<unknown>	DEFAULT	13
__ctype_toupper	.symtab	0x2e064	4	OBJECT	<unknown>	DEFAULT	13
__curbrk	.symtab	0x347b0	4	OBJECT	<unknown>	HIDDEN	14
__data_start	.symtab	0x2d664	0	NOTYPE	<unknown>	DEFAULT	13
__decode_dotted	.symtab	0x1d1ec	248	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x1f0bc	180	FUNC	<unknown>	HIDDEN	2
__default_rt_sa_restorer	.symtab	0x1a0d0	0	FUNC	<unknown>	DEFAULT	2
__default_sa_restorer	.symtab	0x1a0c4	0	FUNC	<unknown>	DEFAULT	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__div0	.symtab	0x1223c	20	FUNC	<unknown>	HIDDEN	2
__divdf3	.symtab	0x1fc28	524	FUNC	<unknown>	HIDDEN	2
__divsi3	.symtab	0x120f8	300	FUNC	<unknown>	HIDDEN	2
__dns_lookup	.symtab	0x1d2e4	2024	FUNC	<unknown>	HIDDEN	2
__do_global_dtors_aux	.symtab	0x810c	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux_fini_array_entry	.symtab	0x2d5c4	0	OBJECT	<unknown>	DEFAULT	9
__dso_handle	.symtab	0x2d664	0	OBJECT	<unknown>	HIDDEN	13
__encode_dotted	.symtab	0x1f4d0	172	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x1efd0	236	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x1f170	96	FUNC	<unknown>	HIDDEN	2
__end__	.symtab	0x35de0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__environ	.symtab	0x3475c	4	OBJECT	<unknown>	DEFAULT	14
__eqdf2	.symtab	0x1fe44	132	FUNC	<unknown>	HIDDEN	2
__errno_location	.symtab	0x12780	28	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__error	.symtab	0x1a11c	0	NOTYPE	<unknown>	DEFAULT	2
__exidx_end	.symtab	0x255bc	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exidx_start	.symtab	0x255ac	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x34754	4	OBJECT	<unknown>	HIDDEN	14
__extendsfdf2	.symtab	0x1f8e4	64	FUNC	<unknown>	HIDDEN	2
__fcntl_nocancel	.symtab	0x125b4	108	FUNC	<unknown>	DEFAULT	2
__fgetc_unlocked	.symtab	0x1bb5c	300	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x2d5c8	0	NOTYPE	<unknown>	HIDDEN	9
__fini_array_start	.symtab	0x2d5c4	0	NOTYPE	<unknown>	HIDDEN	9
__fixunsdfsi	.symtab	0x1ff74	84	FUNC	<unknown>	HIDDEN	2
__floatdidf	.symtab	0x1f938	96	FUNC	<unknown>	HIDDEN	2
__floatsidf	.symtab	0x1f8bc	40	FUNC	<unknown>	HIDDEN	2
__floatundidf	.symtab	0x1f924	116	FUNC	<unknown>	HIDDEN	2
__floatunsidf	.symtab	0x1f898	36	FUNC	<unknown>	HIDDEN	2
__fputc_unlocked	.symtab	0x14d94	264	FUNC	<unknown>	DEFAULT	2
__frame_dummy_init_array_entry	.symtab	0x2d5c0	0	OBJECT	<unknown>	DEFAULT	8
__gedf2	.symtab	0x1fe34	148	FUNC	<unknown>	HIDDEN	2
__get_hosts_byaddr_r	.symtab	0x1e06c	152	FUNC	<unknown>	HIDDEN	2
__get_hosts_byname_r	.symtab	0x1e104	76	FUNC	<unknown>	HIDDEN	2
__getdents64	.symtab	0x1eae0	324	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x12384	40	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x1538c	24	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__gtdf2	.symtab	0x1fe34	148	FUNC	<unknown>	HIDDEN	2
__h_errno_location	.symtab	0x1a8ac	28	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x2d5c4	0	NOTYPE	<unknown>	HIDDEN	8
__init_array_start	.symtab	0x2d5c0	0	NOTYPE	<unknown>	HIDDEN	8
__initbuf	.symtab	0x1c738	76	FUNC	<unknown>	DEFAULT	2
__ledf2	.symtab	0x1fe3c	140	FUNC	<unknown>	HIDDEN	2
__libc_accept	.symtab	0x172c0	56	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x1271c	52	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x17330	56	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x12548	108	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x123f0	52	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x1f46c	100	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x1a3a8	52	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x1a1bc	96	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x1f438	52	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x173e0	56	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x12440	64	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x17418	56	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x17450	64	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x1a038	136	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x34758	4	OBJECT	<unknown>	DEFAULT	14
__libc_system	.symtab	0x19e74	348	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x12424	28	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x12620	52	FUNC	<unknown>	DEFAULT	2
__local_nameserver	.symtab	0x25574	16	OBJECT	<unknown>	HIDDEN	4
__ltdf2	.symtab	0x1fe3c	140	FUNC	<unknown>	HIDDEN	2
__malloc_consolidate	.symtab	0x18324	436	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x17528	120	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x2e1a8	24	OBJECT	<unknown>	DEFAULT	13
__malloc_state	.symtab	0x35a44	888	OBJECT	<unknown>	DEFAULT	14
__malloc_trim	.symtab	0x18274	176	FUNC	<unknown>	DEFAULT	2
__muldf3	.symtab	0x1f998	656	FUNC	<unknown>	HIDDEN	2
__nameserver	.symtab	0x35dc4	4	OBJECT	<unknown>	HIDDEN	14
__nameservers	.symtab	0x35dc8	4	OBJECT	<unknown>	HIDDEN	14
__nedf2	.symtab	0x1fe44	132	FUNC	<unknown>	HIDDEN	2
__open_etc_hosts	.symtab	0x1f1d0	48	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x1db78	1116	FUNC	<unknown>	HIDDEN	2
__opensock	.symtab	0x1e448	56	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x34760	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x2d5c0	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x2d5c0	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__progname	.symtab	0x2e2a0	4	OBJECT	<unknown>	DEFAULT	13
__progname_full	.symtab	0x2e2a4	4	OBJECT	<unknown>	DEFAULT	13
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x19a28	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x19a20	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x19a20	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x19a20	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x19a20	8	FUNC	<unknown>	DEFAULT	2
__read_etc_hosts_r	.symtab	0x1f200	516	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__res_sync	.symtab	0x35dbc	4	OBJECT	<unknown>	HIDDEN	14
__resolv_attempts	.symtab	0x2e2d3	1	OBJECT	<unknown>	HIDDEN	13
__resolv_lock	.symtab	0x34794	24	OBJECT	<unknown>	DEFAULT	14
__resolv_timeout	.symtab	0x2e2d2	1	OBJECT	<unknown>	HIDDEN	13
__rtld_fini	.symtab	0x34768	4	OBJECT	<unknown>	HIDDEN	14
__searchdomain	.symtab	0x35dc0	4	OBJECT	<unknown>	HIDDEN	14
__searchdomains	.symtab	0x35dcc	4	OBJECT	<unknown>	HIDDEN	14
__set_h_errno	.symtab	0x157bc	28	FUNC	<unknown>	DEFAULT	2
__sigaddset	.symtab	0x1e55c	36	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x1e580	36	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x1e538	36	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x2e0a8	4	OBJECT	<unknown>	DEFAULT	13
__stdio_READ	.symtab	0x1ed98	88	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x1add0	180	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x1edf0	196	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x1ae84	320	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x13424	52	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4636	.symtab	0x24160	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x1eeb4	48	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x1ef7c	60	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x1eee4	152	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x1afc4	208	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x1352c	48	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x2e0ac	4	OBJECT	<unknown>	DEFAULT	13
__subdf3	.symtab	0x1f584	788	FUNC	<unknown>	HIDDEN	2
__syscall_error	.symtab	0x1e75c	32	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x1a41c	52	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x19a64	124	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x19b34	108	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x19ba0	724	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x2e29c	4	OBJECT	<unknown>	HIDDEN	13
__udivsi3	.symtab	0x11fe4	252	FUNC	<unknown>	HIDDEN	2
__vfork	.symtab	0x1a0e0	64	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x15440	256	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__xstat32_conv	.symtab	0x1e924	172	FUNC	<unknown>	HIDDEN	2
__xstat64_conv	.symtab	0x1e858	204	FUNC	<unknown>	HIDDEN	2
__xstat_conv	.symtab	0x1e9d0	184	FUNC	<unknown>	HIDDEN	2
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_bss_custom_printf_spec	.symtab	0x34730	10	OBJECT	<unknown>	DEFAULT	14
_bss_end__	.symtab	0x35de0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_call_via_fp	.symtab	0x80fd	4	FUNC	<unknown>	HIDDEN	2
_call_via_ip	.symtab	0x8101	4	FUNC	<unknown>	HIDDEN	2
_call_via_lr	.symtab	0x8109	4	FUNC	<unknown>	HIDDEN	2
_call_via_r0	.symtab	0x80d1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r1	.symtab	0x80d5	4	FUNC	<unknown>	HIDDEN	2
_call_via_r2	.symtab	0x80d9	4	FUNC	<unknown>	HIDDEN	2
_call_via_r3	.symtab	0x80dd	4	FUNC	<unknown>	HIDDEN	2
_call_via_r4	.symtab	0x80e1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r5	.symtab	0x80e5	4	FUNC	<unknown>	HIDDEN	2
_call_via_r6	.symtab	0x80e9	4	FUNC	<unknown>	HIDDEN	2
_call_via_r7	.symtab	0x80ed	4	FUNC	<unknown>	HIDDEN	2
_call_via_r8	.symtab	0x80f1	4	FUNC	<unknown>	HIDDEN	2
_call_via_r9	.symtab	0x80f5	4	FUNC	<unknown>	HIDDEN	2
_call_via_sl	.symtab	0x80f9	4	FUNC	<unknown>	HIDDEN	2
_call_via_sp	.symtab	0x8105	4	FUNC	<unknown>	HIDDEN	2
_charpad	.symtab	0x13640	84	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_custom_printf_arginfo	.symtab	0x359f4	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_handler	.symtab	0x35a1c	40	OBJECT	<unknown>	HIDDEN	14
_custom_printf_spec	.symtab	0x2e1a4	4	OBJECT	<unknown>	HIDDEN	13
_dl_aux_init	.symtab	0x1e6d8	56	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x35dd8	4	OBJECT	<unknown>	DEFAULT	14
_dl_phnum	.symtab	0x35ddc	4	OBJECT	<unknown>	DEFAULT	14
_edata	.symtab	0x2e2d4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x35de0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x3476c	4	OBJECT	<unknown>	DEFAULT	14
_exit	.symtab	0x1a450	44	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1ffc8	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x32730	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x13694	132	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x1b28c	2036	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x34770	4	OBJECT	<unknown>	DEFAULT	14
_init	.symtab	0x80b4	0	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x1b094	112	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_memcpy	.symtab	0x1bc90	0	FUNC	<unknown>	HIDDEN	2
_ppfs_init	.symtab	0x13e00	160	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x140e8	1392	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x13ea0	68	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x13ee4	432	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x14094	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x19a38	44	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x19a30	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x35dd0	8	OBJECT	<unknown>	HIDDEN	14
_start	.symtab	0x81b0	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x130b4	776	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x133bc	104	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x2e0b0	4	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_add_lock	.symtab	0x2e068	24	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_dec_use	.symtab	0x14960	392	FUNC	<unknown>	HIDDEN	2
_stdio_openlist_del_count	.symtab	0x3272c	4	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_del_lock	.symtab	0x2e080	24	OBJECT	<unknown>	DEFAULT	13
_stdio_openlist_use_count	.symtab	0x32728	4	OBJECT	<unknown>	DEFAULT	14
_stdio_streams	.symtab	0x2e0b4	240	OBJECT	<unknown>	DEFAULT	13
_stdio_term	.symtab	0x13458	212	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x2e098	4	OBJECT	<unknown>	DEFAULT	13
_stdlib_strto_l	.symtab	0x18edc	448	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x1b104	44	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x24230	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x1b130	348	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x13718	1768	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x18754	296	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
accept	.symtab	0x172c0	56	FUNC	<unknown>	DEFAULT	2
accept.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
actualparent	.symtab	0x348c8	4	OBJECT	<unknown>	DEFAULT	14
advance_telstate	.symtab	0xd8fc	116	FUNC	<unknown>	DEFAULT	2
advances	.symtab	0x2dec4	28	OBJECT	<unknown>	DEFAULT	13
advances2	.symtab	0x2df24	44	OBJECT	<unknown>	DEFAULT	13
aeabi_unwind_cpp_pr1.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ak47scan	.symtab	0xf37c	256	FUNC	<unknown>	DEFAULT	2
ak47scantoggle	.symtab	0xf47c	432	FUNC	<unknown>	DEFAULT	2
ak47telscan	.symtab	0xd9f8	6532	FUNC	<unknown>	DEFAULT	2
append	.symtab	0xfcf8	80	FUNC	<unknown>	DEFAULT	2
asprintf	.symtab	0x12b18	48	FUNC	<unknown>	DEFAULT	2
asprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x18e84	32	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x18e84	32	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x15090	16	FUNC	<unknown>	DEFAULT	2
been_there_done_that	.symtab	0x34750	4	OBJECT	<unknown>	DEFAULT	14
bind	.symtab	0x172f8	56	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
blacknurse	.symtab	0x9cb8	716	FUNC	<unknown>	DEFAULT	2
botkill	.symtab	0xf62c	160	FUNC	<unknown>	DEFAULT	2
brk	.symtab	0x1e710	76	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x1e480	184	FUNC	<unknown>	DEFAULT	2
buf.2975	.symtab	0x34740	16	OBJECT	<unknown>	DEFAULT	14
c	.symtab	0x2df60	4	OBJECT	<unknown>	DEFAULT	13

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 15:01:49.197345972 CET	46911	53	192.168.2.13	1.1.1.1
Dec 28, 2024 15:01:49.511214972 CET	53	46911	1.1.1.1	192.168.2.13
Dec 28, 2024 15:01:50.560154915 CET	59596	53	192.168.2.13	1.1.1.1
Dec 28, 2024 15:01:50.560210943 CET	60664	53	192.168.2.13	1.1.1.1
Dec 28, 2024 15:01:50.700576067 CET	53	60664	1.1.1.1	192.168.2.13
Dec 28, 2024 15:01:50.785840034 CET	53	59596	1.1.1.1	192.168.2.13

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 28, 2024 15:01:49.197345972 CET	192.168.2.13	1.1.1.1	0x240c	Standard query (0)	pirati.privatedns.org	A (IP address)	IN (0x0001)	false
Dec 28, 2024 15:01:50.560154915 CET	192.168.2.13	1.1.1.1	0xacfd	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 15:01:50.560210943 CET	192.168.2.13	1.1.1.1	0xc0de	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 28, 2024 15:01:49.511214972 CET	1.1.1.1	192.168.2.13	0x240c	No error (0)	pirati.privatedns.org	79.12.214.240	A (IP address)	IN (0x0001)	false
Dec 28, 2024 15:01:50.785840034 CET	1.1.1.1	192.168.2.13	0xacfd	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 28, 2024 15:01:50.785840034 CET	1.1.1.1	192.168.2.13	0xacfd	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: yakuza.arm6.elf PID: 5431, Parent PID: 5356

General

Start time (UTC):	14:01:48
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	/tmp/yakuza.arm6.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: yakuza.arm6.elf PID: 5433, Parent PID: 5431

General

Start time (UTC):	14:01:48
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: yakuza.arm6.elf PID: 5435, Parent PID: 5433

General

Start time (UTC):	14:01:48
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: yakuza.arm6.elf PID: 5439, Parent PID: 5433

General

Start time (UTC):	14:01:48
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: yakuza.arm6.elf PID: 5446, Parent PID: 5433

General

Start time (UTC):	14:01:48
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: sh PID: 5446, Parent PID: 5433

General

Start time (UTC):	14:01:48
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 902i13 \|\| busybox pkill -9 902i13"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5452, Parent PID: 5446

General

Start time (UTC):	14:01:48
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5452, Parent PID: 5446

General

Start time (UTC):	14:01:48
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 902i13
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5481, Parent PID: 5446

General

Start time (UTC):	14:01:52
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5481, Parent PID: 5446

General

Start time (UTC):	14:01:52
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 902i13
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.arm6.elf PID: 5482, Parent PID: 5433

General

Start time (UTC):	14:01:53
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: sh PID: 5482, Parent PID: 5433

General

Start time (UTC):	14:01:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 BzSxLxBxeY \|\| busybox pkill -9 BzSxLxBxeY"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5487, Parent PID: 5482

General

Start time (UTC):	14:01:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5487, Parent PID: 5482

General

Start time (UTC):	14:01:53
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 BzSxLxBxeY
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5490, Parent PID: 5482

General

Start time (UTC):	14:01:54
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5490, Parent PID: 5482

General

Start time (UTC):	14:01:54
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 BzSxLxBxeY
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.arm6.elf PID: 5491, Parent PID: 5433

General

Start time (UTC):	14:01:55
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: sh PID: 5491, Parent PID: 5433

General

Start time (UTC):	14:01:55
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 HOHO-LUGO7 \|\| busybox pkill -9 HOHO-LUGO7"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5497, Parent PID: 5491

General

Start time (UTC):	14:01:55
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5497, Parent PID: 5491

General

Start time (UTC):	14:01:55
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 HOHO-LUGO7
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5504, Parent PID: 5491

General

Start time (UTC):	14:01:57
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5504, Parent PID: 5491

General

Start time (UTC):	14:01:57
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 HOHO-LUGO7
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.arm6.elf PID: 5505, Parent PID: 5433

General

Start time (UTC):	14:01:58
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: sh PID: 5505, Parent PID: 5433

General

Start time (UTC):	14:01:58
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 HOHO-U79OL \|\| busybox pkill -9 HOHO-U79OL"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5507, Parent PID: 5505

General

Start time (UTC):	14:01:58
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5507, Parent PID: 5505

General

Start time (UTC):	14:01:58
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 HOHO-U79OL
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5510, Parent PID: 5505

General

Start time (UTC):	14:01:59
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5510, Parent PID: 5505

General

Start time (UTC):	14:01:59
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 HOHO-U79OL
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.arm6.elf PID: 5511, Parent PID: 5433

General

Start time (UTC):	14:02:00
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: sh PID: 5511, Parent PID: 5433

General

Start time (UTC):	14:02:00
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 JuYfouyf87 \|\| busybox pkill -9 JuYfouyf87"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5516, Parent PID: 5511

General

Start time (UTC):	14:02:00
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5516, Parent PID: 5511

General

Start time (UTC):	14:02:00
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 JuYfouyf87
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5517, Parent PID: 5511

General

Start time (UTC):	14:02:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5517, Parent PID: 5511

General

Start time (UTC):	14:02:01
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 JuYfouyf87
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.arm6.elf PID: 5518, Parent PID: 5433

General

Start time (UTC):	14:02:02
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: sh PID: 5518, Parent PID: 5433

General

Start time (UTC):	14:02:02
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5520, Parent PID: 5518

General

Start time (UTC):	14:02:02
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5520, Parent PID: 5518

General

Start time (UTC):	14:02:02
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeR69xd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5521, Parent PID: 5518

General

Start time (UTC):	14:02:03
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5521, Parent PID: 5518

General

Start time (UTC):	14:02:03
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeR69xd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.arm6.elf PID: 5524, Parent PID: 5433

General

Start time (UTC):	14:02:04
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: sh PID: 5524, Parent PID: 5433

General

Start time (UTC):	14:02:04
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5529, Parent PID: 5524

General

Start time (UTC):	14:02:04
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5529, Parent PID: 5524

General

Start time (UTC):	14:02:04
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SO190Ij1X
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5530, Parent PID: 5524

General

Start time (UTC):	14:02:06
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5530, Parent PID: 5524

General

Start time (UTC):	14:02:06
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SO190Ij1X
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.arm6.elf PID: 5531, Parent PID: 5433

General

Start time (UTC):	14:02:07
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: sh PID: 5531, Parent PID: 5433

General

Start time (UTC):	14:02:07
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 LOLKIKEEEDDE \|\| busybox pkill -9 LOLKIKEEEDDE"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5536, Parent PID: 5531

General

Start time (UTC):	14:02:07
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5536, Parent PID: 5531

General

Start time (UTC):	14:02:07
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 LOLKIKEEEDDE
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5537, Parent PID: 5531

General

Start time (UTC):	14:02:08
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5537, Parent PID: 5531

General

Start time (UTC):	14:02:08
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 LOLKIKEEEDDE
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.arm6.elf PID: 5558, Parent PID: 5433

General

Start time (UTC):	14:02:09
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: sh PID: 5558, Parent PID: 5433

General

Start time (UTC):	14:02:09
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ekjheory98e \|\| busybox pkill -9 ekjheory98e"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5563, Parent PID: 5558

General

Start time (UTC):	14:02:09
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5563, Parent PID: 5558

General

Start time (UTC):	14:02:09
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ekjheory98e
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5565, Parent PID: 5558

General

Start time (UTC):	14:02:10
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5565, Parent PID: 5558

General

Start time (UTC):	14:02:10
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ekjheory98e
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.arm6.elf PID: 5566, Parent PID: 5433

General

Start time (UTC):	14:02:11
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: sh PID: 5566, Parent PID: 5433

General

Start time (UTC):	14:02:11
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scansh4 \|\| busybox pkill -9 scansh4"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5572, Parent PID: 5566

General

Start time (UTC):	14:02:11
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5572, Parent PID: 5566

General

Start time (UTC):	14:02:11
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 scansh4
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5573, Parent PID: 5566

General

Start time (UTC):	14:02:12
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5573, Parent PID: 5566

General

Start time (UTC):	14:02:12
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scansh4
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.arm6.elf PID: 5574, Parent PID: 5433

General

Start time (UTC):	14:02:13
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: sh PID: 5574, Parent PID: 5433

General

Start time (UTC):	14:02:13
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MDMA \|\| busybox pkill -9 MDMA"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5576, Parent PID: 5574

General

Start time (UTC):	14:02:13
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5576, Parent PID: 5574

General

Start time (UTC):	14:02:13
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MDMA
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5579, Parent PID: 5574

General

Start time (UTC):	14:02:14
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5579, Parent PID: 5574

General

Start time (UTC):	14:02:14
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MDMA
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.arm6.elf PID: 5580, Parent PID: 5433

General

Start time (UTC):	14:02:15
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: sh PID: 5580, Parent PID: 5433

General

Start time (UTC):	14:02:15
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 fdevalvex \|\| busybox pkill -9 fdevalvex"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5585, Parent PID: 5580

General

Start time (UTC):	14:02:15
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5585, Parent PID: 5580

General

Start time (UTC):	14:02:15
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 fdevalvex
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5586, Parent PID: 5580

General

Start time (UTC):	14:02:17
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5586, Parent PID: 5580

General

Start time (UTC):	14:02:17
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 fdevalvex
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.arm6.elf PID: 5587, Parent PID: 5433

General

Start time (UTC):	14:02:18
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: sh PID: 5587, Parent PID: 5433

General

Start time (UTC):	14:02:18
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scanspc \|\| busybox pkill -9 scanspc"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5592, Parent PID: 5587

General

Start time (UTC):	14:02:18
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5592, Parent PID: 5587

General

Start time (UTC):	14:02:18
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 scanspc
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5595, Parent PID: 5587

General

Start time (UTC):	14:02:19
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5595, Parent PID: 5587

General

Start time (UTC):	14:02:19
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scanspc
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.arm6.elf PID: 5596, Parent PID: 5433

General

Start time (UTC):	14:02:20
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: sh PID: 5596, Parent PID: 5433

General

Start time (UTC):	14:02:20
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MELTEDNINJAREALZ \|\| busybox pkill -9 MELTEDNINJAREALZ"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5601, Parent PID: 5596

General

Start time (UTC):	14:02:20
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5601, Parent PID: 5596

General

Start time (UTC):	14:02:20
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MELTEDNINJAREALZ
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5602, Parent PID: 5596

General

Start time (UTC):	14:02:21
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5602, Parent PID: 5596

General

Start time (UTC):	14:02:21
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MELTEDNINJAREALZ
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.arm6.elf PID: 5603, Parent PID: 5433

General

Start time (UTC):	14:02:22
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: sh PID: 5603, Parent PID: 5433

General

Start time (UTC):	14:02:22
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 flexsonskids \|\| busybox pkill -9 flexsonskids"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5605, Parent PID: 5603

General

Start time (UTC):	14:02:22
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5605, Parent PID: 5603

General

Start time (UTC):	14:02:22
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 flexsonskids
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5606, Parent PID: 5603

General

Start time (UTC):	14:02:23
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5606, Parent PID: 5603

General

Start time (UTC):	14:02:23
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 flexsonskids
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5609, Parent PID: 5433

General

Start time (UTC):	14:02:24
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5609, Parent PID: 5433

General

Start time (UTC):	14:02:24
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scanx86 \|\| busybox pkill -9 scanx86"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5611, Parent PID: 5609

General

Start time (UTC):	14:02:24
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5611, Parent PID: 5609

General

Start time (UTC):	14:02:24
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 scanx86
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5612, Parent PID: 5609

General

Start time (UTC):	14:02:26
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5612, Parent PID: 5609

General

Start time (UTC):	14:02:26
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scanx86
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5613, Parent PID: 5433

General

Start time (UTC):	14:02:27
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5613, Parent PID: 5433

General

Start time (UTC):	14:02:27
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MISAKI-U79OL \|\| busybox pkill -9 MISAKI-U79OL"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5615, Parent PID: 5613

General

Start time (UTC):	14:02:27
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5615, Parent PID: 5613

General

Start time (UTC):	14:02:27
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MISAKI-U79OL
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5616, Parent PID: 5613

General

Start time (UTC):	14:02:28
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5616, Parent PID: 5613

General

Start time (UTC):	14:02:28
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MISAKI-U79OL
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5619, Parent PID: 5433

General

Start time (UTC):	14:02:29
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5619, Parent PID: 5433

General

Start time (UTC):	14:02:29
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 foAxi102kxe \|\| busybox pkill -9 foAxi102kxe"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5625, Parent PID: 5619

General

Start time (UTC):	14:02:29
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5625, Parent PID: 5619

General

Start time (UTC):	14:02:29
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 foAxi102kxe
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5626, Parent PID: 5619

General

Start time (UTC):	14:02:30
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5626, Parent PID: 5619

General

Start time (UTC):	14:02:30
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 foAxi102kxe
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5627, Parent PID: 5433

General

Start time (UTC):	14:02:31
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5627, Parent PID: 5433

General

Start time (UTC):	14:02:31
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 swodjwodjwoj \|\| busybox pkill -9 swodjwodjwoj"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5632, Parent PID: 5627

General

Start time (UTC):	14:02:31
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5632, Parent PID: 5627

General

Start time (UTC):	14:02:31
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 swodjwodjwoj
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5633, Parent PID: 5627

General

Start time (UTC):	14:02:32
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5633, Parent PID: 5627

General

Start time (UTC):	14:02:32
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 swodjwodjwoj
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5634, Parent PID: 5433

General

Start time (UTC):	14:02:33
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5634, Parent PID: 5433

General

Start time (UTC):	14:02:33
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MmKiy7f87l \|\| busybox pkill -9 MmKiy7f87l"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5636, Parent PID: 5634

General

Start time (UTC):	14:02:33
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5636, Parent PID: 5634

General

Start time (UTC):	14:02:33
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MmKiy7f87l
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5639, Parent PID: 5634

General

Start time (UTC):	14:02:34
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5639, Parent PID: 5634

General

Start time (UTC):	14:02:34
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MmKiy7f87l
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5640, Parent PID: 5433

General

Start time (UTC):	14:02:35
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5640, Parent PID: 5433

General

Start time (UTC):	14:02:35
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 freecookiex86 \|\| busybox pkill -9 freecookiex86"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5645, Parent PID: 5640

General

Start time (UTC):	14:02:35
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5645, Parent PID: 5640

General

Start time (UTC):	14:02:35
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 freecookiex86
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5646, Parent PID: 5640

General

Start time (UTC):	14:02:37
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5646, Parent PID: 5640

General

Start time (UTC):	14:02:37
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 freecookiex86
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5647, Parent PID: 5433

General

Start time (UTC):	14:02:38
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5647, Parent PID: 5433

General

Start time (UTC):	14:02:38
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 sysgpu \|\| busybox pkill -9 sysgpu"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5649, Parent PID: 5647

General

Start time (UTC):	14:02:38
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5649, Parent PID: 5647

General

Start time (UTC):	14:02:38
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 sysgpu
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5654, Parent PID: 5647

General

Start time (UTC):	14:02:39
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5654, Parent PID: 5647

General

Start time (UTC):	14:02:39
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 sysgpu
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5656, Parent PID: 5433

General

Start time (UTC):	14:02:40
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5656, Parent PID: 5433

General

Start time (UTC):	14:02:40
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5662, Parent PID: 5656

General

Start time (UTC):	14:02:40
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5662, Parent PID: 5656

General

Start time (UTC):	14:02:40
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeR69xd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5663, Parent PID: 5656

General

Start time (UTC):	14:02:41
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5663, Parent PID: 5656

General

Start time (UTC):	14:02:41
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeR69xd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5664, Parent PID: 5433

General

Start time (UTC):	14:02:42
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5664, Parent PID: 5433

General

Start time (UTC):	14:02:42
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 frgege \|\| busybox pkill -9 frgege"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5669, Parent PID: 5664

General

Start time (UTC):	14:02:42
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5669, Parent PID: 5664

General

Start time (UTC):	14:02:42
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 frgege
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5670, Parent PID: 5664

General

Start time (UTC):	14:02:43
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5670, Parent PID: 5664

General

Start time (UTC):	14:02:43
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 frgege
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5673, Parent PID: 5433

General

Start time (UTC):	14:02:44
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5673, Parent PID: 5433

General

Start time (UTC):	14:02:44
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 sysupdater \|\| busybox pkill -9 sysupdater"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5675, Parent PID: 5673

General

Start time (UTC):	14:02:44
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5675, Parent PID: 5673

General

Start time (UTC):	14:02:44
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 sysupdater
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5676, Parent PID: 5673

General

Start time (UTC):	14:02:45
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5676, Parent PID: 5673

General

Start time (UTC):	14:02:45
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 sysupdater
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5677, Parent PID: 5433

General

Start time (UTC):	14:02:46
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5677, Parent PID: 5433

General

Start time (UTC):	14:02:46
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 0DnAzepd \|\| busybox pkill -9 0DnAzepd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5682, Parent PID: 5677

General

Start time (UTC):	14:02:46
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5682, Parent PID: 5677

General

Start time (UTC):	14:02:46
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 0DnAzepd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5683, Parent PID: 5677

General

Start time (UTC):	14:02:48
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5683, Parent PID: 5677

General

Start time (UTC):	14:02:48
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 0DnAzepd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5686, Parent PID: 5433

General

Start time (UTC):	14:02:49
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5686, Parent PID: 5433

General

Start time (UTC):	14:02:49
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeRD0nks69 \|\| busybox pkill -9 NiGGeRD0nks69"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5691, Parent PID: 5686

General

Start time (UTC):	14:02:49
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5691, Parent PID: 5686

General

Start time (UTC):	14:02:49
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeRD0nks69
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5692, Parent PID: 5686

General

Start time (UTC):	14:02:50
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5692, Parent PID: 5686

General

Start time (UTC):	14:02:50
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeRD0nks69
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5693, Parent PID: 5433

General

Start time (UTC):	14:02:51
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5693, Parent PID: 5433

General

Start time (UTC):	14:02:51
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 frgreu \|\| busybox pkill -9 frgreu"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5697, Parent PID: 5693

General

Start time (UTC):	14:02:51
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5697, Parent PID: 5693

General

Start time (UTC):	14:02:51
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 frgreu
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5699, Parent PID: 5693

General

Start time (UTC):	14:02:52
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5699, Parent PID: 5693

General

Start time (UTC):	14:02:52
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 frgreu
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5700, Parent PID: 5433

General

Start time (UTC):	14:02:53
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5700, Parent PID: 5433

General

Start time (UTC):	14:02:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 telnetd \|\| busybox pkill -9 telnetd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5702, Parent PID: 5700

General

Start time (UTC):	14:02:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5702, Parent PID: 5700

General

Start time (UTC):	14:02:53
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 telnetd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5705, Parent PID: 5700

General

Start time (UTC):	14:02:54
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5705, Parent PID: 5700

General

Start time (UTC):	14:02:54
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 telnetd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5706, Parent PID: 5433

General

Start time (UTC):	14:02:55
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5706, Parent PID: 5433

General

Start time (UTC):	14:02:55
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 0x766f6964 \|\| busybox pkill -9 0x766f6964"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5712, Parent PID: 5706

General

Start time (UTC):	14:02:55
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5712, Parent PID: 5706

General

Start time (UTC):	14:02:55
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 0x766f6964
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5713, Parent PID: 5706

General

Start time (UTC):	14:02:57
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5713, Parent PID: 5706

General

Start time (UTC):	14:02:57
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 0x766f6964
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5714, Parent PID: 5433

General

Start time (UTC):	14:02:58
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5714, Parent PID: 5433

General

Start time (UTC):	14:02:58
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeRd0nks1337 \|\| busybox pkill -9 NiGGeRd0nks1337"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5719, Parent PID: 5714

General

Start time (UTC):	14:02:58
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5719, Parent PID: 5714

General

Start time (UTC):	14:02:58
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeRd0nks1337
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5722, Parent PID: 5714

General

Start time (UTC):	14:02:59
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5722, Parent PID: 5714

General

Start time (UTC):	14:02:59
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeRd0nks1337
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5723, Parent PID: 5433

General

Start time (UTC):	14:03:00
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5723, Parent PID: 5433

General

Start time (UTC):	14:03:00
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 gaft \|\| busybox pkill -9 gaft"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5728, Parent PID: 5723

General

Start time (UTC):	14:03:00
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5728, Parent PID: 5723

General

Start time (UTC):	14:03:00
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 gaft
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5729, Parent PID: 5723

General

Start time (UTC):	14:03:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5729, Parent PID: 5723

General

Start time (UTC):	14:03:01
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 gaft
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5730, Parent PID: 5433

General

Start time (UTC):	14:03:02
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5730, Parent PID: 5433

General

Start time (UTC):	14:03:02
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 urasgbsigboa \|\| busybox pkill -9 urasgbsigboa"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5732, Parent PID: 5730

General

Start time (UTC):	14:03:02
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5732, Parent PID: 5730

General

Start time (UTC):	14:03:02
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 urasgbsigboa
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5735, Parent PID: 5730

General

Start time (UTC):	14:03:04
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5735, Parent PID: 5730

General

Start time (UTC):	14:03:04
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 urasgbsigboa
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5736, Parent PID: 5433

General

Start time (UTC):	14:03:05
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5736, Parent PID: 5433

General

Start time (UTC):	14:03:05
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 120i3UI49 \|\| busybox pkill -9 120i3UI49"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5741, Parent PID: 5736

General

Start time (UTC):	14:03:05
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5741, Parent PID: 5736

General

Start time (UTC):	14:03:05
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 120i3UI49
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5742, Parent PID: 5736

General

Start time (UTC):	14:03:06
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5742, Parent PID: 5736

General

Start time (UTC):	14:03:06
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 120i3UI49
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5743, Parent PID: 5433

General

Start time (UTC):	14:03:07
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5743, Parent PID: 5433

General

Start time (UTC):	14:03:07
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 OaF3 \|\| busybox pkill -9 OaF3"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5748, Parent PID: 5743

General

Start time (UTC):	14:03:07
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5748, Parent PID: 5743

General

Start time (UTC):	14:03:07
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 OaF3
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5749, Parent PID: 5743

General

Start time (UTC):	14:03:08
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5749, Parent PID: 5743

General

Start time (UTC):	14:03:08
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 OaF3
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5752, Parent PID: 5433

General

Start time (UTC):	14:03:09
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5752, Parent PID: 5433

General

Start time (UTC):	14:03:09
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 geae \|\| busybox pkill -9 geae"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5757, Parent PID: 5752

General

Start time (UTC):	14:03:09
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5757, Parent PID: 5752

General

Start time (UTC):	14:03:09
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 geae
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5759, Parent PID: 5752

General

Start time (UTC):	14:03:10
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5759, Parent PID: 5752

General

Start time (UTC):	14:03:10
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 geae
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5760, Parent PID: 5433

General

Start time (UTC):	14:03:11
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5760, Parent PID: 5433

General

Start time (UTC):	14:03:11
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 vaiolmao \|\| busybox pkill -9 vaiolmao"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5766, Parent PID: 5760

General

Start time (UTC):	14:03:11
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5766, Parent PID: 5760

General

Start time (UTC):	14:03:11
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 vaiolmao
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5767, Parent PID: 5760

General

Start time (UTC):	14:03:12
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5767, Parent PID: 5760

General

Start time (UTC):	14:03:12
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 vaiolmao
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5768, Parent PID: 5433

General

Start time (UTC):	14:03:13
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5768, Parent PID: 5433

General

Start time (UTC):	14:03:13
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 123123a \|\| busybox pkill -9 123123a"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5773, Parent PID: 5768

General

Start time (UTC):	14:03:13
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5773, Parent PID: 5768

General

Start time (UTC):	14:03:13
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 123123a
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5776, Parent PID: 5768

General

Start time (UTC):	14:03:14
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5776, Parent PID: 5768

General

Start time (UTC):	14:03:14
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 123123a
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5777, Parent PID: 5433

General

Start time (UTC):	14:03:15
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5777, Parent PID: 5433

General

Start time (UTC):	14:03:15
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 Ofurain0n4H34D \|\| busybox pkill -9 Ofurain0n4H34D"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5782, Parent PID: 5777

General

Start time (UTC):	14:03:15
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5782, Parent PID: 5777

General

Start time (UTC):	14:03:15
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 Ofurain0n4H34D
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5783, Parent PID: 5777

General

Start time (UTC):	14:03:16
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5783, Parent PID: 5777

General

Start time (UTC):	14:03:16
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 Ofurain0n4H34D
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5784, Parent PID: 5433

General

Start time (UTC):	14:03:17
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5784, Parent PID: 5433

General

Start time (UTC):	14:03:17
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggTrex \|\| busybox pkill -9 ggTrex"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5786, Parent PID: 5784

General

Start time (UTC):	14:03:17
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5786, Parent PID: 5784

General

Start time (UTC):	14:03:17
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggTrex
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5787, Parent PID: 5784

General

Start time (UTC):	14:03:18
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5787, Parent PID: 5784

General

Start time (UTC):	14:03:18
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggTrex
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5790, Parent PID: 5433

General

Start time (UTC):	14:03:19
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5790, Parent PID: 5433

General

Start time (UTC):	14:03:19
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 wasads \|\| busybox pkill -9 wasads"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5792, Parent PID: 5790

General

Start time (UTC):	14:03:19
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5792, Parent PID: 5790

General

Start time (UTC):	14:03:19
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 wasads
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5793, Parent PID: 5790

General

Start time (UTC):	14:03:20
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5793, Parent PID: 5790

General

Start time (UTC):	14:03:20
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 wasads
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5794, Parent PID: 5433

General

Start time (UTC):	14:03:22
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5794, Parent PID: 5433

General

Start time (UTC):	14:03:22
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1293194hjXD \|\| busybox pkill -9 1293194hjXD"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5796, Parent PID: 5794

General

Start time (UTC):	14:03:22
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5796, Parent PID: 5794

General

Start time (UTC):	14:03:22
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1293194hjXD
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5797, Parent PID: 5794

General

Start time (UTC):	14:03:23
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5797, Parent PID: 5794

General

Start time (UTC):	14:03:23
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1293194hjXD
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5800, Parent PID: 5433

General

Start time (UTC):	14:03:24
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5800, Parent PID: 5433

General

Start time (UTC):	14:03:24
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 OthLaLosn \|\| busybox pkill -9 OthLaLosn"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5802, Parent PID: 5800

General

Start time (UTC):	14:03:24
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5802, Parent PID: 5800

General

Start time (UTC):	14:03:24
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 OthLaLosn
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5803, Parent PID: 5800

General

Start time (UTC):	14:03:25
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5803, Parent PID: 5800

General

Start time (UTC):	14:03:25
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 OthLaLosn
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5804, Parent PID: 5433

General

Start time (UTC):	14:03:26
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5804, Parent PID: 5433

General

Start time (UTC):	14:03:26
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggt \|\| busybox pkill -9 ggt"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5810, Parent PID: 5804

General

Start time (UTC):	14:03:26
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5810, Parent PID: 5804

General

Start time (UTC):	14:03:26
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggt
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5811, Parent PID: 5804

General

Start time (UTC):	14:03:27
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5811, Parent PID: 5804

General

Start time (UTC):	14:03:27
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggt
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5812, Parent PID: 5433

General

Start time (UTC):	14:03:28
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5812, Parent PID: 5433

General

Start time (UTC):	14:03:28
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 wget-log \|\| busybox pkill -9 wget-log"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5817, Parent PID: 5812

General

Start time (UTC):	14:03:28
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5817, Parent PID: 5812

General

Start time (UTC):	14:03:28
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 wget-log
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5820, Parent PID: 5812

General

Start time (UTC):	14:03:29
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5820, Parent PID: 5812

General

Start time (UTC):	14:03:29
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 wget-log
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5821, Parent PID: 5433

General

Start time (UTC):	14:03:30
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5821, Parent PID: 5433

General

Start time (UTC):	14:03:30
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1337SoraLOADER \|\| busybox pkill -9 1337SoraLOADER"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5826, Parent PID: 5821

General

Start time (UTC):	14:03:30
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5826, Parent PID: 5821

General

Start time (UTC):	14:03:30
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1337SoraLOADER
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5827, Parent PID: 5821

General

Start time (UTC):	14:03:31
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5827, Parent PID: 5821

General

Start time (UTC):	14:03:31
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1337SoraLOADER
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5828, Parent PID: 5433

General

Start time (UTC):	14:03:32
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5828, Parent PID: 5433

General

Start time (UTC):	14:03:32
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SAIAKINA \|\| busybox pkill -9 SAIAKINA"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5833, Parent PID: 5828

General

Start time (UTC):	14:03:32
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5833, Parent PID: 5828

General

Start time (UTC):	14:03:32
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SAIAKINA
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5834, Parent PID: 5828

General

Start time (UTC):	14:03:33
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5834, Parent PID: 5828

General

Start time (UTC):	14:03:33
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SAIAKINA
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5837, Parent PID: 5433

General

Start time (UTC):	14:03:34
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5837, Parent PID: 5433

General

Start time (UTC):	14:03:34
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggtq \|\| busybox pkill -9 ggtq"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5842, Parent PID: 5837

General

Start time (UTC):	14:03:34
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5842, Parent PID: 5837

General

Start time (UTC):	14:03:34
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggtq
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5843, Parent PID: 5837

General

Start time (UTC):	14:03:35
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5843, Parent PID: 5837

General

Start time (UTC):	14:03:35
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggtq
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5844, Parent PID: 5433

General

Start time (UTC):	14:03:36
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5844, Parent PID: 5433

General

Start time (UTC):	14:03:36
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1378bfp919GRB1Q2 \|\| busybox pkill -9 1378bfp919GRB1Q2"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5846, Parent PID: 5844

General

Start time (UTC):	14:03:36
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5846, Parent PID: 5844

General

Start time (UTC):	14:03:36
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1378bfp919GRB1Q2
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5847, Parent PID: 5844

General

Start time (UTC):	14:03:37
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5847, Parent PID: 5844

General

Start time (UTC):	14:03:37
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1378bfp919GRB1Q2
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5848, Parent PID: 5433

General

Start time (UTC):	14:03:38
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5848, Parent PID: 5433

General

Start time (UTC):	14:03:38
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SAIAKUSO \|\| busybox pkill -9 SAIAKUSO"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5850, Parent PID: 5848

General

Start time (UTC):	14:03:38
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5850, Parent PID: 5848

General

Start time (UTC):	14:03:38
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SAIAKUSO
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5856, Parent PID: 5848

General

Start time (UTC):	14:03:40
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5856, Parent PID: 5848

General

Start time (UTC):	14:03:40
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SAIAKUSO
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5857, Parent PID: 5433

General

Start time (UTC):	14:03:41
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5857, Parent PID: 5433

General

Start time (UTC):	14:03:41
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggtr \|\| busybox pkill -9 ggtr"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5863, Parent PID: 5857

General

Start time (UTC):	14:03:41
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5863, Parent PID: 5857

General

Start time (UTC):	14:03:41
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggtr
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5864, Parent PID: 5857

General

Start time (UTC):	14:03:42
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5864, Parent PID: 5857

General

Start time (UTC):	14:03:42
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggtr
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5865, Parent PID: 5433

General

Start time (UTC):	14:03:43
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5865, Parent PID: 5433

General

Start time (UTC):	14:03:43
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 14Fa \|\| busybox pkill -9 14Fa"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5869, Parent PID: 5865

General

Start time (UTC):	14:03:43
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5869, Parent PID: 5865

General

Start time (UTC):	14:03:43
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 14Fa
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5873, Parent PID: 5865

General

Start time (UTC):	14:03:44
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5873, Parent PID: 5865

General

Start time (UTC):	14:03:44
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 14Fa
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5874, Parent PID: 5433

General

Start time (UTC):	14:03:45
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5874, Parent PID: 5433

General

Start time (UTC):	14:03:45
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SEXSLAVE1337 \|\| busybox pkill -9 SEXSLAVE1337"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5879, Parent PID: 5874

General

Start time (UTC):	14:03:45
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5879, Parent PID: 5874

General

Start time (UTC):	14:03:45
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SEXSLAVE1337
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5880, Parent PID: 5874

General

Start time (UTC):	14:03:46
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5880, Parent PID: 5874

General

Start time (UTC):	14:03:46
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SEXSLAVE1337
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5881, Parent PID: 5433

General

Start time (UTC):	14:03:47
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5881, Parent PID: 5433

General

Start time (UTC):	14:03:47
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggtt \|\| busybox pkill -9 ggtt"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5885, Parent PID: 5881

General

Start time (UTC):	14:03:47
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5885, Parent PID: 5881

General

Start time (UTC):	14:03:47
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggtt
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5887, Parent PID: 5881

General

Start time (UTC):	14:03:48
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5887, Parent PID: 5881

General

Start time (UTC):	14:03:48
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggtt
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5890, Parent PID: 5433

General

Start time (UTC):	14:03:49
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5890, Parent PID: 5433

General

Start time (UTC):	14:03:49
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1902a3u912u3u4 \|\| busybox pkill -9 1902a3u912u3u4"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5895, Parent PID: 5890

General

Start time (UTC):	14:03:49
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5895, Parent PID: 5890

General

Start time (UTC):	14:03:49
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1902a3u912u3u4
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5896, Parent PID: 5890

General

Start time (UTC):	14:03:50
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5896, Parent PID: 5890

General

Start time (UTC):	14:03:50
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1902a3u912u3u4
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.arm6.elf PID: 5897, Parent PID: 5433

General

Start time (UTC):	14:03:51
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.arm6.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: sh PID: 5897, Parent PID: 5433

General

Start time (UTC):	14:03:51
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5902, Parent PID: 5897

General

Start time (UTC):	14:03:51
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5902, Parent PID: 5897

General

Start time (UTC):	14:03:51
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SO190Ij1X
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5903, Parent PID: 5897

General

Start time (UTC):	14:03:52
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5903, Parent PID: 5897

General

Start time (UTC):	14:03:52
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SO190Ij1X
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.
Tactics:	Credential Access
Data Sources:	Application Log: Application Log Content, Command: Command Execution, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report yakuza.arm6.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: yakuza.arm6.elf PID: 5431, Parent PID: 5356

General

Chronological Activities

Analysis Process: yakuza.arm6.elf PID: 5433, Parent PID: 5431

General

Chronological Activities

Analysis Process: yakuza.arm6.elf PID: 5435, Parent PID: 5433

General

Chronological Activities

Analysis Process: yakuza.arm6.elf PID: 5439, Parent PID: 5433

General

Chronological Activities

Analysis Process: yakuza.arm6.elf PID: 5446, Parent PID: 5433

General

Chronological Activities

Analysis Process: sh PID: 5446, Parent PID: 5433

General

Linux Analysis Report
yakuza.arm6.elf