Source: unknown | TCP traffic detected without corresponding DNS query: 91.189.91.43 |
Source: unknown | TCP traffic detected without corresponding DNS query: 109.202.202.202 |
Source: unknown | TCP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown | TCP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown | TCP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown | TCP traffic detected without corresponding DNS query: 1.1.1.1 |
Source: unknown | TCP traffic detected without corresponding DNS query: 77.90.22.16 |
Source: unknown | TCP traffic detected without corresponding DNS query: 77.90.22.16 |
Source: unknown | TCP traffic detected without corresponding DNS query: 77.90.22.16 |
Source: unknown | TCP traffic detected without corresponding DNS query: 91.189.91.42 |
Source: unknown | TCP traffic detected without corresponding DNS query: 91.189.91.43 |
Source: unknown | TCP traffic detected without corresponding DNS query: 109.202.202.202 |
Source: unknown | TCP traffic detected without corresponding DNS query: 77.90.22.16 |
Source: unknown | TCP traffic detected without corresponding DNS query: 91.189.91.42 |
Source: unknown | TCP traffic detected without corresponding DNS query: 77.90.22.16 |
Source: unknown | TCP traffic detected without corresponding DNS query: 77.90.22.16 |
Source: unknown | TCP traffic detected without corresponding DNS query: 77.90.22.16 |
Source: unknown | TCP traffic detected without corresponding DNS query: 77.90.22.16 |
Source: g3.elf | String found in binary or memory: http://%d.%d.%d.%d/%s |
Source: g3.elf, 6257.1.00007fdf14033000.00007fdf14039000.rw-.sdmp, g3.elf, 6298.1.00007fdf14033000.00007fdf14039000.rw-.sdmp | String found in binary or memory: http://1/wget.sh |
Source: hello.service.12.dr, hello.12.dr, tmp.YaNrRY.40.dr, crontab.tmp.12.dr | String found in binary or memory: http://103.136.41.100/g3 |
Source: g3.elf, 6257.1.00007fdf14033000.00007fdf14039000.rw-.sdmp, g3.elf, 6298.1.00007fdf14033000.00007fdf14039000.rw-.sdmp | String found in binary or memory: http://9/curl.sh |
Source: g3.elf, 6257.1.00007fdf14033000.00007fdf14039000.rw-.sdmp, g3.elf, 6298.1.00007fdf14033000.00007fdf14039000.rw-.sdmp | String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/ |
Source: g3.elf, 6257.1.00007fdf14033000.00007fdf14039000.rw-.sdmp, g3.elf, 6298.1.00007fdf14033000.00007fdf14039000.rw-.sdmp | String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/ |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 2018, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 2077, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 2078, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 2079, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 2080, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 2083, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 2084, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 2156, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 6259, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 6260, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 6261, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 6262, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 6263, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 6264, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 2018, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 2077, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 2078, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 2079, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 2080, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 2083, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 2084, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 2156, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 6259, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 6260, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 6261, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 6262, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 6263, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | SIGKILL sent: pid: 6264, result: successful | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1582/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1582/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1582/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1582/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1582/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2033/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2033/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2033/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2033/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2033/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2275/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2275/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2275/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2275/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2275/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1612/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1612/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1612/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1612/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1612/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1579/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1579/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1579/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1579/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1579/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1699/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1699/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1699/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1699/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1699/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1335/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1335/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1335/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1335/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1335/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1698/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1698/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1698/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1698/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1698/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2028/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2028/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2028/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2028/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2028/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1334/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1334/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1334/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1334/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1334/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1576/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1576/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1576/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1576/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1576/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2302/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2302/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2302/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2302/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2302/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/3236/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/3236/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/3236/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/3236/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/3236/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2025/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2025/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2025/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2025/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2025/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2146/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2146/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2146/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2146/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2146/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/912/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/912/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/912/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/912/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/912/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/759/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/759/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/759/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/759/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/759/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2307/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2307/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2307/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2307/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/2307/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/918/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/918/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/918/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/918/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/918/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/6240/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/6240/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/6240/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/6240/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/6240/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1594/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1594/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1594/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1594/cmdline | Jump to behavior |
Source: /tmp/g3.elf (PID: 6257) | File opened: /proc/1594/cmdline | Jump to behavior |
Source: g3.elf, 6257.1.00007ffdba7b2000.00007ffdba7d3000.rw-.sdmp, g3.elf, 6298.1.00007ffdba7b2000.00007ffdba7d3000.rw-.sdmp | Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/g3.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/g3.elf |
Source: g3.elf, 6257.1.00007ffdba7b2000.00007ffdba7d3000.rw-.sdmp | Binary or memory string: !V/tmp/qemu-open.AWtF9j: |
Source: g3.elf, 6257.1.00005621878e7000.0000562187a38000.rw-.sdmp, g3.elf, 6298.1.00005621878e7000.0000562187a38000.rw-.sdmp | Binary or memory string: /etc/qemu-binfmt/arm |
Source: g3.elf, 6257.1.00007ffdba7b2000.00007ffdba7d3000.rw-.sdmp, g3.elf, 6298.1.00007ffdba7b2000.00007ffdba7d3000.rw-.sdmp | Binary or memory string: /usr/bin/qemu-arm |
Source: g3.elf, 6257.1.00005621878e7000.0000562187a38000.rw-.sdmp, g3.elf, 6298.1.00005621878e7000.0000562187a38000.rw-.sdmp | Binary or memory string: !V!/etc/qemu-binfmt/arm |
Source: g3.elf, 6257.1.00007ffdba7b2000.00007ffdba7d3000.rw-.sdmp | Binary or memory string: /tmp/qemu-open.AWtF9j |