Create Interactive Tour

Linux Analysis Report
SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf

Overview

General Information

Sample name:	SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Analysis ID:	1605974
MD5:	875c205b3f022dbced35519ccff1e016
SHA1:	1be1fce4a230e42486c5d2bee748bc9b5e5e1b62
SHA256:	d36ada6b4799ba082a9c829418c8460e509cb508eb346f633643a52030031748
Tags:	elfuser-SecuriteInfoCom
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Sample tries to kill a massive number of system processes

Drops files in suspicious directories

Drops invisible ELF files

Executes the "crontab" command typically for achieving persistence

Sample deletes itself

Sample tries to kill multiple processes (SIGKILL)

Sample tries to persist itself using cron

Writes identical ELF files to multiple locations

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Drops files with innocent-looking names

Executes the "systemctl" command used for controlling the systemd system and service manager

Executes the "uname" command used to read OS and architecture name

Reads CPU information from /proc indicative of miner or evasive malware

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Writes ELF files to disk

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1605974
Start date and time:	2025-02-03 22:50:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Detection:	MAL
Classification:	mal76.spre.troj.evad.linELF@0/12@0/0

Runtime Messages

Command:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
PID:	5479
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Titan
Standard Error:

Process Tree

system is lnxubuntu20

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5479, Parent: 5404, MD5: 875c205b3f022dbced35519ccff1e016) Arguments: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5486, Parent: 5479)

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5487, Parent: 5479)

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487, Parent: 5479, MD5: 875c205b3f022dbced35519ccff1e016) Arguments: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf e

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5494, Parent: 5487)

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5500, Parent: 5487)

mount (PID: 5500, Parent: 5487, MD5: 92b20aa8b155ecd3ba9414aa477ef565) Arguments: mount -o bind /var /proc/5487/

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5525, Parent: 5487)

uname (PID: 5525, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5530, Parent: 5487)

uname (PID: 5530, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5545, Parent: 5487)

uname (PID: 5545, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5546, Parent: 5487)

uname (PID: 5546, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5548, Parent: 5487)

uname (PID: 5548, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5549, Parent: 5487)

uname (PID: 5549, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5552, Parent: 5487)

crontab (PID: 5552, Parent: 5487, MD5: 66e521d421ac9b407699061bf21806f5) Arguments: crontab /var/.recovery

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5553, Parent: 5487)

uname (PID: 5553, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5554, Parent: 5487)

uname (PID: 5554, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5555, Parent: 5487)

uname (PID: 5555, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5556, Parent: 5487)

uname (PID: 5556, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5560, Parent: 5487)

systemctl (PID: 5560, Parent: 5487, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl daemon-reload redis.service

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5561, Parent: 5487)

systemctl (PID: 5561, Parent: 5487, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl "enable " redis.service

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5562, Parent: 5487)

systemctl (PID: 5562, Parent: 5487, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl daemon-reload mysql.service

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5563, Parent: 5487)

systemctl (PID: 5563, Parent: 5487, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl "enable " mysql.service

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5564, Parent: 5487)

uname (PID: 5564, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5565, Parent: 5487)

uname (PID: 5565, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5566, Parent: 5487)

uname (PID: 5566, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5567, Parent: 5487)

uname (PID: 5567, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5570, Parent: 5487)

uname (PID: 5570, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5571, Parent: 5487)

uname (PID: 5571, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5598, Parent: 5487)

uname (PID: 5598, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5599, Parent: 5487)

uname (PID: 5599, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5602, Parent: 5487)

uname (PID: 5602, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5603, Parent: 5487)

uname (PID: 5603, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5604, Parent: 5487)

uname (PID: 5604, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5605, Parent: 5487)

uname (PID: 5605, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5608, Parent: 5487)

uname (PID: 5608, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5609, Parent: 5487)

uname (PID: 5609, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5610, Parent: 5487)

uname (PID: 5610, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5611, Parent: 5487)

uname (PID: 5611, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5614, Parent: 5487)

uname (PID: 5614, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5615, Parent: 5487)

uname (PID: 5615, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5616, Parent: 5487)

uname (PID: 5616, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5617, Parent: 5487)

uname (PID: 5617, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5618, Parent: 5487)

uname (PID: 5618, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5619, Parent: 5487)

uname (PID: 5619, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5622, Parent: 5487)

uname (PID: 5622, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5623, Parent: 5487)

uname (PID: 5623, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5624, Parent: 5487)

uname (PID: 5624, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5625, Parent: 5487)

uname (PID: 5625, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5628, Parent: 5487)

uname (PID: 5628, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5629, Parent: 5487)

uname (PID: 5629, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5630, Parent: 5487)

uname (PID: 5630, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5631, Parent: 5487)

uname (PID: 5631, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5632, Parent: 5487)

uname (PID: 5632, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5633, Parent: 5487)

uname (PID: 5633, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5637, Parent: 5487)

uname (PID: 5637, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5638, Parent: 5487)

uname (PID: 5638, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5641, Parent: 5487)

uname (PID: 5641, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5642, Parent: 5487)

uname (PID: 5642, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5645, Parent: 5487)

uname (PID: 5645, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5646, Parent: 5487)

uname (PID: 5646, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5647, Parent: 5487)

uname (PID: 5647, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5648, Parent: 5487)

uname (PID: 5648, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5651, Parent: 5487)

uname (PID: 5651, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5652, Parent: 5487)

uname (PID: 5652, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5653, Parent: 5487)

uname (PID: 5653, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5654, Parent: 5487)

uname (PID: 5654, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5657, Parent: 5487)

uname (PID: 5657, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5658, Parent: 5487)

uname (PID: 5658, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5661, Parent: 5487)

uname (PID: 5661, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5662, Parent: 5487)

uname (PID: 5662, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5663, Parent: 5487)

uname (PID: 5663, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5664, Parent: 5487)

uname (PID: 5664, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5667, Parent: 5487)

uname (PID: 5667, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5668, Parent: 5487)

uname (PID: 5668, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5669, Parent: 5487)

uname (PID: 5669, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5670, Parent: 5487)

uname (PID: 5670, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5671, Parent: 5487)

uname (PID: 5671, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5672, Parent: 5487)

uname (PID: 5672, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5676, Parent: 5487)

uname (PID: 5676, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5677, Parent: 5487)

uname (PID: 5677, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5678, Parent: 5487)

uname (PID: 5678, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5679, Parent: 5487)

uname (PID: 5679, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5682, Parent: 5487)

uname (PID: 5682, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5683, Parent: 5487)

uname (PID: 5683, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5684, Parent: 5487)

uname (PID: 5684, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5685, Parent: 5487)

uname (PID: 5685, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5688, Parent: 5487)

uname (PID: 5688, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5689, Parent: 5487)

uname (PID: 5689, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5690, Parent: 5487)

uname (PID: 5690, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5691, Parent: 5487)

uname (PID: 5691, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5692, Parent: 5487)

uname (PID: 5692, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5693, Parent: 5487)

uname (PID: 5693, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5696, Parent: 5487)

uname (PID: 5696, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5697, Parent: 5487)

uname (PID: 5697, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5698, Parent: 5487)

uname (PID: 5698, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5699, Parent: 5487)

uname (PID: 5699, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5702, Parent: 5487)

uname (PID: 5702, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5703, Parent: 5487)

uname (PID: 5703, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5704, Parent: 5487)

uname (PID: 5704, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5705, Parent: 5487)

uname (PID: 5705, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5706, Parent: 5487)

uname (PID: 5706, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5709, Parent: 5487)

uname (PID: 5709, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5710, Parent: 5487)

uname (PID: 5710, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5711, Parent: 5487)

uname (PID: 5711, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5712, Parent: 5487)

uname (PID: 5712, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5713, Parent: 5487)

uname (PID: 5713, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5717, Parent: 5487)

uname (PID: 5717, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5718, Parent: 5487)

uname (PID: 5718, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5721, Parent: 5487)

uname (PID: 5721, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5722, Parent: 5487)

uname (PID: 5722, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5725, Parent: 5487)

uname (PID: 5725, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5726, Parent: 5487)

uname (PID: 5726, Parent: 5487, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5488, Parent: 5479)

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5488, Parent: 5479, MD5: 875c205b3f022dbced35519ccff1e016) Arguments: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf d

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5501, Parent: 5488)

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5502, Parent: 5488)

mv (PID: 5502, Parent: 5488, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/kill /usr/bin/.kill

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5547, Parent: 5488)

mv (PID: 5547, Parent: 5488, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/ls /usr/bin/.ls

SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf New Fork (PID: 5557, Parent: 5488)

mv (PID: 5557, Parent: 5488, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/pwd /usr/bin/.pwd

udisksd New Fork (PID: 5511, Parent: 802)

dumpe2fs (PID: 5511, Parent: 802, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0

cleanup

String containing 'busybox' found: 30517578125time: file bad addressfile existsbroken pipebad messagealarm clockstack faultfinal tokentls10servertls: alert(local errorc e trafficCERTIFICATEassistQueuenetpollInitreflectOffsglobalAllocmSpanManualstart traceclobberfreegccheckmarkscheddetailunspecifiedcgocall nil s.nelems= of size ) returned runtime: p ms clock, nBSSRoots=runtime: P exp.) for minTrigger=GOMEMLIMIT=bad m value, elemsize= freeindex= span.list=, npages = , a123456=[ p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACEBACK) at entry+ (targetpc= , plugin: runtime: g : frame.sp=created by .WithCancel.WithValue(ClassHESIODauthoritiesadditionalsshort writebad argSizemethodargs(reflect.SetSHA-512/224SHA-512/256BLAKE2s-256BLAKE2b-256BLAKE2b-384BLAKE2b-512invalid oidpsk_id_hashgocachehashgocachetesthttp2clienthttp2serverarchive/tarcrypto/x509archive/zipgeneralizedapplicationavx512vnniwavx512vbmi2/tmp/.system/bin/busybox/sbin/auditd/usr/sbid -D/lib/sys

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 1238, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 134, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 1648, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 238, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 239, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 241, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 2496, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 332, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 3455, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 347, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 3708, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 3709, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 371, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 3710, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 3711, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 508, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 518, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 519, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 5426, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 5488, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 659, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 672, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 680, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 3826, result: no such process	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 5574, result: no such process	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 5575, result: no such process	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 5576, result: no such process	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 5577, result: no such process	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 5578, result: no such process	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 5579, result: no such process	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 5580, result: no such process	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 5581, result: no such process	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 5582, result: no such process	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 5583, result: no such process	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 5584, result: no such process	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 5585, result: no such process	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 5586, result: no such process	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 5587, result: no such process	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 5588, result: no such process	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 5589, result: no such process	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 5590, result: no such process	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 5591, result: no such process	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	SIGKILL sent: pid: 5592, result: no such process	Jump to behavior

Source: classification engine

Classification label: mal76.spre.troj.evad.linELF@0/12@0/0

Source: ELF file section	Submission: SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Source: ELF file section	Dropped file: default_dns.conf.15.dr
Source: ELF file section	Dropped file: .system.15.dr
Source: ELF file section	Dropped file: media.jpg.15.dr
Source: ELF file section	Dropped file: readdir.so.15.dr
Source: ELF file section	Dropped file: cgo.15.dr
Source: ELF file section	Dropped file: kernal.15.dr
Source: ELF file section	Dropped file: kill.17.dr
Source: ELF file section	Dropped file: ls.17.dr

Persistence and Installation Behavior

Executes the "crontab" command typically for achieving persistence

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5552)

Crontab executable: /usr/bin/crontab -> crontab /var/.recovery

Jump to behavior

Sample tries to persist itself using cron

Source: /usr/bin/crontab (PID: 5552)	File: /var/spool/cron/crontabs/tmp.IjBHGZ			Jump to behavior
Source: /usr/bin/crontab (PID: 5552)	File: /var/spool/cron/crontabs/root			Jump to behavior

Writes identical ELF files to multiple locations

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	File with SHA-256 D36ADA6B4799BA082A9C829418C8460E509CB508EB346F633643A52030031748 written: /opt/cgo	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	File with SHA-256 D36ADA6B4799BA082A9C829418C8460E509CB508EB346F633643A52030031748 written: /usr/lib/readdir.so	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	File with SHA-256 D36ADA6B4799BA082A9C829418C8460E509CB508EB346F633643A52030031748 written: /etc/default_dns.conf	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5488)	File with SHA-256 D36ADA6B4799BA082A9C829418C8460E509CB508EB346F633643A52030031748 written: /usr/bin/kill	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	File with SHA-256 D36ADA6B4799BA082A9C829418C8460E509CB508EB346F633643A52030031748 written: /tmp/.system	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5488)	File with SHA-256 D36ADA6B4799BA082A9C829418C8460E509CB508EB346F633643A52030031748 written: /usr/bin/ls	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	File with SHA-256 D36ADA6B4799BA082A9C829418C8460E509CB508EB346F633643A52030031748 written: /var/kernal	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	File with SHA-256 D36ADA6B4799BA082A9C829418C8460E509CB508EB346F633643A52030031748 written: /var/web/media.jpg	Jump to dropped file

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	File: /tmp/.system	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	File: /var/.recovery	Jump to behavior
Source: /usr/bin/crontab (PID: 5552)	Directory: /var/.recovery	Jump to behavior

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5560)	Systemctl executable: /usr/bin/systemctl -> systemctl daemon-reload redis.service	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5561)	Systemctl executable: /usr/bin/systemctl -> systemctl "enable " redis.service	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5562)	Systemctl executable: /usr/bin/systemctl -> systemctl daemon-reload mysql.service	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5563)	Systemctl executable: /usr/bin/systemctl -> systemctl "enable " mysql.service	Jump to behavior

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	Reads from proc file: /proc/cpuinfo			Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	Reads from proc file: /proc/meminfo			Jump to behavior

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	File written: /opt/cgo	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	File written: /etc/default_dns.conf	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	File written: /tmp/.system	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	File written: /var/kernal	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	File written: /var/web/media.jpg	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	File written: /usr/lib/readdir.so	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5488)	File written: /usr/bin/kill	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5488)	File written: /usr/bin/ls	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Drops files in suspicious directories

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5488)	File: /usr/bin/kill			Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5488)	File: /usr/bin/ls			Jump to dropped file

Drops invisible ELF files

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)

ELF file: /tmp/.system

Jump to dropped file

Sample deletes itself

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)

File: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf

Jump to behavior

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5488)

Path: /usr/bin/ls

Jump to dropped file

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)

Reads CPU info from proc file: /proc/cpuinfo

Jump to behavior

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5479)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5487)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5488)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior

Source: /usr/bin/uname (PID: 5525)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5530)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5545)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5546)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5548)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5549)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5553)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5554)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5555)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5556)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5564)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5565)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5566)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5567)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5570)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5571)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5598)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5599)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5602)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5603)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5604)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5605)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5608)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5609)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5610)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5611)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5614)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5615)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5616)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5617)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5618)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5619)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5622)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5623)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5624)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5625)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5628)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5629)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5630)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5631)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5632)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5633)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5637)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5638)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5641)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5642)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5645)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5646)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5647)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5648)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5651)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5652)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5653)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5654)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5657)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5658)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5661)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5662)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5663)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5664)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5667)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5668)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5669)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5670)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5671)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5672)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5676)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5677)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5678)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5679)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5682)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5683)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5684)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5685)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5688)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5689)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5690)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5691)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5692)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5693)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5696)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5697)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5698)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5699)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5702)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5703)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5704)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5705)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5706)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5709)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5710)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5711)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5712)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5713)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5717)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5718)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5721)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5722)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5725)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5726)	Queries kernel information via 'uname':	Jump to behavior

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5525)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5530)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5545)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5546)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5548)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5549)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5553)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5554)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5555)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5556)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5564)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5565)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5566)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5567)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5570)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5571)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5598)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5599)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5602)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5603)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5604)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5605)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5608)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5609)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5610)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5611)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5614)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5615)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5616)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5617)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5618)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5619)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5622)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5623)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5624)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5625)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5628)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5629)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5630)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5631)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5632)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5633)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5637)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5638)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5641)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5642)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5645)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5646)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5647)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5648)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5651)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5652)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5653)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5654)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5657)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5658)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5661)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5662)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5663)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5664)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5667)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5668)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5669)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5670)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5671)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5672)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5676)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5677)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5678)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5679)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5682)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5683)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5684)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5685)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5688)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5689)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5690)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5691)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5692)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5693)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5696)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5697)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5698)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5699)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5702)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5703)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5704)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5705)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5706)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5709)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5710)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5711)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5712)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5713)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5717)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5718)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5721)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5722)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5725)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf (PID: 5726)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Systemd Service	1 Systemd Service	11 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Hidden Files and Directories	LSASS Memory	4 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf	5%	ReversingLabs	Linux.Trojan.DDOSAgent

Dropped Files

Source	Detection	Scanner	Label
/etc/default_dns.conf	5%	ReversingLabs	Linux.Trojan.DDOSAgent
/opt/cgo	5%	ReversingLabs	Linux.Trojan.DDOSAgent
/tmp/.system	5%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/kill	5%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/ls	5%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/lib/readdir.so	5%	ReversingLabs	Linux.Trojan.DDOSAgent
/var/kernal	5%	ReversingLabs	Linux.Trojan.DDOSAgent
/var/web/media.jpg	5%	ReversingLabs	Linux.Trojan.DDOSAgent

Name	Source	Malicious	Antivirus Detection	Reputation
https://bugs.launchpad.net/ubuntu/	SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf, ls.17.dr, media.jpg.15.dr, default_dns.conf.15.dr, cgo.15.dr, kernal.15.dr, readdir.so.15.dr, .system.15.dr, kill.17.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
156.229.232.67	unknown	Seychelles		139086	ONL-HKOCEANNETWORKLIMITEDHK	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
156.229.232.67	main-linux-arm-5.elf	Get hash	malicious	Unknown	Browse
156.229.232.67	main-linux-ppc64le.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ONL-HKOCEANNETWORKLIMITEDHK	main-linux-arm-5.elf	Get hash	malicious	Unknown	Browse	156.229.232.67
	main-linux-ppc64le.elf	Get hash	malicious	Unknown	Browse	156.229.232.67
	arm7.elf	Get hash	malicious	Mirai	Browse	156.229.232.99
	arm5.elf	Get hash	malicious	Unknown	Browse	156.229.232.99
	rep.arm5.elf	Get hash	malicious	Unknown	Browse	156.229.232.99
	rep.m68k.elf	Get hash	malicious	Unknown	Browse	156.229.232.99
	rep.arm7.elf	Get hash	malicious	Mirai	Browse	156.229.232.99
	rep.spc.elf	Get hash	malicious	Unknown	Browse	156.229.232.99
	rep.x86.elf	Get hash	malicious	Unknown	Browse	156.229.232.99
	rep.mpsl.elf	Get hash	malicious	Unknown	Browse	156.229.232.99

Process:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, BuildID[sha1]=110c0dc063922f9672e72c1ca4f40b83d0196276, for GNU/Linux 3.2.0, stripped
Category:	dropped
Size (bytes):	5185792
Entropy (8bit):	6.286944885525828
Encrypted:	false
SSDEEP:	49152:hVX+c6M+xPTo3ydpGqx6b/CDEdEcV4hQRh3y/pExNUDU0hoYLlCxkgaIc:3X+c6jNaqxqxV4hQRh3ipExCLoSloa
MD5:	875C205B3F022DBCED35519CCFF1E016
SHA1:	1BE1FCE4A230E42486C5D2BEE748BC9B5E5E1B62
SHA-256:	D36ADA6B4799BA082A9C829418C8460E509CB508EB346F633643A52030031748
SHA-512:	91C2877791E52EABCAC55F4252B0F8DF4C5A1DFE2D6D597791EC2D19726CC253940F0557BDCA659F610366E8DF2E1BF472326050FF162AFA6C8AE76AA8B6DD0B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	low
Preview:	.ELF.................... ...4...x.O.....4. ...(.....................l...l...........................<.,.<.,...............-...1...1.\. .\. ...............M..fR..fR..4..................4...4...4.........................M..fR..fR.....<...........Q.td............................R.td..M..fR..fR.\|)..\|)......................GNU.....c./.r.,.......bv............GNU.....................S.......Go..wHOirnswX3MtdvBzHFWS/mD4i3mShcWZ1vbEghWLt/CXZJLJydX3kezILgHwDV/7-eklNO3AGDpGpozp5vG.D.R....@.R....<.R....8.R....4.R....0.R....,.R....(.R....$.R.... .R......R......R......R......R......R......R......R......R................................................................................................................................................................................................................................................................................................................................................................................................

/etc/systemd/system/mysql.service

Download File

Process:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	157
Entropy (8bit):	4.702945306478296
Encrypted:	false
SSDEEP:	3:zMZa7lDol2AXAikA18v3muEcEn7iAtjAx0gdK+DM/XLWK6v+sirSkQmWA1+DRn:z8WDohXAg8vBU7rt8c+gnrLQmWA4Rn
MD5:	527DDA8380938B88718C31C3754412CB
SHA1:	ACA820CA350C118F022AC746A4E07CDAD1ECCCC7
SHA-256:	353C04E7E9E21716048C411DBAD3C0602AE4262AA924AA19D0BBCA2ABEE0DC44
SHA-512:	28584A44CB534B231ED11C66DF109131AD3A6A9745CBE73CD5ABD5D8F4210CFC6E2ECBE619C0670B816245130949D5D98F926F9C050A981D768AE173EF078BCE
Malicious:	false
Reputation:	low
Preview:	[Unit].Description=mysql service.[Service].Type=simple.Restart=always.RestartSec=1.User=root.ExecStart=/lib/readdir.so e.[Install].WantedBy=multi-user.target

/etc/systemd/system/redis.service

Download File

Process:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	157
Entropy (8bit):	4.6433916632597185
Encrypted:	false
SSDEEP:	3:zMZa76A6CnynQ22AXAikA18v3muEcEn7iAtjAx0gdK+AVnJXsirSkQmWA1+DRn:z8DCny1XAg8vBU7rt8c+ApJdrLQmWA4R
MD5:	EF3B3E2027D7642C19C6056316A3B2AD
SHA1:	AC1766E5F242DCCA1CD6146D5A18C7247B7CAEF5
SHA-256:	AF4CB8B23B0E62D7C0A7DBD7DCC17E4B4C2A1F6054F2C3F5310835FA035BB9F1
SHA-512:	02AD9F01EE64DA54E6FB4D66856F1D4AC2769FEB56D0017D7B44FC3C87673CDDEEB0BA68A3BFA1DFFB231BCA4DA6E506A40DD0FE5AE767C115DB15BB49751B9E
Malicious:	false
Reputation:	low
Preview:	[Unit].Description=redis Server Service.[Service].Type=simple.Restart=always.RestartSec=1.User=root.ExecStart=/opt/cgo e.[Install].WantedBy=multi-user.target

/opt/cgo

Download File

Process:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, BuildID[sha1]=110c0dc063922f9672e72c1ca4f40b83d0196276, for GNU/Linux 3.2.0, stripped
Category:	dropped
Size (bytes):	5185792
Entropy (8bit):	6.286944885525828
Encrypted:	false
SSDEEP:	49152:hVX+c6M+xPTo3ydpGqx6b/CDEdEcV4hQRh3y/pExNUDU0hoYLlCxkgaIc:3X+c6jNaqxqxV4hQRh3ipExCLoSloa
MD5:	875C205B3F022DBCED35519CCFF1E016
SHA1:	1BE1FCE4A230E42486C5D2BEE748BC9B5E5E1B62
SHA-256:	D36ADA6B4799BA082A9C829418C8460E509CB508EB346F633643A52030031748
SHA-512:	91C2877791E52EABCAC55F4252B0F8DF4C5A1DFE2D6D597791EC2D19726CC253940F0557BDCA659F610366E8DF2E1BF472326050FF162AFA6C8AE76AA8B6DD0B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	low
Preview:	.ELF.................... ...4...x.O.....4. ...(.....................l...l...........................<.,.<.,...............-...1...1.\. .\. ...............M..fR..fR..4..................4...4...4.........................M..fR..fR.....<...........Q.td............................R.td..M..fR..fR.\|)..\|)......................GNU.....c./.r.,.......bv............GNU.....................S.......Go..wHOirnswX3MtdvBzHFWS/mD4i3mShcWZ1vbEghWLt/CXZJLJydX3kezILgHwDV/7-eklNO3AGDpGpozp5vG.D.R....@.R....<.R....8.R....4.R....0.R....,.R....(.R....$.R.... .R......R......R......R......R......R......R......R......R................................................................................................................................................................................................................................................................................................................................................................................................

/tmp/.system

Download File

Process:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, BuildID[sha1]=110c0dc063922f9672e72c1ca4f40b83d0196276, for GNU/Linux 3.2.0, stripped
Category:	dropped
Size (bytes):	5185792
Entropy (8bit):	6.286944885525828
Encrypted:	false
SSDEEP:	49152:hVX+c6M+xPTo3ydpGqx6b/CDEdEcV4hQRh3y/pExNUDU0hoYLlCxkgaIc:3X+c6jNaqxqxV4hQRh3ipExCLoSloa
MD5:	875C205B3F022DBCED35519CCFF1E016
SHA1:	1BE1FCE4A230E42486C5D2BEE748BC9B5E5E1B62
SHA-256:	D36ADA6B4799BA082A9C829418C8460E509CB508EB346F633643A52030031748
SHA-512:	91C2877791E52EABCAC55F4252B0F8DF4C5A1DFE2D6D597791EC2D19726CC253940F0557BDCA659F610366E8DF2E1BF472326050FF162AFA6C8AE76AA8B6DD0B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	low
Preview:	.ELF.................... ...4...x.O.....4. ...(.....................l...l...........................<.,.<.,...............-...1...1.\. .\. ...............M..fR..fR..4..................4...4...4.........................M..fR..fR.....<...........Q.td............................R.td..M..fR..fR.\|)..\|)......................GNU.....c./.r.,.......bv............GNU.....................S.......Go..wHOirnswX3MtdvBzHFWS/mD4i3mShcWZ1vbEghWLt/CXZJLJydX3kezILgHwDV/7-eklNO3AGDpGpozp5vG.D.R....@.R....<.R....8.R....4.R....0.R....,.R....(.R....$.R.... .R......R......R......R......R......R......R......R......R................................................................................................................................................................................................................................................................................................................................................................................................

/usr/bin/kill

Download File

Process:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, BuildID[sha1]=110c0dc063922f9672e72c1ca4f40b83d0196276, for GNU/Linux 3.2.0, stripped
Category:	dropped
Size (bytes):	5185792
Entropy (8bit):	6.286944885525828
Encrypted:	false
SSDEEP:	49152:hVX+c6M+xPTo3ydpGqx6b/CDEdEcV4hQRh3y/pExNUDU0hoYLlCxkgaIc:3X+c6jNaqxqxV4hQRh3ipExCLoSloa
MD5:	875C205B3F022DBCED35519CCFF1E016
SHA1:	1BE1FCE4A230E42486C5D2BEE748BC9B5E5E1B62
SHA-256:	D36ADA6B4799BA082A9C829418C8460E509CB508EB346F633643A52030031748
SHA-512:	91C2877791E52EABCAC55F4252B0F8DF4C5A1DFE2D6D597791EC2D19726CC253940F0557BDCA659F610366E8DF2E1BF472326050FF162AFA6C8AE76AA8B6DD0B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	low
Preview:	.ELF.................... ...4...x.O.....4. ...(.....................l...l...........................<.,.<.,...............-...1...1.\. .\. ...............M..fR..fR..4..................4...4...4.........................M..fR..fR.....<...........Q.td............................R.td..M..fR..fR.\|)..\|)......................GNU.....c./.r.,.......bv............GNU.....................S.......Go..wHOirnswX3MtdvBzHFWS/mD4i3mShcWZ1vbEghWLt/CXZJLJydX3kezILgHwDV/7-eklNO3AGDpGpozp5vG.D.R....@.R....<.R....8.R....4.R....0.R....,.R....(.R....$.R.... .R......R......R......R......R......R......R......R......R................................................................................................................................................................................................................................................................................................................................................................................................

/usr/bin/ls

Download File

Process:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, BuildID[sha1]=110c0dc063922f9672e72c1ca4f40b83d0196276, for GNU/Linux 3.2.0, stripped
Category:	dropped
Size (bytes):	5185792
Entropy (8bit):	6.286944885525828
Encrypted:	false
SSDEEP:	49152:hVX+c6M+xPTo3ydpGqx6b/CDEdEcV4hQRh3y/pExNUDU0hoYLlCxkgaIc:3X+c6jNaqxqxV4hQRh3ipExCLoSloa
MD5:	875C205B3F022DBCED35519CCFF1E016
SHA1:	1BE1FCE4A230E42486C5D2BEE748BC9B5E5E1B62
SHA-256:	D36ADA6B4799BA082A9C829418C8460E509CB508EB346F633643A52030031748
SHA-512:	91C2877791E52EABCAC55F4252B0F8DF4C5A1DFE2D6D597791EC2D19726CC253940F0557BDCA659F610366E8DF2E1BF472326050FF162AFA6C8AE76AA8B6DD0B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	.ELF.................... ...4...x.O.....4. ...(.....................l...l...........................<.,.<.,...............-...1...1.\. .\. ...............M..fR..fR..4..................4...4...4.........................M..fR..fR.....<...........Q.td............................R.td..M..fR..fR.\|)..\|)......................GNU.....c./.r.,.......bv............GNU.....................S.......Go..wHOirnswX3MtdvBzHFWS/mD4i3mShcWZ1vbEghWLt/CXZJLJydX3kezILgHwDV/7-eklNO3AGDpGpozp5vG.D.R....@.R....<.R....8.R....4.R....0.R....,.R....(.R....$.R.... .R......R......R......R......R......R......R......R......R................................................................................................................................................................................................................................................................................................................................................................................................

/usr/lib/readdir.so

Download File

Process:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, BuildID[sha1]=110c0dc063922f9672e72c1ca4f40b83d0196276, for GNU/Linux 3.2.0, stripped
Category:	dropped
Size (bytes):	5185792
Entropy (8bit):	6.286944885525828
Encrypted:	false
SSDEEP:	49152:hVX+c6M+xPTo3ydpGqx6b/CDEdEcV4hQRh3y/pExNUDU0hoYLlCxkgaIc:3X+c6jNaqxqxV4hQRh3ipExCLoSloa
MD5:	875C205B3F022DBCED35519CCFF1E016
SHA1:	1BE1FCE4A230E42486C5D2BEE748BC9B5E5E1B62
SHA-256:	D36ADA6B4799BA082A9C829418C8460E509CB508EB346F633643A52030031748
SHA-512:	91C2877791E52EABCAC55F4252B0F8DF4C5A1DFE2D6D597791EC2D19726CC253940F0557BDCA659F610366E8DF2E1BF472326050FF162AFA6C8AE76AA8B6DD0B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	.ELF.................... ...4...x.O.....4. ...(.....................l...l...........................<.,.<.,...............-...1...1.\. .\. ...............M..fR..fR..4..................4...4...4.........................M..fR..fR.....<...........Q.td............................R.td..M..fR..fR.\|)..\|)......................GNU.....c./.r.,.......bv............GNU.....................S.......Go..wHOirnswX3MtdvBzHFWS/mD4i3mShcWZ1vbEghWLt/CXZJLJydX3kezILgHwDV/7-eklNO3AGDpGpozp5vG.D.R....@.R....<.R....8.R....4.R....0.R....,.R....(.R....$.R.... .R......R......R......R......R......R......R......R......R................................................................................................................................................................................................................................................................................................................................................................................................

/var/.recovery

Download File

Process:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	22
Entropy (8bit):	3.1312824845975866
Encrypted:	false
SSDEEP:	3:3P11wIazEJvn:IIazEhn
MD5:	1644470D9773EF8433BDCAD59666DEC2
SHA1:	BB1A4EBA9D798E4F335F0AD846990ACCCCDBB88E
SHA-256:	44C5580AD84412D4F0BD8A6160C5F1E2C35D965855CCA2EE473B12115F0BDEFD
SHA-512:	3978D21D4BF595F116795580B7D33EBDEC2DF3E407EDCF822FAC08F3436E6917F54FA786AA3F6630F1B9D5A26230CA40869409CD2B8B2E1D31A893E6E21CD39B
Malicious:	true
Preview:	* * * * * /var/kernal.

/var/kernal

Download File

Process:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, BuildID[sha1]=110c0dc063922f9672e72c1ca4f40b83d0196276, for GNU/Linux 3.2.0, stripped
Category:	dropped
Size (bytes):	5185792
Entropy (8bit):	6.286944885525828
Encrypted:	false
SSDEEP:	49152:hVX+c6M+xPTo3ydpGqx6b/CDEdEcV4hQRh3y/pExNUDU0hoYLlCxkgaIc:3X+c6jNaqxqxV4hQRh3ipExCLoSloa
MD5:	875C205B3F022DBCED35519CCFF1E016
SHA1:	1BE1FCE4A230E42486C5D2BEE748BC9B5E5E1B62
SHA-256:	D36ADA6B4799BA082A9C829418C8460E509CB508EB346F633643A52030031748
SHA-512:	91C2877791E52EABCAC55F4252B0F8DF4C5A1DFE2D6D597791EC2D19726CC253940F0557BDCA659F610366E8DF2E1BF472326050FF162AFA6C8AE76AA8B6DD0B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	.ELF.................... ...4...x.O.....4. ...(.....................l...l...........................<.,.<.,...............-...1...1.\. .\. ...............M..fR..fR..4..................4...4...4.........................M..fR..fR.....<...........Q.td............................R.td..M..fR..fR.\|)..\|)......................GNU.....c./.r.,.......bv............GNU.....................S.......Go..wHOirnswX3MtdvBzHFWS/mD4i3mShcWZ1vbEghWLt/CXZJLJydX3kezILgHwDV/7-eklNO3AGDpGpozp5vG.D.R....@.R....<.R....8.R....4.R....0.R....,.R....(.R....$.R.... .R......R......R......R......R......R......R......R......R................................................................................................................................................................................................................................................................................................................................................................................................

/var/spool/cron/crontabs/tmp.IjBHGZ

Download File

Process:	/usr/bin/crontab
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.059217749904623
Encrypted:	false
SSDEEP:	6:SUrpqoqQjEOP1K+1/iqOBFQ7yXQG4iGMQ5UYLtCFt39YIazEhn:8Qj2T8gQLUeHLU9Ykn
MD5:	065B127534D1A7B98D99DCB8446F2AAD
SHA1:	3941F6F3BF7AAACF1294F42DD018F7D352D82AD4
SHA-256:	2C358F6CC82958367FECF07ED9544FB53CA41A5F1DB9137D08C59D2717696611
SHA-512:	63940E4953EFCF3D33A93D3B42961605B1D2C00473AE82034A4BFF9628477D5778B05DD654807697DEE05DED8107836B710CBEEA4CE09A6CBA8D49E3F1CC7439
Malicious:	true
Preview:	# DO NOT EDIT THIS FILE - edit the master and reinstall..# (/var/.recovery installed on Mon Feb 3 15:51:23 2025).# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $).* * * * * /var/kernal.

/var/web/media.jpg

Download File

Process:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, BuildID[sha1]=110c0dc063922f9672e72c1ca4f40b83d0196276, for GNU/Linux 3.2.0, stripped
Category:	dropped
Size (bytes):	5185792
Entropy (8bit):	6.286944885525828
Encrypted:	false
SSDEEP:	49152:hVX+c6M+xPTo3ydpGqx6b/CDEdEcV4hQRh3y/pExNUDU0hoYLlCxkgaIc:3X+c6jNaqxqxV4hQRh3ipExCLoSloa
MD5:	875C205B3F022DBCED35519CCFF1E016
SHA1:	1BE1FCE4A230E42486C5D2BEE748BC9B5E5E1B62
SHA-256:	D36ADA6B4799BA082A9C829418C8460E509CB508EB346F633643A52030031748
SHA-512:	91C2877791E52EABCAC55F4252B0F8DF4C5A1DFE2D6D597791EC2D19726CC253940F0557BDCA659F610366E8DF2E1BF472326050FF162AFA6C8AE76AA8B6DD0B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	.ELF.................... ...4...x.O.....4. ...(.....................l...l...........................<.,.<.,...............-...1...1.\. .\. ...............M..fR..fR..4..................4...4...4.........................M..fR..fR.....<...........Q.td............................R.td..M..fR..fR.\|)..\|)......................GNU.....c./.r.,.......bv............GNU.....................S.......Go..wHOirnswX3MtdvBzHFWS/mD4i3mShcWZ1vbEghWLt/CXZJLJydX3kezILgHwDV/7-eklNO3AGDpGpozp5vG.D.R....@.R....<.R....8.R....4.R....0.R....,.R....(.R....$.R.... .R......R......R......R......R......R......R......R......R................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, BuildID[sha1]=110c0dc063922f9672e72c1ca4f40b83d0196276, for GNU/Linux 3.2.0, stripped
Entropy (8bit):	6.286944885525828
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
File size:	5'185'792 bytes
MD5:	875c205b3f022dbced35519ccff1e016
SHA1:	1be1fce4a230e42486c5d2bee748bc9b5e5e1b62
SHA256:	d36ada6b4799ba082a9c829418c8460e509cb508eb346f633643a52030031748
SHA512:	91c2877791e52eabcac55f4252b0f8df4c5a1dfe2d6d597791ec2d19726cc253940f0557bdca659f610366e8df2e1bf472326050ff162afa6c8ae76aa8b6dd0b
SSDEEP:	49152:hVX+c6M+xPTo3ydpGqx6b/CDEdEcV4hQRh3y/pExNUDU0hoYLlCxkgaIc:3X+c6jNaqxqxV4hQRh3ipExCLoSloa
TLSH:	59363950FECB54F2E5030A3105ABA27F57305E098B25EBD7EA547F69FA73692083621C
File Content Preview:	.ELF.................... ...4...x.O.....4. ...(.....................l...l...........................<.,.<.,...............-...1...1.\. .\. ...............M..fR..fR..4..................4...4...4.........................M..fR..fR.....<...........Q.td.......

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8049b20
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	8
Section Header Offset:	5184632
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	28

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0
.note.gnu.build-id	NOTE	0x8048134	0x134	0x24	0x0	0x2	A	0	4
.note.ABI-tag	NOTE	0x8048158	0x158	0x20	0x0	0x2	A	0	4
.note.go.buildid	NOTE	0x8048178	0x178	0x64	0x0	0x2	A	0	4
.rel.plt	REL	0x80481dc	0x1dc	0x90	0x8	0x42	AI	21	4
.init	PROGBITS	0x8049000	0x1000	0x20	0x0	0x6	AX	0	4
.plt	PROGBITS	0x8049020	0x1020	0x90	0x0	0x6	AX	0	8
.text	PROGBITS	0x80490b0	0x10b0	0x2ceb77	0x0	0x6	AX	0	16
.fini	PROGBITS	0x8317c28	0x2cfc28	0x14	0x0	0x6	AX	0	4
.rodata	PROGBITS	0x8318000	0x2d0000	0xc7670	0x0	0x2	A	0	32
.typelink	PROGBITS	0x83df680	0x397680	0x1378	0x0	0x2	A	0	32
.itablink	PROGBITS	0x83e0a00	0x398a00	0x294	0x0	0x2	A	0	32
.gopclntab	PROGBITS	0x83e0ca0	0x398ca0	0x11d60c	0x0	0x2	A	0	32
.eh_frame	PROGBITS	0x84fe2ac	0x4b62ac	0x273b8	0x0	0x2	A	0	4
.gcc_except_table	PROGBITS	0x8525664	0x4dd664	0x1f8	0x0	0x2	A	0	1
.tdata	PROGBITS	0x8526684	0x4de684	0x10	0x0	0x403	WAT	0	4
.tbss	NOBITS	0x8526694	0x4de694	0x2c	0x0	0x403	WAT	0	4
.init_array	INIT_ARRAY	0x8526694	0x4de694	0x4	0x4	0x3	WA	0	4
.fini_array	FINI_ARRAY	0x8526698	0x4de698	0x8	0x4	0x3	WA	0	4
.data.rel.ro	PROGBITS	0x85266a0	0x4de6a0	0x2934	0x0	0x3	WA	0	32
.got	PROGBITS	0x8528fd4	0x4e0fd4	0x18	0x0	0x3	WA	0	4
.got.plt	PROGBITS	0x8528ff4	0x4e0ff4	0x54	0x4	0x3	WA	0	4
.data	PROGBITS	0x8529060	0x4e1060	0x5de8	0x0	0x3	WA	0	32
.go.buildinfo	PROGBITS	0x852ee50	0x4e6e50	0x270	0x0	0x3	WA	0	16
.noptrdata	PROGBITS	0x852f0c0	0x4e70c0	0xaa80	0x0	0x3	WA	0	32
.bss	NOBITS	0x8539b40	0x4f1b40	0xfeec	0x0	0x3	WA	0	32
.noptrbss	NOBITS	0x8549a40	0x4f1b40	0x7e40	0x0	0x3	WA	0	32
.comment	PROGBITS	0x0	0x4f1b40	0x26	0x1	0x30	MS	0	1
.shstrtab	STRTAB	0x0	0x4f1b66	0x112	0x0	0x0		0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x26c	0x26c	4.3722	0x4	R	0x1000	.note.gnu.build-id .note.ABI-tag .note.go.buildid .rel.plt
LOAD	0x1000	0x8049000	0x8049000	0x2cec3c	0x2cec3c	6.2052	0x5	R E	0x1000	.init .plt .text .fini
LOAD	0x2d0000	0x8318000	0x8318000	0x20d85c	0x20d85c	5.7987	0x4	R	0x1000	.rodata .typelink .itablink .gopclntab .eh_frame .gcc_except_table
LOAD	0x4de684	0x8526684	0x8526684	0x134bc	0x2b1fc	5.5419	0x6	RW	0x1000	.tdata .tbss .init_array .fini_array .data.rel.ro .got .got.plt .data .go.buildinfo .noptrdata .bss .noptrbss
NOTE	0x134	0x8048134	0x8048134	0xa8	0xa8	5.1117	0x4	R	0x4	.note.gnu.build-id .note.ABI-tag .note.go.buildid
TLS	0x4de684	0x8526684	0x8526684	0x10	0x3c	2.7806	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x10
GNU_RELRO	0x4de684	0x8526684	0x8526684	0x297c	0x297c	4.4540	0x4	R	0x1	.tdata .tbss .init_array .fini_array .data.rel.ro .got

Network Behavior

Download Network PCAP: filtered – full

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 3, 2025 22:51:15.904674053 CET	38236	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:15.909533024 CET	8081	38236	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:15.911115885 CET	38236	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:16.708482981 CET	38236	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:16.713341951 CET	8081	38236	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:17.543642044 CET	8081	38236	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:17.545981884 CET	38236	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:18.763747931 CET	38238	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:18.763747931 CET	38236	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:18.768759012 CET	8081	38238	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:18.768767118 CET	8081	38236	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:18.768806934 CET	38238	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:19.730745077 CET	38238	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:19.735646009 CET	8081	38238	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:20.422135115 CET	8081	38238	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:20.425961971 CET	38238	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:20.932127953 CET	38238	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:20.936940908 CET	8081	38238	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:21.792228937 CET	38240	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:21.797178984 CET	8081	38240	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:21.797238111 CET	38240	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:22.947741032 CET	38240	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:22.952605009 CET	8081	38240	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:23.455540895 CET	8081	38240	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:23.457982063 CET	38240	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:24.986860037 CET	38240	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:24.986938953 CET	38242	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:24.991709948 CET	8081	38240	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:24.991733074 CET	8081	38242	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:24.991790056 CET	38242	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:25.368438005 CET	38242	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:25.373742104 CET	8081	38242	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:26.055211067 CET	38242	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:26.060113907 CET	8081	38242	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:26.641755104 CET	8081	38242	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:26.641968966 CET	38242	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:27.393007040 CET	38242	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:27.393136024 CET	38244	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:27.397844076 CET	8081	38242	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:27.397871971 CET	8081	38244	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:27.397958040 CET	38244	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:27.981384993 CET	38244	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:27.986263990 CET	8081	38244	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:29.067023993 CET	8081	38244	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:29.069973946 CET	38244	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:29.998585939 CET	38244	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:29.998585939 CET	38246	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:30.003421068 CET	8081	38244	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:30.003456116 CET	8081	38246	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:30.003604889 CET	38246	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:30.101239920 CET	38246	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:30.106000900 CET	8081	38246	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:31.061636925 CET	38246	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:31.269958019 CET	38246	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:31.481956005 CET	38246	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:31.921963930 CET	38246	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:32.087121964 CET	8081	38246	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:32.087413073 CET	8081	38246	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:32.087456942 CET	38246	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:32.087852955 CET	8081	38246	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:32.087887049 CET	38246	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:32.089447021 CET	8081	38246	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:32.096235991 CET	8081	38246	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:32.096246958 CET	8081	38246	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:32.096573114 CET	8081	38246	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:32.096683025 CET	8081	38246	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:32.096694946 CET	8081	38246	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:32.105465889 CET	38248	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:32.110229015 CET	8081	38248	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:32.110290051 CET	38248	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:32.193980932 CET	38248	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:32.198755980 CET	8081	38248	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:33.746840954 CET	8081	38248	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:33.749955893 CET	38248	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:34.197499990 CET	38248	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:34.197561026 CET	38250	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:34.203917027 CET	8081	38248	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:34.203928947 CET	8081	38250	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:34.203973055 CET	38250	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:34.285197973 CET	38250	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:34.289944887 CET	8081	38250	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:36.062848091 CET	38250	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:36.067608118 CET	8081	38250	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:41.064385891 CET	38250	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:41.069263935 CET	8081	38250	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:46.066181898 CET	38250	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:46.071094990 CET	8081	38250	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:47.782974005 CET	8081	38250	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:47.785597086 CET	38250	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:47.785672903 CET	38252	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:47.790549994 CET	8081	38250	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:47.790575027 CET	8081	38252	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:47.790654898 CET	38252	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:47.857076883 CET	38252	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:47.862010002 CET	8081	38252	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:49.457115889 CET	8081	38252	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:49.457953930 CET	38252	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:49.862514019 CET	38252	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:49.862572908 CET	38254	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:49.867250919 CET	8081	38252	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:49.867295980 CET	8081	38254	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:49.867892981 CET	38254	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:49.944763899 CET	38254	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:49.949670076 CET	8081	38254	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:51.067795992 CET	38254	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:51.072659016 CET	8081	38254	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:51.546127081 CET	8081	38254	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:51.549953938 CET	38254	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:51.948451996 CET	38254	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:51.948523998 CET	38256	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:51.953413010 CET	8081	38254	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:51.953428030 CET	8081	38256	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:51.953494072 CET	38256	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:52.022965908 CET	38256	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:52.027935982 CET	8081	38256	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:53.626578093 CET	8081	38256	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:53.630012989 CET	38256	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:54.025698900 CET	38256	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:54.025774956 CET	38258	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:54.030427933 CET	8081	38256	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:54.030515909 CET	8081	38258	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:54.030572891 CET	38258	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:54.099864960 CET	38258	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:54.104609013 CET	8081	38258	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:56.056210995 CET	8081	38258	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:56.056679010 CET	8081	38258	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:56.056735992 CET	38258	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:56.069120884 CET	38258	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:56.073868036 CET	8081	38258	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:56.102550983 CET	38260	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:56.107355118 CET	8081	38260	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:56.107424974 CET	38260	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:56.182873011 CET	38260	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:56.187743902 CET	8081	38260	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:57.750329971 CET	8081	38260	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:57.753983021 CET	38260	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:58.185777903 CET	38260	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:58.185838938 CET	38262	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:58.190738916 CET	8081	38260	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:58.190757036 CET	8081	38262	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:58.190825939 CET	38262	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:58.268975019 CET	38262	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:51:58.275122881 CET	8081	38262	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:59.825586081 CET	8081	38262	156.229.232.67	192.168.2.13
Feb 3, 2025 22:51:59.825975895 CET	38262	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:00.272664070 CET	38262	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:00.272727966 CET	38264	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:00.277601957 CET	8081	38262	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:00.277621984 CET	8081	38264	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:00.277678967 CET	38264	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:00.350979090 CET	38264	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:00.355767012 CET	8081	38264	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:01.070698023 CET	38264	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:01.075532913 CET	8081	38264	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:01.941905975 CET	8081	38264	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:01.945966005 CET	38264	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:02.356378078 CET	38264	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:02.356446981 CET	38266	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:02.361663103 CET	8081	38264	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:02.361682892 CET	8081	38266	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:02.361738920 CET	38266	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:02.445224047 CET	38266	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:02.450104952 CET	8081	38266	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:04.015575886 CET	8081	38266	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:04.017956018 CET	38266	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:04.449563026 CET	38266	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:04.449618101 CET	38268	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:04.455172062 CET	8081	38266	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:04.455189943 CET	8081	38268	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:04.455250978 CET	38268	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:04.529603004 CET	38268	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:04.534959078 CET	8081	38268	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:06.072468996 CET	38268	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:06.077317953 CET	8081	38268	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:06.093271971 CET	8081	38268	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:06.093951941 CET	38268	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:06.534446001 CET	38268	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:06.534518957 CET	38270	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:06.539349079 CET	8081	38268	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:06.539365053 CET	8081	38270	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:06.539625883 CET	38270	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:06.617033958 CET	38270	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:06.621944904 CET	8081	38270	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:08.185210943 CET	8081	38270	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:08.185983896 CET	38270	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:08.621391058 CET	38270	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:08.621494055 CET	38272	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:08.626264095 CET	8081	38270	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:08.626353025 CET	8081	38272	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:08.626425028 CET	38272	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:08.704379082 CET	38272	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:08.711203098 CET	8081	38272	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:10.266200066 CET	8081	38272	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:10.270052910 CET	38272	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:10.707437992 CET	38272	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:10.707518101 CET	38274	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:10.712394953 CET	8081	38272	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:10.712416887 CET	8081	38274	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:10.712515116 CET	38274	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:10.807164907 CET	38274	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:10.812005997 CET	8081	38274	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:11.075190067 CET	38274	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:11.080020905 CET	8081	38274	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:12.357261896 CET	8081	38274	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:12.357960939 CET	38274	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:12.813474894 CET	38274	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:12.813601971 CET	38276	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:12.818322897 CET	8081	38274	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:12.818418026 CET	8081	38276	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:12.818547010 CET	38276	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:12.915079117 CET	38276	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:12.919945002 CET	8081	38276	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:14.469222069 CET	8081	38276	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:14.469995975 CET	38276	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:14.918975115 CET	38276	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:14.919049978 CET	38278	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:14.923861980 CET	8081	38276	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:14.923995972 CET	8081	38278	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:14.924065113 CET	38278	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:14.992175102 CET	38278	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:14.997111082 CET	8081	38278	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:16.077500105 CET	38278	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:16.082282066 CET	8081	38278	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:16.607142925 CET	8081	38278	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:16.609967947 CET	38278	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:16.996807098 CET	38278	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:16.996865988 CET	38280	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:17.001801968 CET	8081	38278	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:17.001821041 CET	8081	38280	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:17.001933098 CET	38280	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:17.118246078 CET	38280	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:17.123933077 CET	8081	38280	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:18.640341043 CET	8081	38280	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:18.641978025 CET	38280	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:19.122040033 CET	38280	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:19.122112036 CET	38282	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:19.126894951 CET	8081	38280	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:19.126919985 CET	8081	38282	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:19.127000093 CET	38282	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:19.221249104 CET	38282	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:19.226166964 CET	8081	38282	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:20.862654924 CET	8081	38282	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:20.865974903 CET	38282	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:21.080090046 CET	38282	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:21.085299015 CET	8081	38282	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:21.226345062 CET	38284	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:21.231296062 CET	8081	38284	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:21.231372118 CET	38284	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:21.350979090 CET	38284	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:21.355871916 CET	8081	38284	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:22.872934103 CET	8081	38284	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:22.873961926 CET	38284	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:23.358019114 CET	38284	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:23.358095884 CET	38286	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:23.362847090 CET	8081	38284	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:23.362946987 CET	8081	38286	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:23.363033056 CET	38286	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:23.449367046 CET	38286	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:23.456809044 CET	8081	38286	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:25.015249968 CET	8081	38286	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:25.017954111 CET	38286	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:25.456991911 CET	38286	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:25.457089901 CET	38288	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:25.461822033 CET	8081	38286	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:25.461848974 CET	8081	38288	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:25.461920023 CET	38288	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:25.580306053 CET	38288	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:25.585135937 CET	8081	38288	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:26.082859993 CET	38288	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:26.087848902 CET	8081	38288	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:31.084369898 CET	38288	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:31.091470003 CET	8081	38288	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:32.531361103 CET	8081	38288	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:32.533950090 CET	38288	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:32.534068108 CET	38288	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:32.534154892 CET	38290	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:32.538844109 CET	8081	38288	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:32.538889885 CET	8081	38290	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:32.538965940 CET	38290	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:32.616672039 CET	38290	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:32.621480942 CET	8081	38290	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:34.185852051 CET	8081	38290	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:34.185962915 CET	38290	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:34.622553110 CET	38290	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:34.622631073 CET	38292	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:34.627516031 CET	8081	38290	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:34.627530098 CET	8081	38292	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:34.627583981 CET	38292	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:34.706284046 CET	38292	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:34.711169958 CET	8081	38292	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:36.086657047 CET	38292	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:36.095345974 CET	8081	38292	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:36.303077936 CET	8081	38292	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:36.305962086 CET	38292	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:36.710846901 CET	38292	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:36.710906982 CET	38294	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:36.716412067 CET	8081	38292	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:36.716425896 CET	8081	38294	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:36.716495991 CET	38294	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:36.797821045 CET	38294	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:36.802773952 CET	8081	38294	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:38.377064943 CET	8081	38294	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:38.377959013 CET	38294	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:38.803613901 CET	38294	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:38.803690910 CET	38296	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:38.808440924 CET	8081	38294	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:38.808465004 CET	8081	38296	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:38.808517933 CET	38296	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:38.891031027 CET	38296	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:38.895844936 CET	8081	38296	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:40.470153093 CET	8081	38296	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:40.473954916 CET	38296	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:40.894634008 CET	38296	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:40.894712925 CET	38298	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:40.899511099 CET	8081	38296	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:40.899523020 CET	8081	38298	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:40.899574041 CET	38298	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:40.977344990 CET	38298	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:40.982295036 CET	8081	38298	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:41.088603973 CET	38298	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:41.093391895 CET	8081	38298	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:42.564896107 CET	8081	38298	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:42.565952063 CET	38298	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:42.980957031 CET	38298	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:42.981038094 CET	38300	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:42.985805035 CET	8081	38298	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:42.985831022 CET	8081	38300	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:42.985894918 CET	38300	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:43.057537079 CET	38300	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:43.062339067 CET	8081	38300	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:44.643026114 CET	8081	38300	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:44.645951033 CET	38300	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:45.060621977 CET	38300	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:45.060744047 CET	38302	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:45.065578938 CET	8081	38300	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:45.065593958 CET	8081	38302	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:45.065660954 CET	38302	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:45.146975994 CET	38302	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:45.151813984 CET	8081	38302	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:46.089922905 CET	38302	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:46.094758034 CET	8081	38302	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:46.739675999 CET	8081	38302	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:46.741947889 CET	38302	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:47.150352955 CET	38302	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:47.150410891 CET	38304	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:47.155177116 CET	8081	38302	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:47.155213118 CET	8081	38304	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:47.155265093 CET	38304	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:47.226442099 CET	38304	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:47.231290102 CET	8081	38304	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:48.795124054 CET	8081	38304	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:48.797969103 CET	38304	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:49.230226994 CET	38304	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:49.230287075 CET	38306	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:49.237154961 CET	8081	38304	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:49.237179995 CET	8081	38306	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:49.237257004 CET	38306	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:49.316557884 CET	38306	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:49.324278116 CET	8081	38306	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:50.935607910 CET	8081	38306	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:50.938095093 CET	38306	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:51.091619968 CET	38306	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:51.096473932 CET	8081	38306	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:51.320712090 CET	38308	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:51.325577021 CET	8081	38308	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:51.325639963 CET	38308	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:51.400595903 CET	38308	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:51.405379057 CET	8081	38308	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:53.007589102 CET	8081	38308	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:53.010087967 CET	38308	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:53.405783892 CET	38308	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:53.405836105 CET	38310	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:53.413781881 CET	8081	38308	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:53.413908958 CET	8081	38310	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:53.413968086 CET	38310	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:53.487344027 CET	38310	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:53.495009899 CET	8081	38310	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:55.080720901 CET	8081	38310	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:55.082003117 CET	38310	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:55.490854979 CET	38310	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:55.490920067 CET	38312	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:55.495676994 CET	8081	38310	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:55.495706081 CET	8081	38312	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:55.495748997 CET	38312	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:55.574136972 CET	38312	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:55.578928947 CET	8081	38312	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:56.093600988 CET	38312	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:56.098421097 CET	8081	38312	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:57.139808893 CET	8081	38312	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:57.141953945 CET	38312	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:57.577202082 CET	38312	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:57.577269077 CET	38314	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:57.581981897 CET	8081	38312	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:57.582040071 CET	8081	38314	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:57.582104921 CET	38314	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:57.656755924 CET	38314	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:57.661519051 CET	8081	38314	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:59.218966007 CET	8081	38314	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:59.222006083 CET	38314	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:59.661792994 CET	38314	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:59.661855936 CET	38316	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:59.812495947 CET	8081	38314	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:59.812510967 CET	8081	38316	156.229.232.67	192.168.2.13
Feb 3, 2025 22:52:59.812627077 CET	38316	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:59.889244080 CET	38316	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:52:59.894140959 CET	8081	38316	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:01.095552921 CET	38316	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:01.100461960 CET	8081	38316	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:01.457072020 CET	8081	38316	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:01.457997084 CET	38316	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:01.892951965 CET	38316	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:01.893017054 CET	38318	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:01.899956942 CET	8081	38316	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:01.899972916 CET	8081	38318	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:01.900026083 CET	38318	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:01.975100040 CET	38318	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:01.984129906 CET	8081	38318	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:03.546359062 CET	8081	38318	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:03.550079107 CET	38318	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:03.979103088 CET	38318	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:03.979173899 CET	38320	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:03.983834028 CET	8081	38318	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:03.983957052 CET	8081	38320	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:03.983999968 CET	38320	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:04.071854115 CET	38320	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:04.076646090 CET	8081	38320	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:05.643124104 CET	8081	38320	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:05.645975113 CET	38320	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:06.075654984 CET	38320	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:06.075711012 CET	38322	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:06.080611944 CET	8081	38320	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:06.080630064 CET	8081	38322	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:06.080671072 CET	38322	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:06.098587990 CET	38322	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:06.103360891 CET	8081	38322	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:06.152605057 CET	38322	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:06.157439947 CET	8081	38322	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:07.768238068 CET	8081	38322	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:07.769953966 CET	38322	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:08.155613899 CET	38322	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:08.155694962 CET	38324	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:08.160550117 CET	8081	38322	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:08.160572052 CET	8081	38324	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:08.160665035 CET	38324	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:08.241466999 CET	38324	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:08.246855021 CET	8081	38324	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:09.817471027 CET	8081	38324	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:09.817981958 CET	38324	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:10.244927883 CET	38324	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:10.245024920 CET	38326	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:10.250572920 CET	8081	38324	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:10.250591040 CET	8081	38326	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:10.250667095 CET	38326	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:10.321228027 CET	38326	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:10.326199055 CET	8081	38326	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:11.100802898 CET	38326	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:11.105592012 CET	8081	38326	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:11.958072901 CET	8081	38326	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:11.961988926 CET	38326	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:12.324700117 CET	38326	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:12.324758053 CET	38328	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:12.329643965 CET	8081	38326	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:12.329658985 CET	8081	38328	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:12.329710960 CET	38328	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:12.401675940 CET	38328	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:12.406477928 CET	8081	38328	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:13.968534946 CET	8081	38328	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:13.969976902 CET	38328	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:14.406431913 CET	38328	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:14.406495094 CET	38330	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:14.414598942 CET	8081	38328	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:14.414613008 CET	8081	38330	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:14.414675951 CET	38330	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:14.484642029 CET	38330	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:14.489455938 CET	8081	38330	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:16.061685085 CET	8081	38330	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:16.062026024 CET	38330	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:16.102634907 CET	38330	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:16.107414007 CET	8081	38330	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:16.487464905 CET	38332	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:16.492364883 CET	8081	38332	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:16.492419958 CET	38332	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:16.563266039 CET	38332	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:16.568070889 CET	8081	38332	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:18.143855095 CET	8081	38332	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:18.149947882 CET	38332	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:18.567718029 CET	38332	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:18.567784071 CET	38334	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:18.573373079 CET	8081	38332	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:18.573385954 CET	8081	38334	156.229.232.67	192.168.2.13
Feb 3, 2025 22:53:18.573456049 CET	38334	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:18.658272982 CET	38334	8081	192.168.2.13	156.229.232.67
Feb 3, 2025 22:53:18.663180113 CET	8081	38334	156.229.232.67	192.168.2.13

System Behavior

Analysis Process: SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf PID: 5479, Parent PID: 5404

General

Start time (UTC):	21:51:14
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:14
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Analysis Process: SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf PID: 5487, Parent PID: 5479

General

Start time (UTC):	21:51:14
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:14
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf e
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:14
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Analysis Process: SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf PID: 5500, Parent PID: 5487

General

Start time (UTC):	21:51:14
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:14
Start date (UTC):	03/02/2025
Path:	/usr/bin/mount
Arguments:	mount -o bind /var /proc/5487/
File size:	55528 bytes
MD5 hash:	92b20aa8b155ecd3ba9414aa477ef565

Start time (UTC):	21:51:14
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:14
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:15
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:15
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:17
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:17
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:17
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:17
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:20
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:20
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:20
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:20
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:22
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:22
Start date (UTC):	03/02/2025
Path:	/usr/bin/crontab
Arguments:	crontab /var/.recovery
File size:	43720 bytes
MD5 hash:	66e521d421ac9b407699061bf21806f5

Start time (UTC):	21:51:23
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:23
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:23
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:23
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:26
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:26
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:26
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:26
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:27
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:27
Start date (UTC):	03/02/2025
Path:	/usr/bin/systemctl
Arguments:	systemctl daemon-reload redis.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Start time (UTC):	21:51:27
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:27
Start date (UTC):	03/02/2025
Path:	/usr/bin/systemctl
Arguments:	systemctl "enable " redis.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Start time (UTC):	21:51:27
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:27
Start date (UTC):	03/02/2025
Path:	/usr/bin/systemctl
Arguments:	systemctl daemon-reload mysql.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Start time (UTC):	21:51:27
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:27
Start date (UTC):	03/02/2025
Path:	/usr/bin/systemctl
Arguments:	systemctl "enable " mysql.service
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Start time (UTC):	21:51:28
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:28
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:28
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:28
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:30
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:30
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:30
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:30
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:33
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:33
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:33
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:33
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:46
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:46
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:46
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:46
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:48
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:48
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:48
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:48
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:50
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:50
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:50
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:50
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:52
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:52
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:52
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:52
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:54
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:54
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:54
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:54
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:57
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:57
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:57
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:57
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:59
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:59
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:59
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:59
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:01
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:01
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:01
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:01
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:03
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:03
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:03
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:03
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:05
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:05
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:05
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:05
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:07
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:07
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:07
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:07
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:09
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:09
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:09
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:09
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:11
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:11
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:11
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:11
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:13
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:13
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:13
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:13
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:15
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:15
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:15
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:15
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:17
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:17
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:17
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:17
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:20
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:20
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:20
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:20
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:22
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:22
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:22
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:22
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:24
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:24
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:24
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:24
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:31
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:31
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:31
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:31
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:33
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:33
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:33
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:33
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:35
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:35
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:35
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:35
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:37
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:37
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:37
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:37
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:39
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:39
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:39
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:39
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:41
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:41
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:41
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:41
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:43
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:43
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:43
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:43
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:45
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:45
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:45
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:45
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:48
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:48
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:48
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:48
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:50
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:50
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:50
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:50
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:52
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:52
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:52
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:52
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:54
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:54
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:54
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:54
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:56
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:56
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:56
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:56
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:58
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:58
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:52:58
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:52:58
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:53:00
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:53:00
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:53:00
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:53:00
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:53:02
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:53:02
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:53:02
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:53:02
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:53:04
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:53:04
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:53:04
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:53:04
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:53:06
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:53:06
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:53:07
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:53:07
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:53:09
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:53:09
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:53:09
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:53:09
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:53:11
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:53:11
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:53:11
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:53:11
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:53:13
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:53:13
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:53:13
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:53:13
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:53:15
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:53:15
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:53:15
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:53:15
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:53:17
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:53:17
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -r
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:53:17
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:53:17
Start date (UTC):	03/02/2025
Path:	/usr/bin/uname
Arguments:	uname -m
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

Start time (UTC):	21:51:14
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:14
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf d
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:14
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Analysis Process: SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf PID: 5502, Parent PID: 5488

General

Start time (UTC):	21:51:14
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:14
Start date (UTC):	03/02/2025
Path:	/usr/bin/mv
Arguments:	mv /usr/bin/kill /usr/bin/.kill
File size:	149888 bytes
MD5 hash:	504f0590fa482d4da070a702260e3716

Start time (UTC):	21:51:20
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:20
Start date (UTC):	03/02/2025
Path:	/usr/bin/mv
Arguments:	mv /usr/bin/ls /usr/bin/.ls
File size:	149888 bytes
MD5 hash:	504f0590fa482d4da070a702260e3716

Start time (UTC):	21:51:26
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf
Arguments:	-
File size:	5185792 bytes
MD5 hash:	875c205b3f022dbced35519ccff1e016

Start time (UTC):	21:51:26
Start date (UTC):	03/02/2025
Path:	/usr/bin/mv
Arguments:	mv /usr/bin/pwd /usr/bin/.pwd
File size:	149888 bytes
MD5 hash:	504f0590fa482d4da070a702260e3716

Start time (UTC):	21:51:14
Start date (UTC):	03/02/2025
Path:	/usr/lib/udisks2/udisksd
Arguments:	-
File size:	483056 bytes
MD5 hash:	1d7ae439cc3d82fa6b127671ce037a24

Start time (UTC):	21:51:14
Start date (UTC):	03/02/2025
Path:	/usr/sbin/dumpe2fs
Arguments:	dumpe2fs -h /dev/dm-0
File size:	31112 bytes
MD5 hash:	5c66f7d8f7681a40562cf049ad4b72b4

Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources.Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Creation, File: File Modification, Process: Process Creation, Service: Service Creation, Service: Service Modification
Platforms:	Linux
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/etc/default_dns.conf

/etc/systemd/system/mysql.service

/etc/systemd/system/redis.service

/opt/cgo

/tmp/.system

/usr/bin/kill

/usr/bin/ls

/usr/lib/readdir.so

/var/.recovery

/var/kernal

/var/spool/cron/crontabs/tmp.IjBHGZ

/var/web/media.jpg

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

TCP Packets

System Behavior

Analysis Process: SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf PID: 5479, Parent PID: 5404

General

File Activities

File Opened

File Read

Process Activities

Process Forked

Signal Sent

Thread Sleep

Chronological Activities

Analysis Process: SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf PID: 5486, Parent PID: 5479

General

Analysis Process: SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf PID: 5487, Parent PID: 5479

Linux Analysis Report
SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf