Create Interactive Tour

Linux Analysis Report
SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf

Overview

General Information

Sample name:	SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Analysis ID:	1605975
MD5:	66ff22f7afd265f11b0e2302dbea5476
SHA1:	247b2a5b45746e08d29a9b356372796acfdbad1a
SHA256:	7410709cbf642943d89dde6c430dd75db6ef105d399f32ffdf9b2e7839dd8163
Tags:	elfuser-SecuriteInfoCom
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Sample tries to kill a massive number of system processes

Drops files in suspicious directories

Drops invisible ELF files

Executes the "crontab" command typically for achieving persistence

Sample deletes itself

Sample tries to kill multiple processes (SIGKILL)

Sample tries to persist itself using cron

Writes identical ELF files to multiple locations

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Drops files with innocent-looking names

Executes the "systemctl" command used for controlling the systemd system and service manager

Executes the "uname" command used to read OS and architecture name

Reads CPU information from /proc indicative of miner or evasive malware

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Writes ELF files to disk

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1605975
Start date and time:	2025-02-03 22:51:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Detection:	MAL
Classification:	mal76.spre.troj.evad.linELF@0/44@0/0

Warnings

VT rate limit hit for: SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf

Runtime Messages

Command:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
PID:	5511
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Titan
Standard Error:

Process Tree

system is lnxubuntu20

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5511, Parent: 5427, MD5: 8a53e569e1663d93f45ae5e19fc72498) Arguments: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5518, Parent: 5511)

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518, Parent: 5511, MD5: 8a53e569e1663d93f45ae5e19fc72498) Arguments: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf e

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5540, Parent: 5518)

mount (PID: 5540, Parent: 5518, MD5: 92b20aa8b155ecd3ba9414aa477ef565) Arguments: mount -o bind /var /proc/5518/

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5565, Parent: 5518)

uname (PID: 5565, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5569, Parent: 5518)

uname (PID: 5569, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5586, Parent: 5518)

uname (PID: 5586, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5588, Parent: 5518)

uname (PID: 5588, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5590, Parent: 5518)

crontab (PID: 5590, Parent: 5518, MD5: 66e521d421ac9b407699061bf21806f5) Arguments: crontab /var/.recovery

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5594, Parent: 5518)

uname (PID: 5594, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5599, Parent: 5518)

uname (PID: 5599, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5603, Parent: 5518)

systemctl (PID: 5603, Parent: 5518, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl daemon-reload redis.service

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5607, Parent: 5518)

systemctl (PID: 5607, Parent: 5518, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl "enable " redis.service

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5613, Parent: 5518)

systemctl (PID: 5613, Parent: 5518, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl daemon-reload mysql.service

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5615, Parent: 5518)

uname (PID: 5615, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5617, Parent: 5518)

uname (PID: 5617, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5619, Parent: 5518)

systemctl (PID: 5619, Parent: 5518, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl "enable " mysql.service

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5628, Parent: 5518)

uname (PID: 5628, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5630, Parent: 5518)

uname (PID: 5630, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5642, Parent: 5518)

uname (PID: 5642, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5644, Parent: 5518)

uname (PID: 5644, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5659, Parent: 5518)

uname (PID: 5659, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5661, Parent: 5518)

uname (PID: 5661, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5677, Parent: 5518)

uname (PID: 5677, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5695, Parent: 5518)

uname (PID: 5695, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5704, Parent: 5518)

uname (PID: 5704, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5709, Parent: 5518)

uname (PID: 5709, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5724, Parent: 5518)

uname (PID: 5724, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5729, Parent: 5518)

uname (PID: 5729, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5744, Parent: 5518)

uname (PID: 5744, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5749, Parent: 5518)

uname (PID: 5749, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5767, Parent: 5518)

uname (PID: 5767, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5772, Parent: 5518)

uname (PID: 5772, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5792, Parent: 5518)

uname (PID: 5792, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5797, Parent: 5518)

uname (PID: 5797, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5812, Parent: 5518)

uname (PID: 5812, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5817, Parent: 5518)

uname (PID: 5817, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5834, Parent: 5518)

uname (PID: 5834, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5839, Parent: 5518)

uname (PID: 5839, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5851, Parent: 5518)

uname (PID: 5851, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5853, Parent: 5518)

uname (PID: 5853, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5862, Parent: 5518)

uname (PID: 5862, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5866, Parent: 5518)

uname (PID: 5866, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5876, Parent: 5518)

uname (PID: 5876, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5878, Parent: 5518)

uname (PID: 5878, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5882, Parent: 5518)

uname (PID: 5882, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5884, Parent: 5518)

uname (PID: 5884, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5886, Parent: 5518)

uname (PID: 5886, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5888, Parent: 5518)

uname (PID: 5888, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5892, Parent: 5518)

uname (PID: 5892, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5897, Parent: 5518)

uname (PID: 5897, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5899, Parent: 5518)

uname (PID: 5899, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5904, Parent: 5518)

uname (PID: 5904, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5906, Parent: 5518)

uname (PID: 5906, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5908, Parent: 5518)

uname (PID: 5908, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5912, Parent: 5518)

uname (PID: 5912, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5914, Parent: 5518)

uname (PID: 5914, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5916, Parent: 5518)

uname (PID: 5916, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5918, Parent: 5518)

uname (PID: 5918, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5927, Parent: 5518)

uname (PID: 5927, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5929, Parent: 5518)

uname (PID: 5929, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5933, Parent: 5518)

uname (PID: 5933, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5938, Parent: 5518)

uname (PID: 5938, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5942, Parent: 5518)

uname (PID: 5942, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5944, Parent: 5518)

uname (PID: 5944, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5946, Parent: 5518)

uname (PID: 5946, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5948, Parent: 5518)

uname (PID: 5948, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5950, Parent: 5518)

uname (PID: 5950, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5955, Parent: 5518)

uname (PID: 5955, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5959, Parent: 5518)

uname (PID: 5959, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5965, Parent: 5518)

uname (PID: 5965, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5967, Parent: 5518)

uname (PID: 5967, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5969, Parent: 5518)

uname (PID: 5969, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5973, Parent: 5518)

uname (PID: 5973, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5975, Parent: 5518)

uname (PID: 5975, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5977, Parent: 5518)

uname (PID: 5977, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5979, Parent: 5518)

uname (PID: 5979, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5981, Parent: 5518)

uname (PID: 5981, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5983, Parent: 5518)

uname (PID: 5983, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5987, Parent: 5518)

uname (PID: 5987, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5989, Parent: 5518)

uname (PID: 5989, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5991, Parent: 5518)

uname (PID: 5991, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5993, Parent: 5518)

uname (PID: 5993, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5997, Parent: 5518)

uname (PID: 5997, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5999, Parent: 5518)

uname (PID: 5999, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6001, Parent: 5518)

uname (PID: 6001, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6003, Parent: 5518)

uname (PID: 6003, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6008, Parent: 5518)

uname (PID: 6008, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6010, Parent: 5518)

uname (PID: 6010, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6012, Parent: 5518)

uname (PID: 6012, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6014, Parent: 5518)

uname (PID: 6014, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6016, Parent: 5518)

uname (PID: 6016, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6018, Parent: 5518)

uname (PID: 6018, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6022, Parent: 5518)

uname (PID: 6022, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6024, Parent: 5518)

uname (PID: 6024, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6026, Parent: 5518)

uname (PID: 6026, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6028, Parent: 5518)

uname (PID: 6028, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6032, Parent: 5518)

uname (PID: 6032, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6038, Parent: 5518)

uname (PID: 6038, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6040, Parent: 5518)

uname (PID: 6040, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6042, Parent: 5518)

uname (PID: 6042, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6046, Parent: 5518)

uname (PID: 6046, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6048, Parent: 5518)

uname (PID: 6048, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6050, Parent: 5518)

uname (PID: 6050, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6052, Parent: 5518)

uname (PID: 6052, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6054, Parent: 5518)

uname (PID: 6054, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6056, Parent: 5518)

uname (PID: 6056, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6060, Parent: 5518)

uname (PID: 6060, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6062, Parent: 5518)

uname (PID: 6062, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6064, Parent: 5518)

uname (PID: 6064, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6066, Parent: 5518)

uname (PID: 6066, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6070, Parent: 5518)

uname (PID: 6070, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6072, Parent: 5518)

uname (PID: 6072, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6074, Parent: 5518)

uname (PID: 6074, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6076, Parent: 5518)

uname (PID: 6076, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6079, Parent: 5518)

uname (PID: 6079, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6083, Parent: 5518)

uname (PID: 6083, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6085, Parent: 5518)

uname (PID: 6085, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6087, Parent: 5518)

uname (PID: 6087, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6091, Parent: 5518)

uname (PID: 6091, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -r

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 6093, Parent: 5518)

uname (PID: 6093, Parent: 5518, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: uname -m

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5520, Parent: 5511)

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520, Parent: 5511, MD5: 8a53e569e1663d93f45ae5e19fc72498) Arguments: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf d

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5538, Parent: 5520)

mv (PID: 5538, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/kill /usr/bin/.kill

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5592, Parent: 5520)

mv (PID: 5592, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/ls /usr/bin/.ls

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5605, Parent: 5520)

mv (PID: 5605, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/pwd /usr/bin/.pwd

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5621, Parent: 5520)

mv (PID: 5621, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/mkdir /usr/bin/.mkdir

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5623, Parent: 5520)

mv (PID: 5623, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/rm /usr/bin/.rm

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5637, Parent: 5520)

mv (PID: 5637, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/cat /usr/bin/.cat

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5649, Parent: 5520)

mv (PID: 5649, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/grep /usr/bin/.grep

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5654, Parent: 5520)

mv (PID: 5654, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/chmod /usr/bin/.chmod

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5663, Parent: 5520)

mv (PID: 5663, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/chown /usr/bin/.chown

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5670, Parent: 5520)

mv (PID: 5670, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/sudo /usr/bin/.sudo

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5700, Parent: 5520)

mv (PID: 5700, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/top /usr/bin/.top

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5702, Parent: 5520)

mv (PID: 5702, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/tar /usr/bin/.tar

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5711, Parent: 5520)

mv (PID: 5711, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/find /usr/bin/.find

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5718, Parent: 5520)

mv (PID: 5718, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/ssh /usr/bin/.ssh

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5734, Parent: 5520)

mv (PID: 5734, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/wget /usr/bin/.wget

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5739, Parent: 5520)

mv (PID: 5739, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/df /usr/bin/.df

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5754, Parent: 5520)

mv (PID: 5754, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/head /usr/bin/.head

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5760, Parent: 5520)

mv (PID: 5760, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/tail /usr/bin/.tail

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5777, Parent: 5520)

mv (PID: 5777, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/awk /usr/bin/.awk

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5782, Parent: 5520)

mv (PID: 5782, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/sed /usr/bin/.sed

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5787, Parent: 5520)

mv (PID: 5787, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/echo /usr/bin/.echo

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5802, Parent: 5520)

mv (PID: 5802, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/man /usr/bin/.man

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5807, Parent: 5520)

mv (PID: 5807, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/ln /usr/bin/.ln

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5824, Parent: 5520)

mv (PID: 5824, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/wc /usr/bin/.wc

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5829, Parent: 5520)

mv (PID: 5829, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/du /usr/bin/.du

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5844, Parent: 5520)

mv (PID: 5844, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/netstat /usr/bin/.netstat

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5849, Parent: 5520)

mv (PID: 5849, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/ss /usr/bin/.ss

SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf New Fork (PID: 5860, Parent: 5520)

mv (PID: 5860, Parent: 5520, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/lsof /usr/bin/.lsof

udisksd New Fork (PID: 5553, Parent: 803)

dumpe2fs (PID: 5553, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/dm-0

cleanup

String containing 'busybox' found: 30517578125time: file bad addressfile existsbroken pipebad messagealarm clockstack faultfinal tokentls10servertls: alert(local errorc e trafficCERTIFICATEassistQueuenetpollInitreflectOffsglobalAllocmSpanManualstart traceclobberfreegccheckmarkscheddetailunspecifiedcgocall nil s.nelems= of size ) returned runtime: p ms clock, nBSSRoots=runtime: P exp.) for minTrigger=GOMEMLIMIT=bad m value, elemsize= freeindex= span.list=, npages = , a123456=[ p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACEBACK) at entry+ (targetpc= , plugin: runtime: g : frame.sp=created by .WithCancel.WithValue(ClassHESIODauthoritiesadditionalsshort writebad argSizemethodargs(reflect.SetSHA-512/224SHA-512/256BLAKE2s-256BLAKE2b-256BLAKE2b-384BLAKE2b-512invalid oidpsk_id_hashgocachehashgocachetesthttp2clienthttp2serverarchive/tarcrypto/x509archive/zipgeneralizedapplication/tmp/.system/bin/busybox/sbin/auditd/usr/sbid -D/lib/systemdmultipathtcp127.0.

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 1203, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 129, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 131, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 135, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 142, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 145, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 158, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 1583, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 1873, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 19, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 240, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 242, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 244, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 245, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 246, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 247, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 2517, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 2672, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 268, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 271, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 273, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 275, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 276, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 277, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 279, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 280, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 282, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 283, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 284, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 285, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 287, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 288, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 289, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 290, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 291, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 292, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 293, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 294, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 295, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 296, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 297, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 298, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 299, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 300, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 301, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 302, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 303, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 304, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 305, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 306, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 307, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 308, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 309, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 310, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 311, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 312, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 313, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 314, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 315, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 316, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 317, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 318, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 319, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 320, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 321, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 323, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 325, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 329, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 348, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 3752, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 3753, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 3754, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 3755, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 378, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 418, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 5, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 512, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 514, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 519, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 5451, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 548, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 659, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 671, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 678, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 679, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 683, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 684, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 7, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 740, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 8, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 86, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 941, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 3866, result: no such process	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 5724, result: no such process	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 5955, result: no such process	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	SIGKILL sent: pid: 6038, result: no such process	Jump to behavior

Source: classification engine

Classification label: mal76.spre.troj.evad.linELF@0/44@0/0

Source: ELF file section	Submission: SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Source: ELF file section	Dropped file: .system.14.dr
Source: ELF file section	Dropped file: default_dns.conf.14.dr
Source: ELF file section	Dropped file: media.jpg.14.dr
Source: ELF file section	Dropped file: readdir.so.14.dr
Source: ELF file section	Dropped file: cgo.14.dr
Source: ELF file section	Dropped file: kernal.14.dr
Source: ELF file section	Dropped file: kill.16.dr
Source: ELF file section	Dropped file: ls.16.dr
Source: ELF file section	Dropped file: pwd.16.dr
Source: ELF file section	Dropped file: mkdir.16.dr
Source: ELF file section	Dropped file: rm.16.dr
Source: ELF file section	Dropped file: cat.16.dr
Source: ELF file section	Dropped file: grep.16.dr
Source: ELF file section	Dropped file: chmod.16.dr
Source: ELF file section	Dropped file: chown.16.dr
Source: ELF file section	Dropped file: sudo.16.dr
Source: ELF file section	Dropped file: top.16.dr
Source: ELF file section	Dropped file: tar.16.dr
Source: ELF file section	Dropped file: find.16.dr
Source: ELF file section	Dropped file: ssh.16.dr
Source: ELF file section	Dropped file: wget.16.dr
Source: ELF file section	Dropped file: df.16.dr
Source: ELF file section	Dropped file: head.16.dr
Source: ELF file section	Dropped file: tail.16.dr
Source: ELF file section	Dropped file: awk.16.dr
Source: ELF file section	Dropped file: sed.16.dr
Source: ELF file section	Dropped file: echo.16.dr
Source: ELF file section	Dropped file: man.16.dr
Source: ELF file section	Dropped file: ln.16.dr
Source: ELF file section	Dropped file: wc.16.dr
Source: ELF file section	Dropped file: du.16.dr
Source: ELF file section	Dropped file: netstat.16.dr
Source: ELF file section	Dropped file: ss.16.dr
Source: ELF file section	Dropped file: lsof.16.dr

Persistence and Installation Behavior

Executes the "crontab" command typically for achieving persistence

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5590)

Crontab executable: /usr/bin/crontab -> crontab /var/.recovery

Jump to behavior

Sample tries to persist itself using cron

Source: /usr/bin/crontab (PID: 5590)	File: /var/spool/cron/crontabs/tmp.Mtz4gS			Jump to behavior
Source: /usr/bin/crontab (PID: 5590)	File: /var/spool/cron/crontabs/root			Jump to behavior

Writes identical ELF files to multiple locations

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/bin/tail	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/bin/awk	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/bin/rm	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/bin/mkdir	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/bin/pwd	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /tmp/.system	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/bin/ssh	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/bin/ls	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/bin/wc	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/bin/find	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/bin/sudo	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/bin/df	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/bin/ln	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/bin/cat	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/bin/chown	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /opt/cgo	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/lib/readdir.so	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/bin/top	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/bin/chmod	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/bin/du	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/bin/echo	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /etc/default_dns.conf	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/bin/kill	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/bin/man	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/bin/netstat	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/bin/head	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/bin/lsof	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /var/kernal	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /var/web/media.jpg	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/bin/grep	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/bin/tar	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/bin/wget	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File with SHA-256 7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163 written: /usr/bin/ss	Jump to dropped file

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	File: /tmp/.system	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	File: /var/.recovery	Jump to behavior
Source: /usr/bin/crontab (PID: 5590)	Directory: /var/.recovery	Jump to behavior

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5603)	Systemctl executable: /usr/bin/systemctl -> systemctl daemon-reload redis.service	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5607)	Systemctl executable: /usr/bin/systemctl -> systemctl "enable " redis.service	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5613)	Systemctl executable: /usr/bin/systemctl -> systemctl daemon-reload mysql.service	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5619)	Systemctl executable: /usr/bin/systemctl -> systemctl "enable " mysql.service	Jump to behavior

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	Reads from proc file: /proc/cpuinfo			Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	Reads from proc file: /proc/meminfo			Jump to behavior

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	File written: /opt/cgo	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	File written: /tmp/.system	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	File written: /etc/default_dns.conf	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	File written: /var/kernal	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	File written: /var/web/media.jpg	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	File written: /usr/lib/readdir.so	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/kill	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/ls	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/pwd	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/mkdir	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/rm	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/cat	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/grep	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/chmod	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/chown	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/sudo	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/top	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/tar	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/find	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/ssh	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/wget	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/df	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/head	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/tail	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/awk	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/sed	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/echo	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/man	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/ln	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/wc	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/du	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/netstat	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/ss	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File written: /usr/bin/lsof	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Drops files in suspicious directories

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/kill	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/ls	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/pwd	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/mkdir	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/rm	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/cat	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/grep	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/chmod	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/chown	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/sudo	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/top	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/tar	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/find	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/ssh	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/wget	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/df	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/head	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/tail	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/awk	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/sed	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/echo	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/man	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/ln	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/wc	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/du	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/netstat	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/ss	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	File: /usr/bin/lsof	Jump to dropped file

Drops invisible ELF files

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)

ELF file: /tmp/.system

Jump to dropped file

Sample deletes itself

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)

File: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf

Jump to behavior

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	Path: /usr/bin/ls	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	Path: /usr/bin/netstat	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	Path: /usr/bin/ss	Jump to dropped file
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	Path: /usr/bin/lsof	Jump to dropped file

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)

Reads CPU info from proc file: /proc/cpuinfo

Jump to behavior

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)

Reads CPU info from /sys: /sys/devices/system/cpu/online

Jump to behavior

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5511)	Queries kernel information via 'uname':	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5518)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5565)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5569)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5586)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5588)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5594)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5599)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5615)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5617)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5628)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5630)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5642)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5644)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5659)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5661)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5677)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5695)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5704)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5709)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5724)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5729)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5744)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5749)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5767)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5772)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5792)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5797)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5812)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5817)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5834)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5839)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5851)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5853)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5862)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5866)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5876)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5878)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5882)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5884)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5886)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5888)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5892)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5897)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5899)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5904)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5906)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5908)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5912)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5914)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5916)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5918)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5927)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5929)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5933)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5938)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5942)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5944)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5946)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5948)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5950)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5955)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5959)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5965)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5967)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5969)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5973)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5975)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5977)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5979)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5981)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5983)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5987)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5989)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5991)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5993)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5997)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 5999)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6001)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6003)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6008)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6010)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6012)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6014)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6016)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6018)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6022)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6024)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6026)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6028)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6032)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6038)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6040)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6042)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6046)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6048)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6050)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6052)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6054)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6056)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6060)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6062)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6064)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6066)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6070)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6072)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6074)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6076)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6079)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6083)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6085)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6087)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6091)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uname (PID: 6093)	Queries kernel information via 'uname':	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5520)	Queries kernel information via 'uname':	Jump to behavior

Source: SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf, 5520.1.00007ffe1be73000.00007ffe1be94000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-riscv64
Source: SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf, 5520.1.00007ffe1be73000.00007ffe1be94000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-riscv64/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elfdSHELL=/bin/bashSUDO_GID=1000MAIL=/var/mail/rootHOME=/rootSUDO_COMMAND=/bin/bashLANG=en_US.UTF-8USER=rootLOGNAME=rootCOLORTERM=truecolorTERM=xterm-256colorSUDO_UID=1000XAUTHORITY=/run/user/1000/gdm/XauthorityDISPLAY=:1.0PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binSUDO_USER=saturnino/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Source: SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf, 5511.1.0000562e41e31000.0000562e4242c000.rw-.sdmp	Binary or memory string: A.V1rv64gcsu-v1.9.1-riscv-cpu1/etc/qemu-binfmt/riscv64
Source: SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf, 5520.1.0000559e7f8ce000.0000559e7fee9000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/riscv64
Source: SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf, 5520.1.0000559e7f8ce000.0000559e7fee9000.rw-.sdmp	Binary or memory string: U1rv64gcsu-v1.9.1-riscv-cpu1/etc/qemu-binfmt/riscv64
Source: SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf, 5511.1.00007ffff7991000.00007ffff79b2000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-riscv64/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf

Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5565)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5569)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5586)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5588)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5594)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5599)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5615)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5617)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5628)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5630)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5642)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5644)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5659)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5661)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5677)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5695)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5704)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5709)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5724)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5729)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5744)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5749)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5767)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5772)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5792)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5797)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5812)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5817)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5834)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5839)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5851)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5853)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5862)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5866)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5876)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5878)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5882)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5884)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5886)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5888)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5892)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5897)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5899)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5904)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5906)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5908)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5912)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5914)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5916)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5918)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5927)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5929)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5933)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5938)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5942)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5944)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5946)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5948)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5950)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5955)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5959)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5965)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5967)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5969)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5973)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5975)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5977)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5979)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5981)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5983)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5987)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5989)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5991)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5993)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5997)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 5999)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6001)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6003)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6008)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6010)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6012)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6014)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6016)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6018)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6022)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6024)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6026)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6028)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6032)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6038)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6040)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6042)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6046)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6048)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6050)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6052)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6054)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6056)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6060)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6062)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6064)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6066)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6070)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6072)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6074)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6076)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6079)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6083)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6085)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6087)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6091)	Uname executable: /usr/bin/uname -> uname -r	Jump to behavior
Source: /tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf (PID: 6093)	Uname executable: /usr/bin/uname -> uname -m	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Systemd Service	1 Systemd Service	11 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Hidden Files and Directories	LSASS Memory	4 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf	3%	ReversingLabs	Linux.Trojan.DDOSAgent

Dropped Files

Source	Detection	Scanner	Label
/etc/default_dns.conf	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/opt/cgo	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/tmp/.system	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/awk	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/cat	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/chmod	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/chown	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/df	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/du	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/echo	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/find	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/grep	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/head	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/kill	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/ln	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/ls	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/lsof	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/man	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/mkdir	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/netstat	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/pwd	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/rm	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/ss	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/ssh	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/sudo	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/tail	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/tar	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/top	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/wc	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/bin/wget	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/usr/lib/readdir.so	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/var/kernal	3%	ReversingLabs	Linux.Trojan.DDOSAgent
/var/web/media.jpg	3%	ReversingLabs	Linux.Trojan.DDOSAgent

Name	Source	Malicious	Antivirus Detection	Reputation
https://bugs.launchpad.net/ubuntu/	SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf, df.16.dr, cgo.14.dr, mkdir.16.dr, sed.16.dr, chmod.16.dr, netstat.16.dr, wget.16.dr, sudo.16.dr, man.16.dr, lsof.16.dr, top.16.dr, cat.16.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
156.229.232.67	unknown	Seychelles		139086	ONL-HKOCEANNETWORKLIMITEDHK	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
156.229.232.67	SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf	Get hash	malicious	Unknown	Browse
	main-linux-arm-5.elf	Get hash	malicious	Unknown	Browse
	main-linux-ppc64le.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ONL-HKOCEANNETWORKLIMITEDHK	SecuriteInfo.com.ELF.DDOSAgent-BT.26540.24716.elf	Get hash	malicious	Unknown	Browse	156.229.232.67
	main-linux-arm-5.elf	Get hash	malicious	Unknown	Browse	156.229.232.67
	main-linux-ppc64le.elf	Get hash	malicious	Unknown	Browse	156.229.232.67
	arm7.elf	Get hash	malicious	Mirai	Browse	156.229.232.99
	arm5.elf	Get hash	malicious	Unknown	Browse	156.229.232.99
	rep.arm5.elf	Get hash	malicious	Unknown	Browse	156.229.232.99
	rep.m68k.elf	Get hash	malicious	Unknown	Browse	156.229.232.99
	rep.arm7.elf	Get hash	malicious	Mirai	Browse	156.229.232.99
	rep.spc.elf	Get hash	malicious	Unknown	Browse	156.229.232.99
	rep.x86.elf	Get hash	malicious	Unknown	Browse	156.229.232.99

Process:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
File Type:	ELF 64-bit LSB executable, UCB RISC-V, RVC, double-float ABI, version 1 (SYSV), statically linked, BuildID[sha1]=8dd6bcb9600e14a3f3cd4e754890601771052adc, for GNU/Linux 4.15.0, stripped
Category:	dropped
Size (bytes):	4612664
Entropy (8bit):	6.151312236671566
Encrypted:	false
SSDEEP:	24576:jMuVANVxBDSPJv8MrDvW8QeanQoKl/bOS14FJWxApUohF+93hryKQtyJ6DsVYytD:XA/0vvLnoPdDSYyOpjMMy3CgV40q
MD5:	66FF22F7AFD265F11B0E2302DBEA5476
SHA1:	247B2A5B45746E08D29A9B356372796ACFDBAD1A
SHA-256:	7410709CBF642943D89DDE6C430DD75DB6EF105D399F32FFDF9B2E7839DD8163
SHA-512:	82294B595F230AF87A99DE3B4ECD3A4D971877700FFD29AE14E6C9574C11F9F1F42E311EBAF90FB3DB02CEA1DC71D2DF1FFF3914B9F5FF66F3B6000A140F43B8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	low
Preview:	.ELF.................... .......@........ZF.........@.8...@........p....nYF.....................W.........................................................D.......D.......................D.......E.......E.............8}................................................................................D.......E.......E..... .......................Q.td....................................................R.td......D.......E.......E.....XD......XD..........................GNU....`.....NuH.`.q.*.............GNU.....................S.......Go..kYTUFkN-yf4GtGMWZKLo/lTFNzwdHEM0Urcx-i-TP/W74a007y13EPOHKTAUgw/877HYqUApnoJ4VK1VK8k.................................................................................................Uq..&.J.N.....H....).d..E..7...c#4...F....&.c.7..G...........'..&..P.....#.4..@.H.'....G.....#8...p..E.....F.Fs....H.Gc....@..H.#.."..........H.#.. .'...'cZ....H.... .P.....E.......d....c.7..G.'....&.....'....H......P....#.4..@.'..!..Gc............E>..G........

Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67
Source: unknown	TCP traffic detected without corresponding DNS query: 156.229.232.67

Process:	/usr/bin/crontab
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.0764065140686085
Encrypted:	false
SSDEEP:	6:SUrpqoqQjEOP1K+1/iqOBFQ7yXQUsXy5iGMQ5UYLtCFt39YIazEhn:8Qj2T8gQUsXy5UeHLU9Ykn
MD5:	AF45B660390B94656556AF5A12C68C05
SHA1:	D33C75C84CBFFB7F4B528F9B3E56ADA935ED6F92
SHA-256:	22BB14A4EF3A13BCDADF05436A564685C68686A3CAA9342EE2266A8F993051DE
SHA-512:	3DC2C7CC4F6DAD51BBCF1BF8A47EC5935EB64B5460FEF067FDAB7F6FE0A9C7E5E647B95D292670BE34539300731A403A6434C628557E6FAEC3C8FCE943BFA9CB
Malicious:	true
Preview:	# DO NOT EDIT THIS FILE - edit the master and reinstall..# (/var/.recovery installed on Mon Feb 3 15:52:18 2025).# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $).* * * * * /var/kernal.

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x10520
Flags:	0x5
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	7
Section Header Offset:	4610808
Section Header Size:	64
Number of Section Headers:	29
Header String Table Index:	28

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.note.gnu.build-id	NOTE	0x101c8	0x1c8	0x24	0x0	0x2	A	4
.note.ABI-tag	NOTE	0x101ec	0x1ec	0x20	0x0	0x2	A	4
.note.go.buildid	NOTE	0x1020c	0x20c	0x64	0x0	0x2	A	4
.rela.dyn	RELA	0x10270	0x270	0x60	0x18	0x2	A	8
.text	PROGBITS	0x102d0	0x2d0	0x236fd6	0x0	0x6	AX	16
.rodata	PROGBITS	0x2472c0	0x2372c0	0xd702c	0x0	0x2	A	32
.typelink	PROGBITS	0x31e300	0x30e300	0x1354	0x0	0x2	A	32
.itablink	PROGBITS	0x31f660	0x30f660	0x528	0x0	0x2	A	32
.gopclntab	PROGBITS	0x31fba0	0x30fba0	0x11fab0	0x0	0x2	A	32
.eh_frame	PROGBITS	0x43f650	0x42f650	0x1b004	0x0	0x2	A	8
.gcc_except_table	PROGBITS	0x45a654	0x44a654	0x1bf	0x0	0x2	A	1
.tdata	PROGBITS	0x45bba8	0x44aba8	0x20	0x0	0x403	WAT	8
.tbss	NOBITS	0x45bbc8	0x44abc8	0x60	0x0	0x403	WAT	8
.preinit_array	PREINIT_ARRAY	0x45bbc8	0x44abc8	0x8	0x8	0x3	WA	1
.init_array	INIT_ARRAY	0x45bbd0	0x44abd0	0x8	0x8	0x3	WA	8
.fini_array	FINI_ARRAY	0x45bbd8	0x44abd8	0x10	0x8	0x3	WA	8
.data.rel.ro	PROGBITS	0x45bbe8	0x44abe8	0x3ef8	0x0	0x3	WA	8
.got	PROGBITS	0x45fae0	0x44eae0	0x510	0x8	0x3	WA	8
.got.plt	PROGBITS	0x45fff0	0x44eff0	0x10	0x8	0x3	WA	8
.data	PROGBITS	0x460000	0x44f000	0xb0d8	0x0	0x3	WA	32
.go.buildinfo	PROGBITS	0x46b0e0	0x45a0e0	0x280	0x0	0x3	WA	16
.noptrdata	PROGBITS	0x46b360	0x45a360	0xb5e0	0x0	0x3	WA	32
.sdata	PROGBITS	0x476940	0x465940	0x8	0x0	0x3	WA	8
.bss	NOBITS	0x476960	0x465948	0x26c18	0x0	0x3	WA	32
.noptrbss	NOBITS	0x49d580	0x465948	0x6360	0x0	0x3	WA	32
.comment	PROGBITS	0x0	0x465948	0x26	0x1	0x30	MS	1
.riscv.attributes	<unknown>	0x0	0x46596e	0x57	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x4659c5	0x12f	0x0	0x0		1

Start time (UTC):	21:52:13
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Arguments:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
File size:	4268264 bytes
MD5 hash:	8a53e569e1663d93f45ae5e19fc72498

Start time (UTC):	21:52:14
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Arguments:	-
File size:	4268264 bytes
MD5 hash:	8a53e569e1663d93f45ae5e19fc72498

Start time (UTC):	21:52:16
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Arguments:	-
File size:	4268264 bytes
MD5 hash:	8a53e569e1663d93f45ae5e19fc72498

Start time (UTC):	21:52:17
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Arguments:	-
File size:	4268264 bytes
MD5 hash:	8a53e569e1663d93f45ae5e19fc72498

Start time (UTC):	21:52:18
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Arguments:	-
File size:	4268264 bytes
MD5 hash:	8a53e569e1663d93f45ae5e19fc72498

Start time (UTC):	21:52:21
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Arguments:	-
File size:	4268264 bytes
MD5 hash:	8a53e569e1663d93f45ae5e19fc72498

Start time (UTC):	21:52:22
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Arguments:	-
File size:	4268264 bytes
MD5 hash:	8a53e569e1663d93f45ae5e19fc72498

Start time (UTC):	21:52:23
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Arguments:	-
File size:	4268264 bytes
MD5 hash:	8a53e569e1663d93f45ae5e19fc72498

Start time (UTC):	21:52:26
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Arguments:	-
File size:	4268264 bytes
MD5 hash:	8a53e569e1663d93f45ae5e19fc72498

Start time (UTC):	21:52:28
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Arguments:	-
File size:	4268264 bytes
MD5 hash:	8a53e569e1663d93f45ae5e19fc72498

Start time (UTC):	21:52:30
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Arguments:	-
File size:	4268264 bytes
MD5 hash:	8a53e569e1663d93f45ae5e19fc72498

Start time (UTC):	21:52:33
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Arguments:	-
File size:	4268264 bytes
MD5 hash:	8a53e569e1663d93f45ae5e19fc72498

Start time (UTC):	21:52:35
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Arguments:	-
File size:	4268264 bytes
MD5 hash:	8a53e569e1663d93f45ae5e19fc72498

Start time (UTC):	21:52:37
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Arguments:	-
File size:	4268264 bytes
MD5 hash:	8a53e569e1663d93f45ae5e19fc72498

Start time (UTC):	21:52:39
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Arguments:	-
File size:	4268264 bytes
MD5 hash:	8a53e569e1663d93f45ae5e19fc72498

Start time (UTC):	21:52:42
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Arguments:	-
File size:	4268264 bytes
MD5 hash:	8a53e569e1663d93f45ae5e19fc72498

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/etc/default_dns.conf

/etc/systemd/system/mysql.service

/etc/systemd/system/redis.service

/opt/cgo

/tmp/.system

/tmp/qemu-open.KM80ds (deleted)

/tmp/qemu-open.riy3CC (deleted)

/tmp/qemu-open.wOzXET (deleted)

/tmp/qemu-open.y3Qngr (deleted)

/tmp/qemu-open.zPHrmA (deleted)

/tmp/qemu-open.zkFmBU (deleted)

/usr/bin/awk

/usr/bin/cat

/usr/bin/chmod

/usr/bin/chown

/usr/bin/df

/usr/bin/du

/usr/bin/echo

/usr/bin/find

/usr/bin/grep

/usr/bin/head

/usr/bin/kill

/usr/bin/ln

/usr/bin/ls

/usr/bin/lsof

/usr/bin/man

/usr/bin/mkdir

/usr/bin/netstat

/usr/bin/pwd

/usr/bin/rm

/usr/bin/sed

/usr/bin/ss

/usr/bin/ssh

Linux Analysis Report
SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf

Start time (UTC):	21:52:44
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Arguments:	-
File size:	4268264 bytes
MD5 hash:	8a53e569e1663d93f45ae5e19fc72498

Start time (UTC):	21:52:46
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Arguments:	-
File size:	4268264 bytes
MD5 hash:	8a53e569e1663d93f45ae5e19fc72498

Start time (UTC):	21:52:48
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Arguments:	-
File size:	4268264 bytes
MD5 hash:	8a53e569e1663d93f45ae5e19fc72498

Start time (UTC):	21:52:50
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Arguments:	-
File size:	4268264 bytes
MD5 hash:	8a53e569e1663d93f45ae5e19fc72498

Start time (UTC):	21:52:51
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Arguments:	-
File size:	4268264 bytes
MD5 hash:	8a53e569e1663d93f45ae5e19fc72498

Start time (UTC):	21:52:53
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Arguments:	-
File size:	4268264 bytes
MD5 hash:	8a53e569e1663d93f45ae5e19fc72498

Start time (UTC):	21:52:55
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Arguments:	-
File size:	4268264 bytes
MD5 hash:	8a53e569e1663d93f45ae5e19fc72498

Start time (UTC):	21:52:57
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Arguments:	-
File size:	4268264 bytes
MD5 hash:	8a53e569e1663d93f45ae5e19fc72498

Start time (UTC):	21:52:59
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Arguments:	-
File size:	4268264 bytes
MD5 hash:	8a53e569e1663d93f45ae5e19fc72498

Start time (UTC):	21:53:01
Start date (UTC):	03/02/2025
Path:	/tmp/SecuriteInfo.com.ELF.DDOSAgent-BT.21277.30452.elf
Arguments:	-
File size:	4268264 bytes
MD5 hash:	8a53e569e1663d93f45ae5e19fc72498