Create Interactive Tour

Linux Analysis Report
mqms.elf

Overview

General Information

Sample name:	mqms.elf
Analysis ID:	1676335
MD5:	f34e08709d5e2f1705f844af3fcf138d
SHA1:	8e5b93eb91e5b5d32696526f295dcdd10194955a
SHA256:	f0502450289ff1ce8a4af7f5c23b195215c11eb3d6bbe74ea346c9566e3f74ed
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	80
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Uses IRC for communication with a C&C

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "kill" or "pkill" command typically used to terminate processes

Reads CPU information from /sys indicative of miner or evasive malware

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample contains strings indicative of password brute-forcing capabilities

Sample contains strings that are user agent strings indicative of HTTP manipulation

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1676335
Start date and time:	2025-04-28 16:27:15 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	mqms.elf
Detection:	MAL
Classification:	mal80.troj.linELF@0/0@0/0

Warnings

Report size exceeded maximum capacity and may have missing behavior information.

Runtime Messages

Command:	/tmp/mqms.elf
PID:	5435
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	CAPSAICIN
Standard Error:

Process Tree

system is lnxubuntu20

mqms.elf (PID: 5435, Parent: 5357, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/mqms.elf

mqms.elf New Fork (PID: 5437, Parent: 5435)

mqms.elf New Fork (PID: 5443, Parent: 5437)

mqms.elf New Fork (PID: 5444, Parent: 5437)

mqms.elf New Fork (PID: 5446, Parent: 5437)

sh (PID: 5446, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 902i13 || busybox pkill -9 902i13"

sh New Fork (PID: 5449, Parent: 5446)

pkill (PID: 5449, Parent: 5446, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 902i13

sh New Fork (PID: 5450, Parent: 5446)

busybox (PID: 5450, Parent: 5446, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 902i13

mqms.elf New Fork (PID: 5451, Parent: 5437)

sh (PID: 5451, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 BzSxLxBxeY || busybox pkill -9 BzSxLxBxeY"

sh New Fork (PID: 5453, Parent: 5451)

pkill (PID: 5453, Parent: 5451, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 BzSxLxBxeY

sh New Fork (PID: 5456, Parent: 5451)

busybox (PID: 5456, Parent: 5451, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 BzSxLxBxeY

mqms.elf New Fork (PID: 5457, Parent: 5437)

sh (PID: 5457, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 HOHO-LUGO7 || busybox pkill -9 HOHO-LUGO7"

sh New Fork (PID: 5459, Parent: 5457)

pkill (PID: 5459, Parent: 5457, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 HOHO-LUGO7

sh New Fork (PID: 5466, Parent: 5457)

busybox (PID: 5466, Parent: 5457, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 HOHO-LUGO7

mqms.elf New Fork (PID: 5467, Parent: 5437)

sh (PID: 5467, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 HOHO-U79OL || busybox pkill -9 HOHO-U79OL"

sh New Fork (PID: 5469, Parent: 5467)

pkill (PID: 5469, Parent: 5467, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 HOHO-U79OL

sh New Fork (PID: 5470, Parent: 5467)

busybox (PID: 5470, Parent: 5467, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 HOHO-U79OL

mqms.elf New Fork (PID: 5473, Parent: 5437)

sh (PID: 5473, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 JuYfouyf87 || busybox pkill -9 JuYfouyf87"

sh New Fork (PID: 5479, Parent: 5473)

pkill (PID: 5479, Parent: 5473, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 JuYfouyf87

sh New Fork (PID: 5480, Parent: 5473)

busybox (PID: 5480, Parent: 5473, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 JuYfouyf87

mqms.elf New Fork (PID: 5481, Parent: 5437)

sh (PID: 5481, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"

sh New Fork (PID: 5486, Parent: 5481)

pkill (PID: 5486, Parent: 5481, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeR69xd

sh New Fork (PID: 5487, Parent: 5481)

busybox (PID: 5487, Parent: 5481, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeR69xd

mqms.elf New Fork (PID: 5490, Parent: 5437)

sh (PID: 5490, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SO190Ij1X || busybox pkill -9 SO190Ij1X"

sh New Fork (PID: 5492, Parent: 5490)

pkill (PID: 5492, Parent: 5490, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SO190Ij1X

sh New Fork (PID: 5493, Parent: 5490)

busybox (PID: 5493, Parent: 5490, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SO190Ij1X

mqms.elf New Fork (PID: 5494, Parent: 5437)

sh (PID: 5494, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 LOLKIKEEEDDE || busybox pkill -9 LOLKIKEEEDDE"

sh New Fork (PID: 5499, Parent: 5494)

pkill (PID: 5499, Parent: 5494, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 LOLKIKEEEDDE

sh New Fork (PID: 5500, Parent: 5494)

busybox (PID: 5500, Parent: 5494, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 LOLKIKEEEDDE

mqms.elf New Fork (PID: 5503, Parent: 5437)

sh (PID: 5503, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ekjheory98e || busybox pkill -9 ekjheory98e"

sh New Fork (PID: 5509, Parent: 5503)

pkill (PID: 5509, Parent: 5503, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ekjheory98e

sh New Fork (PID: 5526, Parent: 5503)

busybox (PID: 5526, Parent: 5503, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ekjheory98e

mqms.elf New Fork (PID: 5527, Parent: 5437)

sh (PID: 5527, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scansh4 || busybox pkill -9 scansh4"

sh New Fork (PID: 5529, Parent: 5527)

pkill (PID: 5529, Parent: 5527, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scansh4

sh New Fork (PID: 5530, Parent: 5527)

busybox (PID: 5530, Parent: 5527, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scansh4

mqms.elf New Fork (PID: 5533, Parent: 5437)

sh (PID: 5533, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MDMA || busybox pkill -9 MDMA"

sh New Fork (PID: 5535, Parent: 5533)

pkill (PID: 5535, Parent: 5533, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MDMA

sh New Fork (PID: 5536, Parent: 5533)

busybox (PID: 5536, Parent: 5533, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MDMA

mqms.elf New Fork (PID: 5537, Parent: 5437)

sh (PID: 5537, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 fdevalvex || busybox pkill -9 fdevalvex"

sh New Fork (PID: 5542, Parent: 5537)

pkill (PID: 5542, Parent: 5537, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 fdevalvex

sh New Fork (PID: 5543, Parent: 5537)

busybox (PID: 5543, Parent: 5537, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 fdevalvex

mqms.elf New Fork (PID: 5546, Parent: 5437)

sh (PID: 5546, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scanspc || busybox pkill -9 scanspc"

sh New Fork (PID: 5551, Parent: 5546)

pkill (PID: 5551, Parent: 5546, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scanspc

sh New Fork (PID: 5552, Parent: 5546)

busybox (PID: 5552, Parent: 5546, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scanspc

mqms.elf New Fork (PID: 5553, Parent: 5437)

sh (PID: 5553, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MELTEDNINJAREALZ || busybox pkill -9 MELTEDNINJAREALZ"

sh New Fork (PID: 5555, Parent: 5553)

pkill (PID: 5555, Parent: 5553, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MELTEDNINJAREALZ

sh New Fork (PID: 5556, Parent: 5553)

busybox (PID: 5556, Parent: 5553, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MELTEDNINJAREALZ

mqms.elf New Fork (PID: 5557, Parent: 5437)

sh (PID: 5557, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 flexsonskids || busybox pkill -9 flexsonskids"

sh New Fork (PID: 5559, Parent: 5557)

pkill (PID: 5559, Parent: 5557, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 flexsonskids

sh New Fork (PID: 5562, Parent: 5557)

busybox (PID: 5562, Parent: 5557, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 flexsonskids

mqms.elf New Fork (PID: 5563, Parent: 5437)

sh (PID: 5563, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scanx86 || busybox pkill -9 scanx86"

sh New Fork (PID: 5565, Parent: 5563)

pkill (PID: 5565, Parent: 5563, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scanx86

sh New Fork (PID: 5566, Parent: 5563)

busybox (PID: 5566, Parent: 5563, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scanx86

mqms.elf New Fork (PID: 5567, Parent: 5437)

sh (PID: 5567, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MISAKI-U79OL || busybox pkill -9 MISAKI-U79OL"

sh New Fork (PID: 5573, Parent: 5567)

pkill (PID: 5573, Parent: 5567, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MISAKI-U79OL

sh New Fork (PID: 5576, Parent: 5567)

busybox (PID: 5576, Parent: 5567, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MISAKI-U79OL

mqms.elf New Fork (PID: 5577, Parent: 5437)

sh (PID: 5577, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 foAxi102kxe || busybox pkill -9 foAxi102kxe"

sh New Fork (PID: 5581, Parent: 5577)

pkill (PID: 5581, Parent: 5577, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 foAxi102kxe

sh New Fork (PID: 5583, Parent: 5577)

busybox (PID: 5583, Parent: 5577, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 foAxi102kxe

mqms.elf New Fork (PID: 5586, Parent: 5437)

sh (PID: 5586, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 swodjwodjwoj || busybox pkill -9 swodjwodjwoj"

sh New Fork (PID: 5591, Parent: 5586)

pkill (PID: 5591, Parent: 5586, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 swodjwodjwoj

sh New Fork (PID: 5592, Parent: 5586)

busybox (PID: 5592, Parent: 5586, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 swodjwodjwoj

mqms.elf New Fork (PID: 5593, Parent: 5437)

sh (PID: 5593, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MmKiy7f87l || busybox pkill -9 MmKiy7f87l"

sh New Fork (PID: 5598, Parent: 5593)

pkill (PID: 5598, Parent: 5593, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MmKiy7f87l

sh New Fork (PID: 5601, Parent: 5593)

busybox (PID: 5601, Parent: 5593, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MmKiy7f87l

mqms.elf New Fork (PID: 5605, Parent: 5437)

sh (PID: 5605, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 freecookiex86 || busybox pkill -9 freecookiex86"

sh New Fork (PID: 5611, Parent: 5605)

pkill (PID: 5611, Parent: 5605, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 freecookiex86

sh New Fork (PID: 5612, Parent: 5605)

busybox (PID: 5612, Parent: 5605, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 freecookiex86

mqms.elf New Fork (PID: 5613, Parent: 5437)

sh (PID: 5613, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 sysgpu || busybox pkill -9 sysgpu"

sh New Fork (PID: 5615, Parent: 5613)

pkill (PID: 5615, Parent: 5613, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 sysgpu

sh New Fork (PID: 5618, Parent: 5613)

busybox (PID: 5618, Parent: 5613, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 sysgpu

mqms.elf New Fork (PID: 5619, Parent: 5437)

sh (PID: 5619, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"

sh New Fork (PID: 5621, Parent: 5619)

pkill (PID: 5621, Parent: 5619, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeR69xd

sh New Fork (PID: 5624, Parent: 5619)

busybox (PID: 5624, Parent: 5619, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeR69xd

mqms.elf New Fork (PID: 5625, Parent: 5437)

sh (PID: 5625, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 frgege || busybox pkill -9 frgege"

sh New Fork (PID: 5627, Parent: 5625)

pkill (PID: 5627, Parent: 5625, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 frgege

sh New Fork (PID: 5628, Parent: 5625)

busybox (PID: 5628, Parent: 5625, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 frgege

mqms.elf New Fork (PID: 5629, Parent: 5437)

sh (PID: 5629, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 sysupdater || busybox pkill -9 sysupdater"

sh New Fork (PID: 5631, Parent: 5629)

pkill (PID: 5631, Parent: 5629, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 sysupdater

sh New Fork (PID: 5634, Parent: 5629)

busybox (PID: 5634, Parent: 5629, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 sysupdater

mqms.elf New Fork (PID: 5635, Parent: 5437)

sh (PID: 5635, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 0DnAzepd || busybox pkill -9 0DnAzepd"

sh New Fork (PID: 5641, Parent: 5635)

pkill (PID: 5641, Parent: 5635, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 0DnAzepd

sh New Fork (PID: 5642, Parent: 5635)

busybox (PID: 5642, Parent: 5635, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 0DnAzepd

mqms.elf New Fork (PID: 5643, Parent: 5437)

sh (PID: 5643, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeRD0nks69 || busybox pkill -9 NiGGeRD0nks69"

sh New Fork (PID: 5645, Parent: 5643)

pkill (PID: 5645, Parent: 5643, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeRD0nks69

sh New Fork (PID: 5648, Parent: 5643)

busybox (PID: 5648, Parent: 5643, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeRD0nks69

mqms.elf New Fork (PID: 5649, Parent: 5437)

sh (PID: 5649, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 frgreu || busybox pkill -9 frgreu"

sh New Fork (PID: 5654, Parent: 5649)

pkill (PID: 5654, Parent: 5649, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 frgreu

sh New Fork (PID: 5655, Parent: 5649)

busybox (PID: 5655, Parent: 5649, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 frgreu

mqms.elf New Fork (PID: 5656, Parent: 5437)

sh (PID: 5656, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 telnetd || busybox pkill -9 telnetd"

sh New Fork (PID: 5658, Parent: 5656)

pkill (PID: 5658, Parent: 5656, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 telnetd

sh New Fork (PID: 5661, Parent: 5656)

busybox (PID: 5661, Parent: 5656, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 telnetd

mqms.elf New Fork (PID: 5662, Parent: 5437)

sh (PID: 5662, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 0x766f6964 || busybox pkill -9 0x766f6964"

sh New Fork (PID: 5664, Parent: 5662)

pkill (PID: 5664, Parent: 5662, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 0x766f6964

sh New Fork (PID: 5668, Parent: 5662)

busybox (PID: 5668, Parent: 5662, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 0x766f6964

mqms.elf New Fork (PID: 5669, Parent: 5437)

sh (PID: 5669, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeRd0nks1337 || busybox pkill -9 NiGGeRd0nks1337"

sh New Fork (PID: 5671, Parent: 5669)

pkill (PID: 5671, Parent: 5669, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeRd0nks1337

sh New Fork (PID: 5672, Parent: 5669)

busybox (PID: 5672, Parent: 5669, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeRd0nks1337

mqms.elf New Fork (PID: 5675, Parent: 5437)

sh (PID: 5675, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 gaft || busybox pkill -9 gaft"

sh New Fork (PID: 5677, Parent: 5675)

pkill (PID: 5677, Parent: 5675, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 gaft

sh New Fork (PID: 5678, Parent: 5675)

busybox (PID: 5678, Parent: 5675, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 gaft

mqms.elf New Fork (PID: 5679, Parent: 5437)

sh (PID: 5679, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 urasgbsigboa || busybox pkill -9 urasgbsigboa"

sh New Fork (PID: 5681, Parent: 5679)

pkill (PID: 5681, Parent: 5679, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 urasgbsigboa

sh New Fork (PID: 5684, Parent: 5679)

busybox (PID: 5684, Parent: 5679, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 urasgbsigboa

mqms.elf New Fork (PID: 5685, Parent: 5437)

sh (PID: 5685, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 120i3UI49 || busybox pkill -9 120i3UI49"

sh New Fork (PID: 5687, Parent: 5685)

pkill (PID: 5687, Parent: 5685, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 120i3UI49

sh New Fork (PID: 5688, Parent: 5685)

busybox (PID: 5688, Parent: 5685, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 120i3UI49

mqms.elf New Fork (PID: 5689, Parent: 5437)

sh (PID: 5689, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 OaF3 || busybox pkill -9 OaF3"

sh New Fork (PID: 5691, Parent: 5689)

pkill (PID: 5691, Parent: 5689, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 OaF3

sh New Fork (PID: 5694, Parent: 5689)

busybox (PID: 5694, Parent: 5689, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 OaF3

mqms.elf New Fork (PID: 5695, Parent: 5437)

sh (PID: 5695, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 geae || busybox pkill -9 geae"

sh New Fork (PID: 5697, Parent: 5695)

pkill (PID: 5697, Parent: 5695, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 geae

sh New Fork (PID: 5698, Parent: 5695)

busybox (PID: 5698, Parent: 5695, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 geae

mqms.elf New Fork (PID: 5701, Parent: 5437)

sh (PID: 5701, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 vaiolmao || busybox pkill -9 vaiolmao"

sh New Fork (PID: 5707, Parent: 5701)

pkill (PID: 5707, Parent: 5701, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 vaiolmao

sh New Fork (PID: 5708, Parent: 5701)

busybox (PID: 5708, Parent: 5701, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 vaiolmao

mqms.elf New Fork (PID: 5709, Parent: 5437)

sh (PID: 5709, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 123123a || busybox pkill -9 123123a"

sh New Fork (PID: 5711, Parent: 5709)

pkill (PID: 5711, Parent: 5709, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 123123a

sh New Fork (PID: 5714, Parent: 5709)

busybox (PID: 5714, Parent: 5709, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 123123a

mqms.elf New Fork (PID: 5716, Parent: 5437)

sh (PID: 5716, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 Ofurain0n4H34D || busybox pkill -9 Ofurain0n4H34D"

sh New Fork (PID: 5721, Parent: 5716)

pkill (PID: 5721, Parent: 5716, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 Ofurain0n4H34D

sh New Fork (PID: 5722, Parent: 5716)

busybox (PID: 5722, Parent: 5716, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 Ofurain0n4H34D

mqms.elf New Fork (PID: 5723, Parent: 5437)

sh (PID: 5723, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggTrex || busybox pkill -9 ggTrex"

sh New Fork (PID: 5730, Parent: 5723)

pkill (PID: 5730, Parent: 5723, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggTrex

sh New Fork (PID: 5734, Parent: 5723)

busybox (PID: 5734, Parent: 5723, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggTrex

mqms.elf New Fork (PID: 5735, Parent: 5437)

sh (PID: 5735, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 wasads || busybox pkill -9 wasads"

sh New Fork (PID: 5737, Parent: 5735)

pkill (PID: 5737, Parent: 5735, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 wasads

sh New Fork (PID: 5740, Parent: 5735)

busybox (PID: 5740, Parent: 5735, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 wasads

mqms.elf New Fork (PID: 5741, Parent: 5437)

sh (PID: 5741, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1293194hjXD || busybox pkill -9 1293194hjXD"

sh New Fork (PID: 5747, Parent: 5741)

pkill (PID: 5747, Parent: 5741, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1293194hjXD

sh New Fork (PID: 5748, Parent: 5741)

busybox (PID: 5748, Parent: 5741, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1293194hjXD

mqms.elf New Fork (PID: 5749, Parent: 5437)

sh (PID: 5749, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 OthLaLosn || busybox pkill -9 OthLaLosn"

sh New Fork (PID: 5751, Parent: 5749)

pkill (PID: 5751, Parent: 5749, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 OthLaLosn

sh New Fork (PID: 5754, Parent: 5749)

busybox (PID: 5754, Parent: 5749, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 OthLaLosn

mqms.elf New Fork (PID: 5755, Parent: 5437)

sh (PID: 5755, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggt || busybox pkill -9 ggt"

sh New Fork (PID: 5760, Parent: 5755)

pkill (PID: 5760, Parent: 5755, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggt

sh New Fork (PID: 5761, Parent: 5755)

busybox (PID: 5761, Parent: 5755, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggt

mqms.elf New Fork (PID: 5764, Parent: 5437)

sh (PID: 5764, Parent: 5437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 wget-log || busybox pkill -9 wget-log"

sh New Fork (PID: 5766, Parent: 5764)

pkill (PID: 5766, Parent: 5764, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 wget-log

sh New Fork (PID: 5767, Parent: 5764)

busybox (PID: 5767, Parent: 5764, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 wget-log

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
mqms.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
mqms.elf	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x1fced:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x203a1:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20

Memory Dumps

Source	Rule	Description	Author	Strings
5435.1.00007f7130400000.00007f7130423000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5435.1.00007f7130400000.00007f7130423000.r-x.sdmp	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x1fced:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x203a1:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
Process Memory Space: mqms.elf PID: 5435	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0xacea:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0xb338:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0xb981:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Bitcoin Miner
• Networking
• System Summary
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: mqms.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: mqms.elf

ReversingLabs: Detection: 61%

Source: /usr/bin/pkill (PID: 5449)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5453)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5459)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5469)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5479)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5486)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5492)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5499)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5509)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5529)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5535)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5542)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5551)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5555)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5559)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5565)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5573)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5581)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5591)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5598)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5611)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5615)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5621)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5627)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5631)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5641)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5645)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5654)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5658)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5664)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5671)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5677)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5681)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5687)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5691)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5697)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5707)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5711)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5721)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5730)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5737)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5747)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5751)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5760)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5766)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Networking

Uses IRC for communication with a C&C

Source: unknown

IRC traffic detected: 192.168.2.13:45490 -> 79.51.28.70:5060 NICK [OSX|MIPS]4YmC USER 4YmC localhost localhost :4YmC

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: IRC traffic on port 45490 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45492 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45492 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45492 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45494 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45496 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45498 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45500 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45502 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45504 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45506 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45508 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45510 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45512 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45514 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45516 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45518 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45518 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45520 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45522 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45524 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45524 -> 5060

Source: global traffic

TCP traffic: 192.168.2.13:45490 -> 79.51.28.70:5060

Source: global traffic

TCP traffic: 192.168.2.13:48202 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70
Source: unknown	TCP traffic detected without corresponding DNS query: 79.51.28.70

Source: mqms.elf	String found in binary or memory: http://piati.privatedns.org/mq.sh;
Source: mqms.elf	String found in binary or memory: https://youtu.be/dQw4w9WgXcQ
Source: mqms.elf	String found in binary or memory: https://youtu.be/dQw4w9WgXcQNever

Source: unknown

Network traffic detected: HTTP traffic on port 48202 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: mqms.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: 5435.1.00007f7130400000.00007f7130423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: Process Memory Space: mqms.elf PID: 5435, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown

Source: mqms.elf	ELF static info symbol of initial sample: passwords
Source: mqms.elf	ELF static info symbol of initial sample: usernames

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: pkill -9 %s \|\| busybox pkill -9 %s
Source: Initial sample	String containing 'busybox' found: pkill -9 %s \|\| busybox pkill -9 %shistory -c;history -wcd /root;rm -f .bash_historycd /var/tmp; rm -f *NOTICE %s :MOVE <server>

Source: Initial sample	String containing potential weak password found: admin
Source: Initial sample	String containing potential weak password found: default
Source: Initial sample	String containing potential weak password found: support
Source: Initial sample	String containing potential weak password found: guest
Source: Initial sample	String containing potential weak password found: supervisor
Source: Initial sample	String containing potential weak password found: service
Source: Initial sample	String containing potential weak password found: 12345
Source: Initial sample	String containing potential weak password found: 123456
Source: Initial sample	String containing potential weak password found: password
Source: Initial sample	String containing potential weak password found: admin1234

Source: mqms.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: 5435.1.00007f7130400000.00007f7130423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: Process Memory Space: mqms.elf PID: 5435, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16

Source: classification engine

Classification label: mal80.troj.linELF@0/0@0/0

Source: mqms.elf	ELF static info symbol of initial sample: libc/string/mips/memcpy.S
Source: mqms.elf	ELF static info symbol of initial sample: libc/string/mips/memset.S
Source: mqms.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/mips/crt1.S
Source: mqms.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/mips/crti.S
Source: mqms.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/mips/crtn.S
Source: mqms.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/mips/pipe.S

Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/230/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/230/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/5381/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/5381/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/110/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/110/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/231/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/231/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/111/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/111/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/232/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/232/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/112/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/112/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/233/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/233/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/113/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/113/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/234/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/234/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/114/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/114/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/235/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/235/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/115/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/115/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/236/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/236/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/116/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/116/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/237/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/237/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/117/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/117/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/238/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/238/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/118/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/118/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/239/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/239/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/119/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/119/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/914/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/914/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/10/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/10/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/917/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/917/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/11/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/11/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/12/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/12/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/13/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/13/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/14/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/14/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/15/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/15/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/5276/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/5276/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/16/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/16/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/17/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/17/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/18/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/18/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/19/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/19/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/240/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/240/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/3095/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/3095/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/120/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/120/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/241/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/241/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/121/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/121/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/242/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/242/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/1/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/1/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/122/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/122/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/243/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/243/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/2/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/2/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/123/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/123/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/244/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/244/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/3/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/3/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/124/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/124/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/245/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/245/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/1588/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/1588/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/125/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/125/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/4/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/4/cmdline
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/246/status
Source: /usr/bin/pkill (PID: 5581)	File opened: /proc/246/cmdline

Source: /tmp/mqms.elf (PID: 5446)	Shell command executed: sh -c "pkill -9 902i13 \|\| busybox pkill -9 902i13"	Jump to behavior
Source: /tmp/mqms.elf (PID: 5451)	Shell command executed: sh -c "pkill -9 BzSxLxBxeY \|\| busybox pkill -9 BzSxLxBxeY"	Jump to behavior
Source: /tmp/mqms.elf (PID: 5457)	Shell command executed: sh -c "pkill -9 HOHO-LUGO7 \|\| busybox pkill -9 HOHO-LUGO7"	Jump to behavior
Source: /tmp/mqms.elf (PID: 5467)	Shell command executed: sh -c "pkill -9 HOHO-U79OL \|\| busybox pkill -9 HOHO-U79OL"	Jump to behavior
Source: /tmp/mqms.elf (PID: 5473)	Shell command executed: sh -c "pkill -9 JuYfouyf87 \|\| busybox pkill -9 JuYfouyf87"	Jump to behavior
Source: /tmp/mqms.elf (PID: 5481)	Shell command executed: sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"	Jump to behavior
Source: /tmp/mqms.elf (PID: 5490)	Shell command executed: sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"	Jump to behavior
Source: /tmp/mqms.elf (PID: 5494)	Shell command executed: sh -c "pkill -9 LOLKIKEEEDDE \|\| busybox pkill -9 LOLKIKEEEDDE"	Jump to behavior
Source: /tmp/mqms.elf (PID: 5503)	Shell command executed: sh -c "pkill -9 ekjheory98e \|\| busybox pkill -9 ekjheory98e"	Jump to behavior
Source: /tmp/mqms.elf (PID: 5527)	Shell command executed: sh -c "pkill -9 scansh4 \|\| busybox pkill -9 scansh4"	Jump to behavior
Source: /tmp/mqms.elf (PID: 5533)	Shell command executed: sh -c "pkill -9 MDMA \|\| busybox pkill -9 MDMA"	Jump to behavior
Source: /tmp/mqms.elf (PID: 5537)	Shell command executed: sh -c "pkill -9 fdevalvex \|\| busybox pkill -9 fdevalvex"	Jump to behavior
Source: /tmp/mqms.elf (PID: 5546)	Shell command executed: sh -c "pkill -9 scanspc \|\| busybox pkill -9 scanspc"	Jump to behavior
Source: /tmp/mqms.elf (PID: 5553)	Shell command executed: sh -c "pkill -9 MELTEDNINJAREALZ \|\| busybox pkill -9 MELTEDNINJAREALZ"	Jump to behavior
Source: /tmp/mqms.elf (PID: 5557)	Shell command executed: sh -c "pkill -9 flexsonskids \|\| busybox pkill -9 flexsonskids"	Jump to behavior
Source: /tmp/mqms.elf (PID: 5563)	Shell command executed: sh -c "pkill -9 scanx86 \|\| busybox pkill -9 scanx86"
Source: /tmp/mqms.elf (PID: 5567)	Shell command executed: sh -c "pkill -9 MISAKI-U79OL \|\| busybox pkill -9 MISAKI-U79OL"
Source: /tmp/mqms.elf (PID: 5577)	Shell command executed: sh -c "pkill -9 foAxi102kxe \|\| busybox pkill -9 foAxi102kxe"
Source: /tmp/mqms.elf (PID: 5586)	Shell command executed: sh -c "pkill -9 swodjwodjwoj \|\| busybox pkill -9 swodjwodjwoj"
Source: /tmp/mqms.elf (PID: 5593)	Shell command executed: sh -c "pkill -9 MmKiy7f87l \|\| busybox pkill -9 MmKiy7f87l"
Source: /tmp/mqms.elf (PID: 5605)	Shell command executed: sh -c "pkill -9 freecookiex86 \|\| busybox pkill -9 freecookiex86"
Source: /tmp/mqms.elf (PID: 5613)	Shell command executed: sh -c "pkill -9 sysgpu \|\| busybox pkill -9 sysgpu"
Source: /tmp/mqms.elf (PID: 5619)	Shell command executed: sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
Source: /tmp/mqms.elf (PID: 5625)	Shell command executed: sh -c "pkill -9 frgege \|\| busybox pkill -9 frgege"
Source: /tmp/mqms.elf (PID: 5629)	Shell command executed: sh -c "pkill -9 sysupdater \|\| busybox pkill -9 sysupdater"
Source: /tmp/mqms.elf (PID: 5635)	Shell command executed: sh -c "pkill -9 0DnAzepd \|\| busybox pkill -9 0DnAzepd"
Source: /tmp/mqms.elf (PID: 5643)	Shell command executed: sh -c "pkill -9 NiGGeRD0nks69 \|\| busybox pkill -9 NiGGeRD0nks69"
Source: /tmp/mqms.elf (PID: 5649)	Shell command executed: sh -c "pkill -9 frgreu \|\| busybox pkill -9 frgreu"
Source: /tmp/mqms.elf (PID: 5656)	Shell command executed: sh -c "pkill -9 telnetd \|\| busybox pkill -9 telnetd"
Source: /tmp/mqms.elf (PID: 5662)	Shell command executed: sh -c "pkill -9 0x766f6964 \|\| busybox pkill -9 0x766f6964"
Source: /tmp/mqms.elf (PID: 5669)	Shell command executed: sh -c "pkill -9 NiGGeRd0nks1337 \|\| busybox pkill -9 NiGGeRd0nks1337"
Source: /tmp/mqms.elf (PID: 5675)	Shell command executed: sh -c "pkill -9 gaft \|\| busybox pkill -9 gaft"
Source: /tmp/mqms.elf (PID: 5679)	Shell command executed: sh -c "pkill -9 urasgbsigboa \|\| busybox pkill -9 urasgbsigboa"
Source: /tmp/mqms.elf (PID: 5685)	Shell command executed: sh -c "pkill -9 120i3UI49 \|\| busybox pkill -9 120i3UI49"
Source: /tmp/mqms.elf (PID: 5689)	Shell command executed: sh -c "pkill -9 OaF3 \|\| busybox pkill -9 OaF3"
Source: /tmp/mqms.elf (PID: 5695)	Shell command executed: sh -c "pkill -9 geae \|\| busybox pkill -9 geae"
Source: /tmp/mqms.elf (PID: 5701)	Shell command executed: sh -c "pkill -9 vaiolmao \|\| busybox pkill -9 vaiolmao"
Source: /tmp/mqms.elf (PID: 5709)	Shell command executed: sh -c "pkill -9 123123a \|\| busybox pkill -9 123123a"
Source: /tmp/mqms.elf (PID: 5716)	Shell command executed: sh -c "pkill -9 Ofurain0n4H34D \|\| busybox pkill -9 Ofurain0n4H34D"
Source: /tmp/mqms.elf (PID: 5723)	Shell command executed: sh -c "pkill -9 ggTrex \|\| busybox pkill -9 ggTrex"
Source: /tmp/mqms.elf (PID: 5735)	Shell command executed: sh -c "pkill -9 wasads \|\| busybox pkill -9 wasads"
Source: /tmp/mqms.elf (PID: 5741)	Shell command executed: sh -c "pkill -9 1293194hjXD \|\| busybox pkill -9 1293194hjXD"
Source: /tmp/mqms.elf (PID: 5749)	Shell command executed: sh -c "pkill -9 OthLaLosn \|\| busybox pkill -9 OthLaLosn"
Source: /tmp/mqms.elf (PID: 5755)	Shell command executed: sh -c "pkill -9 ggt \|\| busybox pkill -9 ggt"
Source: /tmp/mqms.elf (PID: 5764)	Shell command executed: sh -c "pkill -9 wget-log \|\| busybox pkill -9 wget-log"

Source: /bin/sh (PID: 5449)	Pkill executable: /usr/bin/pkill -> pkill -9 902i13	Jump to behavior
Source: /bin/sh (PID: 5453)	Pkill executable: /usr/bin/pkill -> pkill -9 BzSxLxBxeY	Jump to behavior
Source: /bin/sh (PID: 5459)	Pkill executable: /usr/bin/pkill -> pkill -9 HOHO-LUGO7	Jump to behavior
Source: /bin/sh (PID: 5469)	Pkill executable: /usr/bin/pkill -> pkill -9 HOHO-U79OL	Jump to behavior
Source: /bin/sh (PID: 5479)	Pkill executable: /usr/bin/pkill -> pkill -9 JuYfouyf87	Jump to behavior
Source: /bin/sh (PID: 5486)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeR69xd	Jump to behavior
Source: /bin/sh (PID: 5492)	Pkill executable: /usr/bin/pkill -> pkill -9 SO190Ij1X	Jump to behavior
Source: /bin/sh (PID: 5499)	Pkill executable: /usr/bin/pkill -> pkill -9 LOLKIKEEEDDE	Jump to behavior
Source: /bin/sh (PID: 5509)	Pkill executable: /usr/bin/pkill -> pkill -9 ekjheory98e	Jump to behavior
Source: /bin/sh (PID: 5529)	Pkill executable: /usr/bin/pkill -> pkill -9 scansh4	Jump to behavior
Source: /bin/sh (PID: 5535)	Pkill executable: /usr/bin/pkill -> pkill -9 MDMA	Jump to behavior
Source: /bin/sh (PID: 5542)	Pkill executable: /usr/bin/pkill -> pkill -9 fdevalvex	Jump to behavior
Source: /bin/sh (PID: 5551)	Pkill executable: /usr/bin/pkill -> pkill -9 scanspc	Jump to behavior
Source: /bin/sh (PID: 5555)	Pkill executable: /usr/bin/pkill -> pkill -9 MELTEDNINJAREALZ	Jump to behavior
Source: /bin/sh (PID: 5559)	Pkill executable: /usr/bin/pkill -> pkill -9 flexsonskids	Jump to behavior
Source: /bin/sh (PID: 5565)	Pkill executable: /usr/bin/pkill -> pkill -9 scanx86
Source: /bin/sh (PID: 5573)	Pkill executable: /usr/bin/pkill -> pkill -9 MISAKI-U79OL
Source: /bin/sh (PID: 5581)	Pkill executable: /usr/bin/pkill -> pkill -9 foAxi102kxe
Source: /bin/sh (PID: 5591)	Pkill executable: /usr/bin/pkill -> pkill -9 swodjwodjwoj
Source: /bin/sh (PID: 5598)	Pkill executable: /usr/bin/pkill -> pkill -9 MmKiy7f87l
Source: /bin/sh (PID: 5611)	Pkill executable: /usr/bin/pkill -> pkill -9 freecookiex86
Source: /bin/sh (PID: 5615)	Pkill executable: /usr/bin/pkill -> pkill -9 sysgpu
Source: /bin/sh (PID: 5621)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeR69xd
Source: /bin/sh (PID: 5627)	Pkill executable: /usr/bin/pkill -> pkill -9 frgege
Source: /bin/sh (PID: 5631)	Pkill executable: /usr/bin/pkill -> pkill -9 sysupdater
Source: /bin/sh (PID: 5641)	Pkill executable: /usr/bin/pkill -> pkill -9 0DnAzepd
Source: /bin/sh (PID: 5645)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeRD0nks69
Source: /bin/sh (PID: 5654)	Pkill executable: /usr/bin/pkill -> pkill -9 frgreu
Source: /bin/sh (PID: 5658)	Pkill executable: /usr/bin/pkill -> pkill -9 telnetd
Source: /bin/sh (PID: 5664)	Pkill executable: /usr/bin/pkill -> pkill -9 0x766f6964
Source: /bin/sh (PID: 5671)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeRd0nks1337
Source: /bin/sh (PID: 5677)	Pkill executable: /usr/bin/pkill -> pkill -9 gaft
Source: /bin/sh (PID: 5681)	Pkill executable: /usr/bin/pkill -> pkill -9 urasgbsigboa
Source: /bin/sh (PID: 5687)	Pkill executable: /usr/bin/pkill -> pkill -9 120i3UI49
Source: /bin/sh (PID: 5691)	Pkill executable: /usr/bin/pkill -> pkill -9 OaF3
Source: /bin/sh (PID: 5697)	Pkill executable: /usr/bin/pkill -> pkill -9 geae
Source: /bin/sh (PID: 5707)	Pkill executable: /usr/bin/pkill -> pkill -9 vaiolmao
Source: /bin/sh (PID: 5711)	Pkill executable: /usr/bin/pkill -> pkill -9 123123a
Source: /bin/sh (PID: 5721)	Pkill executable: /usr/bin/pkill -> pkill -9 Ofurain0n4H34D
Source: /bin/sh (PID: 5730)	Pkill executable: /usr/bin/pkill -> pkill -9 ggTrex
Source: /bin/sh (PID: 5737)	Pkill executable: /usr/bin/pkill -> pkill -9 wasads
Source: /bin/sh (PID: 5747)	Pkill executable: /usr/bin/pkill -> pkill -9 1293194hjXD
Source: /bin/sh (PID: 5751)	Pkill executable: /usr/bin/pkill -> pkill -9 OthLaLosn
Source: /bin/sh (PID: 5760)	Pkill executable: /usr/bin/pkill -> pkill -9 ggt
Source: /bin/sh (PID: 5766)	Pkill executable: /usr/bin/pkill -> pkill -9 wget-log

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: IRC traffic on port 45490 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45492 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45492 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45492 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45494 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45496 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45498 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45500 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45502 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45504 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45506 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45508 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45510 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45512 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45514 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45516 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45518 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45518 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45520 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45522 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45524 -> 5060
Source: unknown	Network traffic detected: IRC traffic on port 45524 -> 5060

Source: /usr/bin/pkill (PID: 5449)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5453)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5459)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5469)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5479)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5486)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5492)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5499)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5509)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5529)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5535)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5542)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5551)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5555)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5559)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5565)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5573)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5581)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5591)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5598)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5611)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5615)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5621)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5627)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5631)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5641)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5645)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5654)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5658)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5664)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5671)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5677)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5681)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5687)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5691)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5697)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5707)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5711)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5721)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5730)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5737)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5747)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5751)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5760)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5766)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/mqms.elf (PID: 5435)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5450)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5456)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5466)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5470)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5480)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5487)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5493)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5500)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5526)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5530)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5536)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5543)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5552)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5556)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5562)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5566)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5576)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5583)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5592)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5601)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5612)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5618)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5624)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5628)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5634)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5642)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5648)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5655)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5661)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5668)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5672)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5678)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5684)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5688)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5694)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5698)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5708)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5714)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5722)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5734)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5740)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5748)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5754)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5761)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5767)	Queries kernel information via 'uname':

Source: mqms.elf, 5435.1.00005577ce67d000.00005577ce704000.rw-.sdmp	Binary or memory string: wU!/etc/qemu-binfmt/mips
Source: mqms.elf, 5435.1.00005577ce67d000.00005577ce704000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: mqms.elf, 5435.1.00007ffec1c1e000.00007ffec1c3f000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips
Source: mqms.elf, 5435.1.00007ffec1c1e000.00007ffec1c3f000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/mqms.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mqms.elf

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: mqms.elf, type: SAMPLE
Source: Yara match	File source: 5435.1.00007f7130400000.00007f7130423000.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U;) Presto/2.7.62 Version/11.01
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; U; de; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.62
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0) Gecko/20110517 Firefox/5.0 Fennec/5.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (compatible; Teleca Q7; Brew 3.1.5; U; en) 480X800 LGE VX11000

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: mqms.elf, type: SAMPLE
Source: Yara match	File source: 5435.1.00007f7130400000.00007f7130423000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	1 Brute Force	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
mqms.elf	61%	ReversingLabs	Linux.Trojan.Tsunami
mqms.elf	100%	Avira	EXP/ELF.Agent.J.8

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://youtu.be/dQw4w9WgXcQ	mqms.elf	false	high
http://piati.privatedns.org/mq.sh;	mqms.elf	false	high
https://youtu.be/dQw4w9WgXcQNever	mqms.elf	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.125.190.26	unknown	United Kingdom		41231	CANONICAL-ASGB	false
79.51.28.70	unknown	Italy		3269	ASN-IBSNAZIT	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.125.190.26	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse
	Space.x86_64.elf	Get hash	malicious	Unknown	Browse
	Space.arm5.elf	Get hash	malicious	Unknown	Browse
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse
	mssl.elf	Get hash	malicious	Unknown	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	x86.elf	Get hash	malicious	Unknown	Browse
	arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
79.51.28.70	mqar5.elf	Get hash	malicious	Mirai	Browse
	mqar4.elf	Get hash	malicious	Mirai	Browse
	mqm68k.elf	Get hash	malicious	Mirai	Browse
	mqsh.elf	Get hash	malicious	Mirai	Browse
	mqar6.elf	Get hash	malicious	Mirai	Browse
	mqi586.elf	Get hash	malicious	Mirai	Browse
	mqms.elf	Get hash	malicious	Mirai	Browse
	mqar7.elf	Get hash	malicious	Mirai	Browse
	mqar5.elf	Get hash	malicious	Mirai	Browse
	mqar4.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	mqar4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	mqsh.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	mqi586.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	i386.elf	Get hash	malicious	IPRoyal Pawns	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
ASN-IBSNAZIT	mqar5.elf	Get hash	malicious	Mirai	Browse	79.51.28.70
	mqar4.elf	Get hash	malicious	Mirai	Browse	79.51.28.70
	mqm68k.elf	Get hash	malicious	Mirai	Browse	79.51.28.70
	mqsh.elf	Get hash	malicious	Mirai	Browse	79.51.28.70
	mqar6.elf	Get hash	malicious	Mirai	Browse	79.51.28.70
	mqi586.elf	Get hash	malicious	Mirai	Browse	79.51.28.70
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	87.28.215.122
	250428-e5d9yatq17.bin.exe	Get hash	malicious	Unknown	Browse	79.46.186.147
	hoho.arm.elf	Get hash	malicious	Unknown	Browse	85.40.82.0
	hoho.m68k.elf	Get hash	malicious	Unknown	Browse	79.56.176.139

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	5.379060794385342
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	mqms.elf
File size:	188'016 bytes
MD5:	f34e08709d5e2f1705f844af3fcf138d
SHA1:	8e5b93eb91e5b5d32696526f295dcdd10194955a
SHA256:	f0502450289ff1ce8a4af7f5c23b195215c11eb3d6bbe74ea346c9566e3f74ed
SHA512:	bd89232dde4b0918ce144d5b9fcf73246c96ff0a137393fb88f1118cc7b1dbb2cc1915ee8cda8dec49e8d2f29cb283d5d407927a15026d6e48b8e7fbe3f61176
SSDEEP:	3072:eq2sVtDOhAdMiwp7ndg+P8DQo4XxBquuvGFHgSLER9JteI:uOtDOeu5xa+0W1uvGFHgSLEXJteI
TLSH:	CD04952A7E21BFBEE26886310BF35F70839921D326E18742E27CDA585F7128D185F754
File Content Preview:	.ELF.....................@.....4..yl.....4. ...(....p........@...@...........................@...@....-...-...............0..F0..F0.................dt.Q.................................................F..<...'..D...!'.......................<...'.. ...!...

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4002a0
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	4
Section Header Offset:	162156
Section Header Size:	40
Number of Section Headers:	21
Header String Table Index:	18

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.reginfo	MIPS_REGINFO	0x4000b4	0xb4	0x18	0x18	0x2	A	0	0	4
.init	PROGBITS	0x4000cc	0xcc	0x8c	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x400160	0x160	0x1d580	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x41d6e0	0x1d6e0	0x5c	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x41d740	0x1d740	0x566c	0x0	0x2	A	0	0	16
.eh_frame	PROGBITS	0x422dac	0x22dac	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x463000	0x23000	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x463008	0x23008	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x463010	0x23010	0x4	0x0	0x3	WA	0	0	4
.data.rel.ro	PROGBITS	0x463014	0x23014	0x15c	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x463170	0x23170	0xcb0	0x0	0x3	WA	0	0	16
.got	PROGBITS	0x463e20	0x23e20	0x664	0x4	0x10000003	WAp	0	0	16
.sbss	NOBITS	0x464484	0x24484	0x50	0x0	0x10000003	WAp	0	0	4
.bss	NOBITS	0x4644e0	0x24484	0x77f4	0x0	0x3	WA	0	0	16
.comment	PROGBITS	0x0	0x24484	0xd4a	0x0	0x0		0	0	1
.mdebug.abi32	PROGBITS	0xd4a	0x251ce	0x0	0x0	0x0		0	0	1
.pdr	PROGBITS	0x0	0x251d0	0x2700	0x0	0x0		0	0	4
.shstrtab	STRTAB	0x0	0x278d0	0x9a	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x27cb4	0x3880	0x10	0x0		20	346	4
.strtab	STRTAB	0x0	0x2b534	0x293c	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
<unknown>	0xb4	0x4000b4	0x4000b4	0x18	0x18	0.9834	0x4	R	0x4	.reginfo
LOAD	0x0	0x400000	0x400000	0x22db0	0x22db0	5.3721	0x5	R E	0x10000	.reginfo .init .text .fini .rodata .eh_frame
LOAD	0x23000	0x463000	0x463000	0x1484	0x8cd4	4.5544	0x6	RW	0x10000	.ctors .dtors .jcr .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x4000b4	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x4000cc	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x400160	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x41d6e0	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x41d740	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x422dac	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x463000	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x463008	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x463010	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x463014	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x463170	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x463e20	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x464484	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x4644e0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0xd4a	0	SECTION	<unknown>	DEFAULT	16
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	17
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	18
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	19
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	20
C.72.5487	.symtab	0x41f48c	36	OBJECT	<unknown>	DEFAULT	5
C.90.5707	.symtab	0x463014	312	OBJECT	<unknown>	DEFAULT	10
C.97.5805	.symtab	0x46314c	12	OBJECT	<unknown>	DEFAULT	10
ClearHistory	.symtab	0x40a7f8	160	FUNC	<unknown>	DEFAULT	3
HTTP	.symtab	0x40411c	608	FUNC	<unknown>	DEFAULT	3
Q	.symtab	0x46491c	16384	OBJECT	<unknown>	DEFAULT	14
Send	.symtab	0x4006f8	204	FUNC	<unknown>	DEFAULT	3
UserAgents	.symtab	0x4634d8	144	OBJECT	<unknown>	DEFAULT	11
_352	.symtab	0x40cf7c	44	FUNC	<unknown>	DEFAULT	3
_376	.symtab	0x40cde8	296	FUNC	<unknown>	DEFAULT	3
_433	.symtab	0x40cfa8	176	FUNC	<unknown>	DEFAULT	3
_GLOBAL_OFFSET_TABLE_	.symtab	0x463e20	0	OBJECT	<unknown>	DEFAULT	12
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_NICK	.symtab	0x40d058	432	FUNC	<unknown>	DEFAULT	3
_PING	.symtab	0x40cf10	108	FUNC	<unknown>	DEFAULT	3
_PRIVMSG	.symtab	0x40bb8c	4700	FUNC	<unknown>	DEFAULT	3
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x463004	0	OBJECT	<unknown>	DEFAULT	7
__CTOR_LIST__	.symtab	0x463000	0	OBJECT	<unknown>	DEFAULT	7
__C_ctype_b	.symtab	0x463d90	4	OBJECT	<unknown>	DEFAULT	11
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x422660	768	OBJECT	<unknown>	DEFAULT	5
__C_ctype_tolower	.symtab	0x463da0	4	OBJECT	<unknown>	DEFAULT	11
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x422960	768	OBJECT	<unknown>	DEFAULT	5
__C_ctype_toupper	.symtab	0x463a20	4	OBJECT	<unknown>	DEFAULT	11
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x4212f0	768	OBJECT	<unknown>	DEFAULT	5
__DTOR_END__	.symtab	0x46300c	0	OBJECT	<unknown>	DEFAULT	8
__DTOR_LIST__	.symtab	0x463008	0	OBJECT	<unknown>	DEFAULT	8
__EH_FRAME_BEGIN__	.symtab	0x422dac	0	OBJECT	<unknown>	DEFAULT	6
__FRAME_END__	.symtab	0x422dac	0	OBJECT	<unknown>	DEFAULT	6
__GI___C_ctype_b	.symtab	0x463d90	4	OBJECT	<unknown>	HIDDEN	11
__GI___C_ctype_b_data	.symtab	0x422660	768	OBJECT	<unknown>	HIDDEN	5
__GI___C_ctype_tolower	.symtab	0x463da0	4	OBJECT	<unknown>	HIDDEN	11
__GI___C_ctype_tolower_data	.symtab	0x422960	768	OBJECT	<unknown>	HIDDEN	5
__GI___C_ctype_toupper	.symtab	0x463a20	4	OBJECT	<unknown>	HIDDEN	11
__GI___C_ctype_toupper_data	.symtab	0x4212f0	768	OBJECT	<unknown>	HIDDEN	5
__GI___ctype_b	.symtab	0x463d94	4	OBJECT	<unknown>	HIDDEN	11
__GI___ctype_tolower	.symtab	0x463da4	4	OBJECT	<unknown>	HIDDEN	11
__GI___ctype_toupper	.symtab	0x463a24	4	OBJECT	<unknown>	HIDDEN	11
__GI___errno_location	.symtab	0x40f260	24	FUNC	<unknown>	HIDDEN	3
__GI___fgetc_unlocked	.symtab	0x418ff0	388	FUNC	<unknown>	HIDDEN	3
__GI___fputc_unlocked	.symtab	0x411f40	372	FUNC	<unknown>	HIDDEN	3
__GI___glibc_strerror_r	.symtab	0x412820	68	FUNC	<unknown>	HIDDEN	3
__GI___h_errno_location	.symtab	0x417ee0	24	FUNC	<unknown>	HIDDEN	3
__GI___libc_fcntl	.symtab	0x40e9a0	136	FUNC	<unknown>	HIDDEN	3
__GI___libc_fcntl64	.symtab	0x40ea30	104	FUNC	<unknown>	HIDDEN	3
__GI___libc_open	.symtab	0x417c70	124	FUNC	<unknown>	HIDDEN	3
__GI___uClibc_fini	.symtab	0x417240	196	FUNC	<unknown>	HIDDEN	3
__GI___uClibc_init	.symtab	0x41739c	140	FUNC	<unknown>	HIDDEN	3
__GI___xpg_strerror_r	.symtab	0x412870	392	FUNC	<unknown>	HIDDEN	3
__GI__exit	.symtab	0x417920	80	FUNC	<unknown>	HIDDEN	3
__GI_abort	.symtab	0x41bfe0	428	FUNC	<unknown>	HIDDEN	3
__GI_accept	.symtab	0x4152b0	84	FUNC	<unknown>	HIDDEN	3
__GI_asprintf	.symtab	0x40f680	72	FUNC	<unknown>	HIDDEN	3
__GI_atoi	.symtab	0x416950	28	FUNC	<unknown>	HIDDEN	3
__GI_atol	.symtab	0x416950	28	FUNC	<unknown>	HIDDEN	3
__GI_bind	.symtab	0x415310	84	FUNC	<unknown>	HIDDEN	3
__GI_brk	.symtab	0x41c1c0	112	FUNC	<unknown>	HIDDEN	3
__GI_chdir	.symtab	0x40eaa0	88	FUNC	<unknown>	HIDDEN	3
__GI_clock_getres	.symtab	0x417970	84	FUNC	<unknown>	HIDDEN	3
__GI_close	.symtab	0x40eb00	84	FUNC	<unknown>	HIDDEN	3
__GI_connect	.symtab	0x415370	84	FUNC	<unknown>	HIDDEN	3
__GI_dup2	.symtab	0x4179d0	84	FUNC	<unknown>	HIDDEN	3
__GI_endservent	.symtab	0x419cec	176	FUNC	<unknown>	HIDDEN	3
__GI_errno	.symtab	0x46a9b0	4	OBJECT	<unknown>	HIDDEN	14
__GI_execl	.symtab	0x416cf0	204	FUNC	<unknown>	HIDDEN	3
__GI_execve	.symtab	0x417a30	84	FUNC	<unknown>	HIDDEN	3
__GI_exit	.symtab	0x416c00	236	FUNC	<unknown>	HIDDEN	3
__GI_fclose	.symtab	0x40f280	512	FUNC	<unknown>	HIDDEN	3
__GI_fcntl	.symtab	0x40e9a0	136	FUNC	<unknown>	HIDDEN	3
__GI_fcntl64	.symtab	0x40ea30	104	FUNC	<unknown>	HIDDEN	3
__GI_fdopen	.symtab	0x4180a0	128	FUNC	<unknown>	HIDDEN	3
__GI_fflush_unlocked	.symtab	0x411bb0	628	FUNC	<unknown>	HIDDEN	3
__GI_fgetc_unlocked	.symtab	0x418ff0	388	FUNC	<unknown>	HIDDEN	3
__GI_fgets	.symtab	0x411750	216	FUNC	<unknown>	HIDDEN	3
__GI_fgets_unlocked	.symtab	0x411e30	268	FUNC	<unknown>	HIDDEN	3
__GI_fopen	.symtab	0x40f480	28	FUNC	<unknown>	HIDDEN	3
__GI_fork	.symtab	0x40eb60	84	FUNC	<unknown>	HIDDEN	3
__GI_fprintf	.symtab	0x40f630	72	FUNC	<unknown>	HIDDEN	3
__GI_fputc	.symtab	0x411830	276	FUNC	<unknown>	HIDDEN	3
__GI_fputs	.symtab	0x411950	200	FUNC	<unknown>	HIDDEN	3
__GI_fputs_unlocked	.symtab	0x4120c0	128	FUNC	<unknown>	HIDDEN	3
__GI_freeaddrinfo	.symtab	0x413bc8	84	FUNC	<unknown>	HIDDEN	3
__GI_fseek	.symtab	0x41c280	68	FUNC	<unknown>	HIDDEN	3
__GI_fseeko64	.symtab	0x41c390	388	FUNC	<unknown>	HIDDEN	3
__GI_fwrite_unlocked	.symtab	0x412140	280	FUNC	<unknown>	HIDDEN	3
__GI_getaddrinfo	.symtab	0x413c1c	1020	FUNC	<unknown>	HIDDEN	3
__GI_getc_unlocked	.symtab	0x418ff0	388	FUNC	<unknown>	HIDDEN	3
__GI_getcwd	.symtab	0x40ebc0	364	FUNC	<unknown>	HIDDEN	3
__GI_getdtablesize	.symtab	0x40ed30	72	FUNC	<unknown>	HIDDEN	3
__GI_getegid	.symtab	0x417a90	88	FUNC	<unknown>	HIDDEN	3
__GI_geteuid	.symtab	0x417af0	88	FUNC	<unknown>	HIDDEN	3
__GI_getgid	.symtab	0x417b50	84	FUNC	<unknown>	HIDDEN	3
__GI_gethostbyaddr_r	.symtab	0x414e20	1160	FUNC	<unknown>	HIDDEN	3
__GI_gethostbyname2_r	.symtab	0x414a30	1004	FUNC	<unknown>	HIDDEN	3
__GI_gethostbyname_r	.symtab	0x41b990	1108	FUNC	<unknown>	HIDDEN	3
__GI_getpagesize	.symtab	0x40ed80	48	FUNC	<unknown>	HIDDEN	3
__GI_getpid	.symtab	0x40edb0	84	FUNC	<unknown>	HIDDEN	3
__GI_getrlimit	.symtab	0x40ee70	84	FUNC	<unknown>	HIDDEN	3
__GI_getservbyname_r	.symtab	0x41a088	464	FUNC	<unknown>	HIDDEN	3
__GI_getservbyport	.symtab	0x41a004	132	FUNC	<unknown>	HIDDEN	3
__GI_getservbyport_r	.symtab	0x419e84	384	FUNC	<unknown>	HIDDEN	3
__GI_getservent_r	.symtab	0x4199a0	740	FUNC	<unknown>	HIDDEN	3
__GI_getuid	.symtab	0x417bb0	84	FUNC	<unknown>	HIDDEN	3
__GI_h_errno	.symtab	0x46a9b4	4	OBJECT	<unknown>	HIDDEN	14
__GI_if_freenameindex	.symtab	0x41a778	112	FUNC	<unknown>	HIDDEN	3
__GI_if_nameindex	.symtab	0x41a4f8	640	FUNC	<unknown>	HIDDEN	3
__GI_if_nametoindex	.symtab	0x41a3ec	268	FUNC	<unknown>	HIDDEN	3
__GI_in6addr_loopback	.symtab	0x422380	16	OBJECT	<unknown>	HIDDEN	5
__GI_inet_addr	.symtab	0x4149e0	72	FUNC	<unknown>	HIDDEN	3
__GI_inet_aton	.symtab	0x41a7f0	244	FUNC	<unknown>	HIDDEN	3
__GI_inet_ntoa	.symtab	0x4149bc	32	FUNC	<unknown>	HIDDEN	3
__GI_inet_ntoa_r	.symtab	0x414920	156	FUNC	<unknown>	HIDDEN	3
__GI_inet_ntop	.symtab	0x4145c0	852	FUNC	<unknown>	HIDDEN	3
__GI_inet_pton	.symtab	0x414110	700	FUNC	<unknown>	HIDDEN	3
__GI_initstate_r	.symtab	0x4165c0	328	FUNC	<unknown>	HIDDEN	3
__GI_ioctl	.symtab	0x40eed0	104	FUNC	<unknown>	HIDDEN	3
__GI_isatty	.symtab	0x412be0	60	FUNC	<unknown>	HIDDEN	3
__GI_kill	.symtab	0x40ef40	88	FUNC	<unknown>	HIDDEN	3
__GI_listen	.symtab	0x415450	84	FUNC	<unknown>	HIDDEN	3
__GI_lseek64	.symtab	0x41d3f0	168	FUNC	<unknown>	HIDDEN	3
__GI_memchr	.symtab	0x419180	264	FUNC	<unknown>	HIDDEN	3
__GI_memcpy	.symtab	0x412260	308	FUNC	<unknown>	HIDDEN	3
__GI_memmove	.symtab	0x419290	816	FUNC	<unknown>	HIDDEN	3
__GI_mempcpy	.symtab	0x4195c0	76	FUNC	<unknown>	HIDDEN	3
__GI_memrchr	.symtab	0x419610	272	FUNC	<unknown>	HIDDEN	3
__GI_memset	.symtab	0x4123a0	144	FUNC	<unknown>	HIDDEN	3
__GI_nanosleep	.symtab	0x417c10	84	FUNC	<unknown>	HIDDEN	3
__GI_open	.symtab	0x417c70	124	FUNC	<unknown>	HIDDEN	3
__GI_perror	.symtab	0x40f4a0	84	FUNC	<unknown>	HIDDEN	3
__GI_pipe	.symtab	0x417880	64	FUNC	<unknown>	HIDDEN	3
__GI_poll	.symtab	0x40efa0	84	FUNC	<unknown>	HIDDEN	3
__GI_putc	.symtab	0x411830	276	FUNC	<unknown>	HIDDEN	3
__GI_putc_unlocked	.symtab	0x411f40	372	FUNC	<unknown>	HIDDEN	3
__GI_raise	.symtab	0x41d3a0	76	FUNC	<unknown>	HIDDEN	3
__GI_random	.symtab	0x415f90	164	FUNC	<unknown>	HIDDEN	3
__GI_random_r	.symtab	0x41639c	176	FUNC	<unknown>	HIDDEN	3
__GI_rawmemchr	.symtab	0x41c8c0	200	FUNC	<unknown>	HIDDEN	3
__GI_read	.symtab	0x41d4a0	84	FUNC	<unknown>	HIDDEN	3
__GI_recv	.symtab	0x4154b0	84	FUNC	<unknown>	HIDDEN	3
__GI_rewind	.symtab	0x41c2d0	192	FUNC	<unknown>	HIDDEN	3
__GI_sbrk	.symtab	0x417d10	144	FUNC	<unknown>	HIDDEN	3
__GI_select	.symtab	0x40f000	120	FUNC	<unknown>	HIDDEN	3
__GI_send	.symtab	0x415510	84	FUNC	<unknown>	HIDDEN	3
__GI_sendto	.symtab	0x415570	128	FUNC	<unknown>	HIDDEN	3
__GI_setservent	.symtab	0x419d9c	232	FUNC	<unknown>	HIDDEN	3
__GI_setsid	.symtab	0x40f080	84	FUNC	<unknown>	HIDDEN	3
__GI_setsockopt	.symtab	0x4155f0	120	FUNC	<unknown>	HIDDEN	3
__GI_setstate_r	.symtab	0x416260	316	FUNC	<unknown>	HIDDEN	3
__GI_sigaction	.symtab	0x417790	232	FUNC	<unknown>	HIDDEN	3
__GI_signal	.symtab	0x41be50	252	FUNC	<unknown>	HIDDEN	3
__GI_sigprocmask	.symtab	0x417da0	148	FUNC	<unknown>	HIDDEN	3
__GI_sleep	.symtab	0x416dc0	564	FUNC	<unknown>	HIDDEN	3
__GI_socket	.symtab	0x415670	84	FUNC	<unknown>	HIDDEN	3
__GI_sprintf	.symtab	0x40f6d0	80	FUNC	<unknown>	HIDDEN	3
__GI_srandom_r	.symtab	0x41644c	372	FUNC	<unknown>	HIDDEN	3
__GI_strcasecmp	.symtab	0x412a20	108	FUNC	<unknown>	HIDDEN	3
__GI_strcasestr	.symtab	0x412a90	152	FUNC	<unknown>	HIDDEN	3
__GI_strcat	.symtab	0x412430	52	FUNC	<unknown>	HIDDEN	3
__GI_strchr	.symtab	0x419720	256	FUNC	<unknown>	HIDDEN	3
__GI_strcmp	.symtab	0x412470	44	FUNC	<unknown>	HIDDEN	3
__GI_strcoll	.symtab	0x412470	44	FUNC	<unknown>	HIDDEN	3
__GI_strcpy	.symtab	0x4124a0	36	FUNC	<unknown>	HIDDEN	3
__GI_strdup	.symtab	0x412b30	144	FUNC	<unknown>	HIDDEN	3
__GI_strlen	.symtab	0x4124d0	184	FUNC	<unknown>	HIDDEN	3
__GI_strncat	.symtab	0x41c990	180	FUNC	<unknown>	HIDDEN	3
__GI_strncmp	.symtab	0x412590	200	FUNC	<unknown>	HIDDEN	3
__GI_strncpy	.symtab	0x412660	188	FUNC	<unknown>	HIDDEN	3
__GI_strnlen	.symtab	0x412720	256	FUNC	<unknown>	HIDDEN	3
__GI_strpbrk	.symtab	0x4198f0	64	FUNC	<unknown>	HIDDEN	3
__GI_strspn	.symtab	0x41ca50	76	FUNC	<unknown>	HIDDEN	3
__GI_strtok	.symtab	0x412bc0	32	FUNC	<unknown>	HIDDEN	3
__GI_strtok_r	.symtab	0x419820	204	FUNC	<unknown>	HIDDEN	3
__GI_strtol	.symtab	0x416970	28	FUNC	<unknown>	HIDDEN	3
__GI_strtoul	.symtab	0x416990	28	FUNC	<unknown>	HIDDEN	3
__GI_sysconf	.symtab	0x417000	432	FUNC	<unknown>	HIDDEN	3
__GI_tcgetattr	.symtab	0x412c20	176	FUNC	<unknown>	HIDDEN	3
__GI_time	.symtab	0x40f0e0	84	FUNC	<unknown>	HIDDEN	3
__GI_tolower	.symtab	0x417ea0	60	FUNC	<unknown>	HIDDEN	3
__GI_toupper	.symtab	0x40f220	60	FUNC	<unknown>	HIDDEN	3
__GI_vasprintf	.symtab	0x40f720	224	FUNC	<unknown>	HIDDEN	3
__GI_vfprintf	.symtab	0x4102b0	260	FUNC	<unknown>	HIDDEN	3
__GI_vsnprintf	.symtab	0x40f800	260	FUNC	<unknown>	HIDDEN	3
__GI_wait4	.symtab	0x417e40	88	FUNC	<unknown>	HIDDEN	3
__GI_waitpid	.symtab	0x40f1a0	28	FUNC	<unknown>	HIDDEN	3
__GI_wcrtomb	.symtab	0x417f00	112	FUNC	<unknown>	HIDDEN	3
__GI_wcsnrtombs	.symtab	0x417fb0	228	FUNC	<unknown>	HIDDEN	3
__GI_wcsrtombs	.symtab	0x417f70	64	FUNC	<unknown>	HIDDEN	3
__GI_write	.symtab	0x40f1c0	84	FUNC	<unknown>	HIDDEN	3
__JCR_END__	.symtab	0x463010	0	OBJECT	<unknown>	DEFAULT	9
__JCR_LIST__	.symtab	0x463010	0	OBJECT	<unknown>	DEFAULT	9
__app_fini	.symtab	0x46a99c	4	OBJECT	<unknown>	HIDDEN	14
__atexit_lock	.symtab	0x463d60	24	OBJECT	<unknown>	DEFAULT	11
__bsd_signal	.symtab	0x41be50	252	FUNC	<unknown>	HIDDEN	3
__bss_start	.symtab	0x464484	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x417314	136	FUNC	<unknown>	DEFAULT	3
__ctype_b	.symtab	0x463d94	4	OBJECT	<unknown>	DEFAULT	11
__ctype_tolower	.symtab	0x463da4	4	OBJECT	<unknown>	DEFAULT	11
__ctype_toupper	.symtab	0x463a24	4	OBJECT	<unknown>	DEFAULT	11
__curbrk	.symtab	0x46aa10	4	OBJECT	<unknown>	HIDDEN	14
__data_start	.symtab	0x463190	0	OBJECT	<unknown>	DEFAULT	11
__decode_answer	.symtab	0x41cda0	340	FUNC	<unknown>	HIDDEN	3
__decode_dotted	.symtab	0x41a8f0	340	FUNC	<unknown>	HIDDEN	3
__decode_header	.symtab	0x41cbb0	228	FUNC	<unknown>	HIDDEN	3
__deregister_frame_info	.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x41aa50	2568	FUNC	<unknown>	HIDDEN	3
__do_global_ctors_aux	.symtab	0x41d670	0	FUNC	<unknown>	DEFAULT	3
__do_global_dtors_aux	.symtab	0x400160	0	FUNC	<unknown>	DEFAULT	3
__dso_handle	.symtab	0x463170	0	OBJECT	<unknown>	HIDDEN	11
__encode_dotted	.symtab	0x41d500	280	FUNC	<unknown>	HIDDEN	3
__encode_header	.symtab	0x41caa0	272	FUNC	<unknown>	HIDDEN	3
__encode_question	.symtab	0x41cca0	172	FUNC	<unknown>	HIDDEN	3
__environ	.symtab	0x46a994	4	OBJECT	<unknown>	DEFAULT	14
__errno_location	.symtab	0x40f260	24	FUNC	<unknown>	DEFAULT	3
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x46a980	4	OBJECT	<unknown>	HIDDEN	14
__fgetc_unlocked	.symtab	0x418ff0	388	FUNC	<unknown>	DEFAULT	3
__fini_array_end	.symtab	0x463000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x463000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fputc_unlocked	.symtab	0x411f40	372	FUNC	<unknown>	DEFAULT	3
__get_hosts_byaddr_r	.symtab	0x41b8b0	212	FUNC	<unknown>	HIDDEN	3
__get_hosts_byname_r	.symtab	0x41b840	104	FUNC	<unknown>	HIDDEN	3
__getpagesize	.symtab	0x40ed80	48	FUNC	<unknown>	DEFAULT	3
__glibc_strerror_r	.symtab	0x412820	68	FUNC	<unknown>	DEFAULT	3
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x417ee0	24	FUNC	<unknown>	DEFAULT	3
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_alloc	.symtab	0x415c30	188	FUNC	<unknown>	DEFAULT	3
__heap_alloc_at	.symtab	0x415cf0	184	FUNC	<unknown>	DEFAULT	3
__heap_free	.symtab	0x415df8	364	FUNC	<unknown>	DEFAULT	3
__heap_link_free_area	.symtab	0x415db0	44	FUNC	<unknown>	DEFAULT	3
__heap_link_free_area_after	.symtab	0x415ddc	28	FUNC	<unknown>	DEFAULT	3
__init_array_end	.symtab	0x463000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x463000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__initbuf	.symtab	0x419930	112	FUNC	<unknown>	DEFAULT	3
__length_dotted	.symtab	0x41d620	72	FUNC	<unknown>	HIDDEN	3
__length_question	.symtab	0x41cd50	72	FUNC	<unknown>	HIDDEN	3
__libc_accept	.symtab	0x4152b0	84	FUNC	<unknown>	DEFAULT	3
__libc_close	.symtab	0x40eb00	84	FUNC	<unknown>	DEFAULT	3
__libc_connect	.symtab	0x415370	84	FUNC	<unknown>	DEFAULT	3
__libc_creat	.symtab	0x417cec	28	FUNC	<unknown>	DEFAULT	3
__libc_fcntl	.symtab	0x40e9a0	136	FUNC	<unknown>	DEFAULT	3
__libc_fcntl64	.symtab	0x40ea30	104	FUNC	<unknown>	DEFAULT	3
__libc_fork	.symtab	0x40eb60	84	FUNC	<unknown>	DEFAULT	3
__libc_getpid	.symtab	0x40edb0	84	FUNC	<unknown>	DEFAULT	3
__libc_lseek64	.symtab	0x41d3f0	168	FUNC	<unknown>	DEFAULT	3
__libc_nanosleep	.symtab	0x417c10	84	FUNC	<unknown>	DEFAULT	3
__libc_open	.symtab	0x417c70	124	FUNC	<unknown>	DEFAULT	3
__libc_poll	.symtab	0x40efa0	84	FUNC	<unknown>	DEFAULT	3
__libc_read	.symtab	0x41d4a0	84	FUNC	<unknown>	DEFAULT	3
__libc_recv	.symtab	0x4154b0	84	FUNC	<unknown>	DEFAULT	3
__libc_select	.symtab	0x40f000	120	FUNC	<unknown>	DEFAULT	3
__libc_send	.symtab	0x415510	84	FUNC	<unknown>	DEFAULT	3
__libc_sendto	.symtab	0x415570	128	FUNC	<unknown>	DEFAULT	3
__libc_sigaction	.symtab	0x417790	232	FUNC	<unknown>	DEFAULT	3
__libc_stack_end	.symtab	0x46a990	4	OBJECT	<unknown>	DEFAULT	14
__libc_system	.symtab	0x416710	568	FUNC	<unknown>	DEFAULT	3
__libc_waitpid	.symtab	0x40f1a0	28	FUNC	<unknown>	DEFAULT	3
__libc_write	.symtab	0x40f1c0	84	FUNC	<unknown>	DEFAULT	3
__malloc_heap	.symtab	0x463c90	4	OBJECT	<unknown>	DEFAULT	11
__malloc_heap_lock	.symtab	0x46a960	24	OBJECT	<unknown>	DEFAULT	14
__malloc_sbrk_lock	.symtab	0x46bc20	24	OBJECT	<unknown>	DEFAULT	14
__nameserver	.symtab	0x46bc48	12	OBJECT	<unknown>	HIDDEN	14
__nameservers	.symtab	0x4644c4	4	OBJECT	<unknown>	HIDDEN	13
__open_etc_hosts	.symtab	0x41cf00	108	FUNC	<unknown>	HIDDEN	3
__open_nameservers	.symtab	0x41b460	984	FUNC	<unknown>	HIDDEN	3
__opensock	.symtab	0x41bdf0	96	FUNC	<unknown>	HIDDEN	3
__pagesize	.symtab	0x46a998	4	OBJECT	<unknown>	DEFAULT	14
__preinit_array_end	.symtab	0x463000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x463000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x417304	8	FUNC	<unknown>	DEFAULT	3
__pthread_mutex_lock	.symtab	0x417304	8	FUNC	<unknown>	DEFAULT	3
__pthread_mutex_trylock	.symtab	0x417304	8	FUNC	<unknown>	DEFAULT	3
__pthread_mutex_unlock	.symtab	0x417304	8	FUNC	<unknown>	DEFAULT	3
__pthread_return_0	.symtab	0x417304	8	FUNC	<unknown>	DEFAULT	3
__pthread_return_void	.symtab	0x41730c	8	FUNC	<unknown>	DEFAULT	3
__raise	.symtab	0x41d3a0	76	FUNC	<unknown>	HIDDEN	3
__read_etc_hosts_r	.symtab	0x41cf6c	1076	FUNC	<unknown>	HIDDEN	3
__register_frame_info	.symtab	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x463de0	24	OBJECT	<unknown>	DEFAULT	11
__rtld_fini	.symtab	0x46a9a0	4	OBJECT	<unknown>	HIDDEN	14
__searchdomain	.symtab	0x46bc38	16	OBJECT	<unknown>	HIDDEN	14
__searchdomains	.symtab	0x4644c8	4	OBJECT	<unknown>	HIDDEN	13
__sigaddset	.symtab	0x41bf78	44	FUNC	<unknown>	DEFAULT	3
__sigdelset	.symtab	0x41bfa4	48	FUNC	<unknown>	DEFAULT	3
__sigismember	.symtab	0x41bf50	40	FUNC	<unknown>	DEFAULT	3
__start	.symtab	0x4002a0	100	FUNC	<unknown>	DEFAULT	3
__stdin	.symtab	0x463a7c	4	OBJECT	<unknown>	DEFAULT	11
__stdio_READ	.symtab	0x41c520	140	FUNC	<unknown>	HIDDEN	3
__stdio_WRITE	.symtab	0x418120	280	FUNC	<unknown>	HIDDEN	3
__stdio_adjust_position	.symtab	0x41c5b0	324	FUNC	<unknown>	HIDDEN	3
__stdio_fwrite	.symtab	0x418240	472	FUNC	<unknown>	HIDDEN	3
__stdio_init_mutex	.symtab	0x4100f8	32	FUNC	<unknown>	HIDDEN	3
__stdio_mutex_initializer.3833	.symtab	0x421610	24	OBJECT	<unknown>	DEFAULT	5
__stdio_rfill	.symtab	0x41c700	88	FUNC	<unknown>	HIDDEN	3
__stdio_seek	.symtab	0x41c850	112	FUNC	<unknown>	HIDDEN	3
__stdio_trans2r_o	.symtab	0x41c760	228	FUNC	<unknown>	HIDDEN	3
__stdio_trans2w_o	.symtab	0x418420	308	FUNC	<unknown>	HIDDEN	3
__stdio_wcommit	.symtab	0x410240	100	FUNC	<unknown>	HIDDEN	3
__stdout	.symtab	0x463a80	4	OBJECT	<unknown>	DEFAULT	11
__syscall_error	.symtab	0x41c230	72	FUNC	<unknown>	HIDDEN	3
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x4178c0	84	FUNC	<unknown>	HIDDEN	3
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x417240	196	FUNC	<unknown>	DEFAULT	3
__uClibc_init	.symtab	0x41739c	140	FUNC	<unknown>	DEFAULT	3
__uClibc_main	.symtab	0x417428	864	FUNC	<unknown>	DEFAULT	3
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x463d80	4	OBJECT	<unknown>	HIDDEN	11
__xpg_strerror_r	.symtab	0x412870	392	FUNC	<unknown>	DEFAULT	3
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x4103c0	128	FUNC	<unknown>	DEFAULT	3
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x41c190	44	FUNC	<unknown>	DEFAULT	3
_dl_phdr	.symtab	0x4644cc	4	OBJECT	<unknown>	DEFAULT	13
_dl_phnum	.symtab	0x4644d0	4	OBJECT	<unknown>	DEFAULT	13
_edata	.symtab	0x464484	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x46bcd4	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x46a9b0	4	OBJECT	<unknown>	DEFAULT	14
_exit	.symtab	0x417920	80	FUNC	<unknown>	DEFAULT	3
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fbss	.symtab	0x464484	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_fdata	.symtab	0x463170	0	NOTYPE	<unknown>	DEFAULT	11
_fini	.symtab	0x41d6e0	28	FUNC	<unknown>	DEFAULT	4
_fixed_buffers	.symtab	0x468938	8192	OBJECT	<unknown>	DEFAULT	14
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x410440	228	FUNC	<unknown>	DEFAULT	3
_fpmaxtostr	.symtab	0x4187a0	2120	FUNC	<unknown>	HIDDEN	3
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ftext	.symtab	0x400160	0	NOTYPE	<unknown>	DEFAULT	3
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_gp	.symtab	0x46be10	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_gp_disp	.symtab	0x0	0	OBJECT	<unknown>	DEFAULT	SHN_UNDEF
_h_errno	.symtab	0x46a9b4	4	OBJECT	<unknown>	DEFAULT	14
_init	.symtab	0x4000cc	28	FUNC	<unknown>	DEFAULT	2
_load_inttype	.symtab	0x418560	136	FUNC	<unknown>	HIDDEN	3
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x410cd0	220	FUNC	<unknown>	HIDDEN	3
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x4110ac	1512	FUNC	<unknown>	HIDDEN	3
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x410db0	100	FUNC	<unknown>	HIDDEN	3
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x410e20	540	FUNC	<unknown>	HIDDEN	3
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x411040	108	FUNC	<unknown>	DEFAULT	3
_pthread_cleanup_pop_restore	.symtab	0x41730c	8	FUNC	<unknown>	DEFAULT	3
_pthread_cleanup_push_defer	.symtab	0x41730c	8	FUNC	<unknown>	DEFAULT	3
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x46bc54	128	OBJECT	<unknown>	HIDDEN	14
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x40fcd0	880	FUNC	<unknown>	HIDDEN	3
_stdio_init	.symtab	0x410040	184	FUNC	<unknown>	HIDDEN	3
_stdio_openlist	.symtab	0x463a84	4	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_add_lock	.symtab	0x463a30	24	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_dec_use	.symtab	0x411a20	400	FUNC	<unknown>	DEFAULT	3
_stdio_openlist_del_count	.symtab	0x468934	4	OBJECT	<unknown>	DEFAULT	14
_stdio_openlist_del_lock	.symtab	0x463a48	24	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_use_count	.symtab	0x468930	4	OBJECT	<unknown>	DEFAULT	14
_stdio_streams	.symtab	0x463a88	240	OBJECT	<unknown>	DEFAULT	11
_stdio_term	.symtab	0x410118	284	FUNC	<unknown>	HIDDEN	3
_stdio_user_locking	.symtab	0x463a60	4	OBJECT	<unknown>	DEFAULT	11
_stdlib_strto_l	.symtab	0x4169b0	592	FUNC	<unknown>	HIDDEN	3
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x4185f0	68	FUNC	<unknown>	HIDDEN	3
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x421780	2934	OBJECT	<unknown>	HIDDEN	5
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x418640	340	FUNC	<unknown>	HIDDEN	3
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x410524	1960	FUNC	<unknown>	HIDDEN	3
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x41bfe0	428	FUNC	<unknown>	DEFAULT	3
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
accept	.symtab	0x4152b0	84	FUNC	<unknown>	DEFAULT	3
accept.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
actualparent	.symtab	0x464498	4	OBJECT	<unknown>	DEFAULT	13
advance_telstate	.symtab	0x40811c	204	FUNC	<unknown>	DEFAULT	3
advances	.symtab	0x463890	28	OBJECT	<unknown>	DEFAULT	11
advances2	.symtab	0x4638f0	44	OBJECT	<unknown>	DEFAULT	11
ak47scan	.symtab	0x40a1f4	456	FUNC	<unknown>	DEFAULT	3
ak47scantoggle	.symtab	0x40a3bc	808	FUNC	<unknown>	DEFAULT	3
ak47telscan	.symtab	0x4082cc	7976	FUNC	<unknown>	DEFAULT	3
append	.symtab	0x40b460	120	FUNC	<unknown>	DEFAULT	3
asprintf	.symtab	0x40f680	72	FUNC	<unknown>	DEFAULT	3
asprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x416950	28	FUNC	<unknown>	DEFAULT	3
atol	.symtab	0x416950	28	FUNC	<unknown>	DEFAULT	3
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x412a00	32	FUNC	<unknown>	DEFAULT	3
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x46aa00	4	OBJECT	<unknown>	DEFAULT	14
been_there_done_that.2792	.symtab	0x46a9a4	4	OBJECT	<unknown>	DEFAULT	14
bind	.symtab	0x415310	84	FUNC	<unknown>	DEFAULT	3
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
blacknurse	.symtab	0x402968	1220	FUNC	<unknown>	DEFAULT	3
botkill	.symtab	0x40a6e4	276	FUNC	<unknown>	DEFAULT	3
brk	.symtab	0x41c1c0	112	FUNC	<unknown>	DEFAULT	3
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x41be50	252	FUNC	<unknown>	DEFAULT	3
buf.2601	.symtab	0x46a950	16	OBJECT	<unknown>	DEFAULT	14
c	.symtab	0x4631a8	4	OBJECT	<unknown>	DEFAULT	11
capsaicin2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chan	.symtab	0x4644bc	4	OBJECT	<unknown>	DEFAULT	13
changeservers	.symtab	0x464504	4	OBJECT	<unknown>	DEFAULT	14
chdir	.symtab	0x40eaa0	88	FUNC	<unknown>	DEFAULT	3
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x417970	84	FUNC	<unknown>	DEFAULT	3
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x40eb00	84	FUNC	<unknown>	DEFAULT	3
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.2296	.symtab	0x4644e0	1	OBJECT	<unknown>	DEFAULT	14
con	.symtab	0x40d208	1340	FUNC	<unknown>	DEFAULT	3
connect	.symtab	0x415370	84	FUNC	<unknown>	DEFAULT	3
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
contains_fail	.symtab	0x407d54	88	FUNC	<unknown>	DEFAULT	3
contains_response	.symtab	0x407dac	148	FUNC	<unknown>	DEFAULT	3
contains_string	.symtab	0x407be4	280	FUNC	<unknown>	DEFAULT	3
contains_success	.symtab	0x407cfc	88	FUNC	<unknown>	DEFAULT	3
creat	.symtab	0x417cec	28	FUNC	<unknown>	DEFAULT	3
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x400348	288	FUNC	<unknown>	DEFAULT	3
data_start	.symtab	0x463190	0	OBJECT	<unknown>	DEFAULT	11
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
disable	.symtab	0x402118	548	FUNC	<unknown>	DEFAULT	3
disabled	.symtab	0x464508	1	OBJECT	<unknown>	DEFAULT	14
dispass	.symtab	0x46aa20	256	OBJECT	<unknown>	DEFAULT	14
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dns	.symtab	0x40624c	1164	FUNC	<unknown>	DEFAULT	3
dns_format	.symtab	0x405610	444	FUNC	<unknown>	DEFAULT	3
dns_hdr_create	.symtab	0x4057cc	240	FUNC	<unknown>	DEFAULT	3
dns_send	.symtab	0x4058bc	1620	FUNC	<unknown>	DEFAULT	3
dnsflood	.symtab	0x405f10	828	FUNC	<unknown>	DEFAULT	3
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
download	.symtab	0x401454	1828	FUNC	<unknown>	DEFAULT	3
dup2	.symtab	0x4179d0	84	FUNC	<unknown>	DEFAULT	3
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
enable	.symtab	0x40233c	472	FUNC	<unknown>	DEFAULT	3
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
endservent	.symtab	0x419cec	176	FUNC	<unknown>	DEFAULT	3
environ	.symtab	0x46a994	4	OBJECT	<unknown>	DEFAULT	14
errno	.symtab	0x46a9b0	4	OBJECT	<unknown>	DEFAULT	14
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
estridx	.symtab	0x4216f0	126	OBJECT	<unknown>	DEFAULT	5
execfile	.symtab	0x46ab20	256	OBJECT	<unknown>	DEFAULT	14
execl	.symtab	0x416cf0	204	FUNC	<unknown>	DEFAULT	3
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x417a30	84	FUNC	<unknown>	DEFAULT	3
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x416c00	236	FUNC	<unknown>	DEFAULT	3
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x422cb8	72	OBJECT	<unknown>	DEFAULT	5
fails	.symtab	0x4638ac	36	OBJECT	<unknown>	DEFAULT	11
fastflux	.symtab	0x40b85c	816	FUNC	<unknown>	DEFAULT	3
fclose	.symtab	0x40f280	512	FUNC	<unknown>	DEFAULT	3
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x40e9a0	136	FUNC	<unknown>	DEFAULT	3
fcntl64	.symtab	0x40ea30	104	FUNC	<unknown>	DEFAULT	3
fdopen	.symtab	0x4180a0	128	FUNC	<unknown>	DEFAULT	3
fdopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
feof	.symtab	0x4116a0	168	FUNC	<unknown>	DEFAULT	3
feof.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fflush_unlocked	.symtab	0x411bb0	628	FUNC	<unknown>	DEFAULT	3
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x418ff0	388	FUNC	<unknown>	DEFAULT	3
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x411750	216	FUNC	<unknown>	DEFAULT	3
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x411e30	268	FUNC	<unknown>	DEFAULT	3
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
filter	.symtab	0x4009fc	236	FUNC	<unknown>	DEFAULT	3
flooders	.symtab	0x463930	176	OBJECT	<unknown>	DEFAULT	11
fmt	.symtab	0x422ca0	20	OBJECT	<unknown>	DEFAULT	5
fopen	.symtab	0x40f480	28	FUNC	<unknown>	DEFAULT	3
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x40eb60	84	FUNC	<unknown>	DEFAULT	3
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fprintf	.symtab	0x40f630	72	FUNC	<unknown>	DEFAULT	3
fprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputc	.symtab	0x411830	276	FUNC	<unknown>	DEFAULT	3
fputc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputc_unlocked	.symtab	0x411f40	372	FUNC	<unknown>	DEFAULT	3
fputc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs	.symtab	0x411950	200	FUNC	<unknown>	DEFAULT	3
fputs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x4120c0	128	FUNC	<unknown>	DEFAULT	3
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x40021c	0	FUNC	<unknown>	DEFAULT	3
free	.symtab	0x4158c0	396	FUNC	<unknown>	DEFAULT	3
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
freeaddrinfo	.symtab	0x413bc8	84	FUNC	<unknown>	DEFAULT	3
fseek	.symtab	0x41c280	68	FUNC	<unknown>	DEFAULT	3
fseeko	.symtab	0x41c280	68	FUNC	<unknown>	DEFAULT	3
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x41c390	388	FUNC	<unknown>	DEFAULT	3
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x412140	280	FUNC	<unknown>	DEFAULT	3
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gaih	.symtab	0x463158	24	OBJECT	<unknown>	DEFAULT	10
gaih_inet	.symtab	0x412e1c	3500	FUNC	<unknown>	DEFAULT	3
gaih_inet_serv	.symtab	0x412cf0	300	FUNC	<unknown>	DEFAULT	3
gaih_inet_typeproto	.symtab	0x422300	35	OBJECT	<unknown>	DEFAULT	5
get	.symtab	0x401b78	540	FUNC	<unknown>	DEFAULT	3
getBuild	.symtab	0x400310	56	FUNC	<unknown>	DEFAULT	3
getDatIP	.symtab	0x40728c	1824	FUNC	<unknown>	DEFAULT	3
getHost	.symtab	0x403c34	160	FUNC	<unknown>	DEFAULT	3
getPublicIP	.symtab	0x40b678	256	FUNC	<unknown>	DEFAULT	3
get_hosts_byaddr_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_telstate_host	.symtab	0x4080b4	104	FUNC	<unknown>	DEFAULT	3
getaddrinfo	.symtab	0x413c1c	1020	FUNC	<unknown>	DEFAULT	3
getaddrinfo.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x418ff0	388	FUNC	<unknown>	DEFAULT	3
getcwd	.symtab	0x40ebc0	364	FUNC	<unknown>	DEFAULT	3
getcwd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x40ed30	72	FUNC	<unknown>	DEFAULT	3
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x417a90	88	FUNC	<unknown>	DEFAULT	3
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x417af0	88	FUNC	<unknown>	DEFAULT	3
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x417b50	84	FUNC	<unknown>	DEFAULT	3
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyaddr_r	.symtab	0x414e20	1160	FUNC	<unknown>	DEFAULT	3
gethostbyaddr_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x414a30	1004	FUNC	<unknown>	DEFAULT	3
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x41b990	1108	FUNC	<unknown>	DEFAULT	3
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getmyip	.symtab	0x40b778	228	FUNC	<unknown>	DEFAULT	3
getpagesize	.symtab	0x40ed80	48	FUNC	<unknown>	DEFAULT	3
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x40edb0	84	FUNC	<unknown>	DEFAULT	3
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x40ee10	84	FUNC	<unknown>	DEFAULT	3
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x40ee70	84	FUNC	<unknown>	DEFAULT	3
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getservbyname	.symtab	0x41a258	132	FUNC	<unknown>	DEFAULT	3
getservbyname_r	.symtab	0x41a088	464	FUNC	<unknown>	DEFAULT	3
getservbyport	.symtab	0x41a004	132	FUNC	<unknown>	DEFAULT	3
getservbyport_r	.symtab	0x419e84	384	FUNC	<unknown>	DEFAULT	3
getservent	.symtab	0x419c84	104	FUNC	<unknown>	DEFAULT	3
getservent_r	.symtab	0x4199a0	740	FUNC	<unknown>	DEFAULT	3
getservice.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x4153d0	120	FUNC	<unknown>	DEFAULT	3
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x417bb0	84	FUNC	<unknown>	DEFAULT	3
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x46a9b4	4	OBJECT	<unknown>	DEFAULT	14
head	.symtab	0x4644ac	4	OBJECT	<unknown>	DEFAULT	13
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_alloc_at.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
help	.symtab	0x40a98c	2044	FUNC	<unknown>	DEFAULT	3
histClear	.symtab	0x40b5f4	132	FUNC	<unknown>	DEFAULT	3
hlt	.symtab	0x4002fc	0	NOTYPE	<unknown>	DEFAULT	3
hold	.symtab	0x405438	472	FUNC	<unknown>	DEFAULT	3
host2ip	.symtab	0x402514	340	FUNC	<unknown>	DEFAULT	3
htonl	.symtab	0x412ce0	8	FUNC	<unknown>	DEFAULT	3
htons	.symtab	0x412ce8	8	FUNC	<unknown>	DEFAULT	3
i.5394	.symtab	0x464918	4	OBJECT	<unknown>	DEFAULT	14
i.5436	.symtab	0x4631ac	4	OBJECT	<unknown>	DEFAULT	11
ident	.symtab	0x464488	4	OBJECT	<unknown>	DEFAULT	13
identd	.symtab	0x400c80	1152	FUNC	<unknown>	DEFAULT	3
if_freenameindex	.symtab	0x41a778	112	FUNC	<unknown>	DEFAULT	3
if_index.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
if_indextoname	.symtab	0x41a2e0	268	FUNC	<unknown>	DEFAULT	3
if_nameindex	.symtab	0x41a4f8	640	FUNC	<unknown>	DEFAULT	3
if_nametoindex	.symtab	0x41a3ec	268	FUNC	<unknown>	DEFAULT	3
in6_addr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
in6addr_any	.symtab	0x422370	16	OBJECT	<unknown>	DEFAULT	5
in6addr_loopback	.symtab	0x422380	16	OBJECT	<unknown>	DEFAULT	5
in_cksum	.symtab	0x4011c8	324	FUNC	<unknown>	DEFAULT	3
index	.symtab	0x419720	256	FUNC	<unknown>	DEFAULT	3
inet_addr	.symtab	0x4149e0	72	FUNC	<unknown>	DEFAULT	3
inet_aton	.symtab	0x41a7f0	244	FUNC	<unknown>	DEFAULT	3
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x4149bc	32	FUNC	<unknown>	DEFAULT	3
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x414920	156	FUNC	<unknown>	DEFAULT	3
inet_ntop	.symtab	0x4145c0	852	FUNC	<unknown>	DEFAULT	3
inet_ntop4	.symtab	0x4143cc	500	FUNC	<unknown>	DEFAULT	3
inet_pton	.symtab	0x414110	700	FUNC	<unknown>	DEFAULT	3
inet_pton4	.symtab	0x414020	240	FUNC	<unknown>	DEFAULT	3
infected	.symtab	0x463924	8	OBJECT	<unknown>	DEFAULT	11
init_rand	.symtab	0x402668	300	FUNC	<unknown>	DEFAULT	3
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initial_fa	.symtab	0x463b80	264	OBJECT	<unknown>	DEFAULT	11
initstate	.symtab	0x4160e4	208	FUNC	<unknown>	DEFAULT	3
initstate_r	.symtab	0x4165c0	328	FUNC	<unknown>	DEFAULT	3
ioctl	.symtab	0x40eed0	104	FUNC	<unknown>	DEFAULT	3
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x412be0	60	FUNC	<unknown>	DEFAULT	3
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ismaster	.symtab	0x40b4d8	284	FUNC	<unknown>	DEFAULT	3
junk	.symtab	0x404ad8	472	FUNC	<unknown>	DEFAULT	3
key	.symtab	0x4644b4	4	OBJECT	<unknown>	DEFAULT	13
kill	.symtab	0x40ef40	88	FUNC	<unknown>	DEFAULT	3
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killall	.symtab	0x40b188	484	FUNC	<unknown>	DEFAULT	3
killd	.symtab	0x40b36c	244	FUNC	<unknown>	DEFAULT	3
knownBots	.symtab	0x4631d0	776	OBJECT	<unknown>	DEFAULT	11
legit	.symtab	0x46391c	8	OBJECT	<unknown>	DEFAULT	11
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/mips/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/mips/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/mips/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/mips/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/mips/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/mips/pipe.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
limiter	.symtab	0x46448c	4	OBJECT	<unknown>	DEFAULT	13
listFork	.symtab	0x4034ec	468	FUNC	<unknown>	DEFAULT	3
listen	.symtab	0x415450	84	FUNC	<unknown>	DEFAULT	3
listen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x41d3f0	168	FUNC	<unknown>	DEFAULT	3
main	.symtab	0x40d9b0	4068	FUNC	<unknown>	DEFAULT	3
makeFukdString	.symtab	0x40d744	332	FUNC	<unknown>	DEFAULT	3
makeRandomShit	.symtab	0x402e2c	316	FUNC	<unknown>	DEFAULT	3
malloc	.symtab	0x4156d0	492	FUNC	<unknown>	DEFAULT	3
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
masters	.symtab	0x4631c8	4	OBJECT	<unknown>	DEFAULT	11
memchr	.symtab	0x419180	264	FUNC	<unknown>	DEFAULT	3
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x412260	308	FUNC	<unknown>	DEFAULT	3
memmove	.symtab	0x419290	816	FUNC	<unknown>	DEFAULT	3
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x4195c0	76	FUNC	<unknown>	DEFAULT	3
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x419610	272	FUNC	<unknown>	DEFAULT	3
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x4123a0	144	FUNC	<unknown>	DEFAULT	3
mfork	.symtab	0x4007c4	568	FUNC	<unknown>	DEFAULT	3
move	.symtab	0x40a898	244	FUNC	<unknown>	DEFAULT	3
msgs	.symtab	0x4639e0	64	OBJECT	<unknown>	DEFAULT	11
mygethostbyname	.symtab	0x40130c	328	FUNC	<unknown>	DEFAULT	3
mylock	.symtab	0x463ca0	24	OBJECT	<unknown>	DEFAULT	11
mylock	.symtab	0x463db0	24	OBJECT	<unknown>	DEFAULT	11
mylock	.symtab	0x46a9e0	24	OBJECT	<unknown>	DEFAULT	14
mylock	.symtab	0x463e00	24	OBJECT	<unknown>	DEFAULT	11
nanosleep	.symtab	0x417c10	84	FUNC	<unknown>	DEFAULT	3
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
negotiate	.symtab	0x4079ac	568	FUNC	<unknown>	DEFAULT	3
next_start.1065	.symtab	0x46a940	4	OBJECT	<unknown>	DEFAULT	14
nick	.symtab	0x464490	4	OBJECT	<unknown>	DEFAULT	13
nickc	.symtab	0x401e04	324	FUNC	<unknown>	DEFAULT	3
ntohl	.symtab	0x412cd0	8	FUNC	<unknown>	DEFAULT	3
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x412cd8	8	FUNC	<unknown>	DEFAULT	3
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
nummasters	.symtab	0x4631a4	4	OBJECT	<unknown>	DEFAULT	11
numpids	.symtab	0x464514	4	OBJECT	<unknown>	DEFAULT	14
numservers	.symtab	0x4631a0	4	OBJECT	<unknown>	DEFAULT	11
object.2349	.symtab	0x4644e4	24	OBJECT	<unknown>	DEFAULT	14
open	.symtab	0x417c70	124	FUNC	<unknown>	DEFAULT	3
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opensock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
p.2294	.symtab	0x463180	0	OBJECT	<unknown>	DEFAULT	11
passwords	.symtab	0x4636fc	404	OBJECT	<unknown>	DEFAULT	11
pclose	.symtab	0x40f910	324	FUNC	<unknown>	DEFAULT	3
perror	.symtab	0x40f4a0	84	FUNC	<unknown>	DEFAULT	3
perror.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pid	.symtab	0x464484	4	OBJECT	<unknown>	DEFAULT	13
pids	.symtab	0x4644c0	4	OBJECT	<unknown>	DEFAULT	13
pipe	.symtab	0x417880	64	FUNC	<unknown>	DEFAULT	3
poll	.symtab	0x40efa0	84	FUNC	<unknown>	DEFAULT	3
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
popen	.symtab	0x40fa54	636	FUNC	<unknown>	DEFAULT	3
popen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
popen_list	.symtab	0x468920	4	OBJECT	<unknown>	DEFAULT	14
poww	.symtab	0x401100	200	FUNC	<unknown>	DEFAULT	3
pps	.symtab	0x4644a4	4	OBJECT	<unknown>	DEFAULT	13
prefix.4045	.symtab	0x421640	12	OBJECT	<unknown>	DEFAULT	5
print	.symtab	0x406c64	1456	FUNC	<unknown>	DEFAULT	3
printchar	.symtab	0x4066d8	184	FUNC	<unknown>	DEFAULT	3
printi	.symtab	0x4069cc	664	FUNC	<unknown>	DEFAULT	3
prints	.symtab	0x406790	572	FUNC	<unknown>	DEFAULT	3
putc	.symtab	0x411830	276	FUNC	<unknown>	DEFAULT	3
putc_unlocked	.symtab	0x411f40	372	FUNC	<unknown>	DEFAULT	3
puts	.symtab	0x40f500	260	FUNC	<unknown>	DEFAULT	3
puts.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
qual_chars.4050	.symtab	0x421660	20	OBJECT	<unknown>	DEFAULT	5
raise	.symtab	0x41d3a0	76	FUNC	<unknown>	DEFAULT	3
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x415f70	28	FUNC	<unknown>	DEFAULT	3
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x402794	468	FUNC	<unknown>	DEFAULT	3
random	.symtab	0x415f90	164	FUNC	<unknown>	DEFAULT	3
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x4223c0	40	OBJECT	<unknown>	DEFAULT	5
random_r	.symtab	0x41639c	176	FUNC	<unknown>	DEFAULT	3
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randstring	.symtab	0x400ae8	408	FUNC	<unknown>	DEFAULT	3
randtbl	.symtab	0x463cb8	128	OBJECT	<unknown>	DEFAULT	11
rawmemchr	.symtab	0x41c8c0	200	FUNC	<unknown>	DEFAULT	3
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x41d4a0	84	FUNC	<unknown>	DEFAULT	3
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_until_response	.symtab	0x407fa8	268	FUNC	<unknown>	DEFAULT	3
read_with_timeout	.symtab	0x407e40	360	FUNC	<unknown>	DEFAULT	3
realloc	.symtab	0x415a50	472	FUNC	<unknown>	DEFAULT	3
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realrand	.symtab	0x401f48	228	FUNC	<unknown>	DEFAULT	3
recv	.symtab	0x4154b0	84	FUNC	<unknown>	DEFAULT	3
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rekdevice	.symtab	0x4631cc	4	OBJECT	<unknown>	DEFAULT	11
reset_telstate	.symtab	0x4081e8	100	FUNC	<unknown>	DEFAULT	3
rewind	.symtab	0x41c2d0	192	FUNC	<unknown>	DEFAULT	3
rewind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rnd	.symtab	0x4644b8	4	OBJECT	<unknown>	DEFAULT	13
rndnick	.symtab	0x40202c	236	FUNC	<unknown>	DEFAULT	3
rseed	.symtab	0x46ac20	4096	OBJECT	<unknown>	DEFAULT	14
rsi	.symtab	0x46449c	4	OBJECT	<unknown>	DEFAULT	13
sbrk	.symtab	0x417d10	144	FUNC	<unknown>	DEFAULT	3
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x464500	4	OBJECT	<unknown>	DEFAULT	14
sclose	.symtab	0x40824c	128	FUNC	<unknown>	DEFAULT	3
select	.symtab	0x40f000	120	FUNC	<unknown>	DEFAULT	3
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x415510	84	FUNC	<unknown>	DEFAULT	3
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendHOLD	.symtab	0x404cb0	1928	FUNC	<unknown>	DEFAULT	3
sendHTTP	.symtab	0x403e40	732	FUNC	<unknown>	DEFAULT	3
sendJUNK	.symtab	0x40437c	1884	FUNC	<unknown>	DEFAULT	3
sendSTD	.symtab	0x4036c0	1396	FUNC	<unknown>	DEFAULT	3
sendto	.symtab	0x415570	128	FUNC	<unknown>	DEFAULT	3
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
serv	.symtab	0x46a9c8	16	OBJECT	<unknown>	DEFAULT	14
serv_stayopen	.symtab	0x46a9d8	4	OBJECT	<unknown>	DEFAULT	14
servbuf	.symtab	0x46a9c0	4	OBJECT	<unknown>	DEFAULT	14
server	.symtab	0x4644a8	4	OBJECT	<unknown>	DEFAULT	13
servers	.symtab	0x4631c0	8	OBJECT	<unknown>	DEFAULT	11
servf	.symtab	0x46a9c4	4	OBJECT	<unknown>	DEFAULT	14
setservent	.symtab	0x419d9c	232	FUNC	<unknown>	DEFAULT	3
setsid	.symtab	0x40f080	84	FUNC	<unknown>	DEFAULT	3
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x4155f0	120	FUNC	<unknown>	DEFAULT	3
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x416034	176	FUNC	<unknown>	DEFAULT	3
setstate_r	.symtab	0x416260	316	FUNC	<unknown>	DEFAULT	3
sigaction	.symtab	0x417790	232	FUNC	<unknown>	DEFAULT	3
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x41be50	252	FUNC	<unknown>	DEFAULT	3
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x417da0	148	FUNC	<unknown>	DEFAULT	3
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x416dc0	564	FUNC	<unknown>	DEFAULT	3
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleeptime	.symtab	0x4631b0	4	OBJECT	<unknown>	DEFAULT	11
sock	.symtab	0x464494	4	OBJECT	<unknown>	DEFAULT	13
socket	.symtab	0x415670	84	FUNC	<unknown>	DEFAULT	3
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x403cd4	364	FUNC	<unknown>	DEFAULT	3
spec_and_mask.4049	.symtab	0x421674	16	OBJECT	<unknown>	DEFAULT	5
spec_base.4044	.symtab	0x42164c	7	OBJECT	<unknown>	DEFAULT	5
spec_chars.4046	.symtab	0x4216a0	21	OBJECT	<unknown>	DEFAULT	5
spec_flags.4045	.symtab	0x4216b8	8	OBJECT	<unknown>	DEFAULT	5
spec_or_mask.4048	.symtab	0x421684	16	OBJECT	<unknown>	DEFAULT	5
spec_ranges.4047	.symtab	0x421694	9	OBJECT	<unknown>	DEFAULT	5
spoofs	.symtab	0x46450c	4	OBJECT	<unknown>	DEFAULT	14
spoofsm	.symtab	0x464510	4	OBJECT	<unknown>	DEFAULT	14
sprintf	.symtab	0x40f6d0	80	FUNC	<unknown>	DEFAULT	3
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x4161b4	172	FUNC	<unknown>	DEFAULT	3
srandom	.symtab	0x4161b4	172	FUNC	<unknown>	DEFAULT	3
srandom_r	.symtab	0x41644c	372	FUNC	<unknown>	DEFAULT	3
static_id	.symtab	0x463dd0	2	OBJECT	<unknown>	DEFAULT	11
static_ns	.symtab	0x46a9f8	4	OBJECT	<unknown>	DEFAULT	14
stderr	.symtab	0x463a78	4	OBJECT	<unknown>	DEFAULT	11
stdin	.symtab	0x463a70	4	OBJECT	<unknown>	DEFAULT	11
stdout	.symtab	0x463a74	4	OBJECT	<unknown>	DEFAULT	11
strcasecmp	.symtab	0x412a20	108	FUNC	<unknown>	DEFAULT	3
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcasestr	.symtab	0x412a90	152	FUNC	<unknown>	DEFAULT	3
strcasestr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcat	.symtab	0x412430	52	FUNC	<unknown>	DEFAULT	3
strcat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x419720	256	FUNC	<unknown>	DEFAULT	3
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x412470	44	FUNC	<unknown>	DEFAULT	3
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x412470	44	FUNC	<unknown>	DEFAULT	3
strcpy	.symtab	0x4124a0	36	FUNC	<unknown>	DEFAULT	3
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x412b30	144	FUNC	<unknown>	DEFAULT	3
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x412870	392	FUNC	<unknown>	DEFAULT	3
strlen	.symtab	0x4124d0	184	FUNC	<unknown>	DEFAULT	3
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncat	.symtab	0x41c990	180	FUNC	<unknown>	DEFAULT	3
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncmp	.symtab	0x412590	200	FUNC	<unknown>	DEFAULT	3
strncmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x412660	188	FUNC	<unknown>	DEFAULT	3
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x412720	256	FUNC	<unknown>	DEFAULT	3
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x4198f0	64	FUNC	<unknown>	DEFAULT	3
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x41ca50	76	FUNC	<unknown>	DEFAULT	3
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x412bc0	32	FUNC	<unknown>	DEFAULT	3
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x419820	204	FUNC	<unknown>	DEFAULT	3
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x416970	28	FUNC	<unknown>	DEFAULT	3
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoul	.symtab	0x416990	28	FUNC	<unknown>	DEFAULT	3
strtoul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strwildmatch	.symtab	0x400468	656	FUNC	<unknown>	DEFAULT	3
successes	.symtab	0x4638d0	32	OBJECT	<unknown>	DEFAULT	11
sysconf	.symtab	0x417000	432	FUNC	<unknown>	DEFAULT	3
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
system	.symtab	0x416710	568	FUNC	<unknown>	DEFAULT	3
system.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x407214	120	FUNC	<unknown>	DEFAULT	3
tcgetattr	.symtab	0x412c20	176	FUNC	<unknown>	DEFAULT	3
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tehport	.symtab	0x4644b0	4	OBJECT	<unknown>	DEFAULT	13
textBuffer.4883	.symtab	0x464518	1024	OBJECT	<unknown>	DEFAULT	14
thanks	.symtab	0x46392c	4	OBJECT	<unknown>	DEFAULT	11
time	.symtab	0x40f0e0	84	FUNC	<unknown>	DEFAULT	3
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x417ea0	60	FUNC	<unknown>	DEFAULT	3
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
touchMyself	.symtab	0x40d890	288	FUNC	<unknown>	DEFAULT	3
toupper	.symtab	0x40f220	60	FUNC	<unknown>	DEFAULT	3
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
type_codes	.symtab	0x4216c0	24	OBJECT	<unknown>	DEFAULT	5
type_sizes	.symtab	0x4216d8	12	OBJECT	<unknown>	DEFAULT	5
umask	.symtab	0x40f140	88	FUNC	<unknown>	DEFAULT	3
umask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown	.symtab	0x402f68	1412	FUNC	<unknown>	DEFAULT	3
unknown.1088	.symtab	0x421770	14	OBJECT	<unknown>	DEFAULT	5
unsafe_state	.symtab	0x463d40	28	OBJECT	<unknown>	DEFAULT	11
user	.symtab	0x4644a0	4	OBJECT	<unknown>	DEFAULT	13
usernames	.symtab	0x463568	404	OBJECT	<unknown>	DEFAULT	11
usleep	.symtab	0x4171b0	144	FUNC	<unknown>	DEFAULT	3
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vasprintf	.symtab	0x40f720	224	FUNC	<unknown>	DEFAULT	3
vasprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
version	.symtab	0x401d94	112	FUNC	<unknown>	DEFAULT	3
vfprintf	.symtab	0x4102b0	260	FUNC	<unknown>	DEFAULT	3
vfprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vsnprintf	.symtab	0x40f800	260	FUNC	<unknown>	DEFAULT	3
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vsprintf	.symtab	0x40f610	32	FUNC	<unknown>	DEFAULT	3
vsprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x417e40	88	FUNC	<unknown>	DEFAULT	3
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x40f1a0	28	FUNC	<unknown>	DEFAULT	3
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x417f00	112	FUNC	<unknown>	DEFAULT	3
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x417fb0	228	FUNC	<unknown>	DEFAULT	3
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x417f70	64	FUNC	<unknown>	DEFAULT	3
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x40f1c0	84	FUNC	<unknown>	DEFAULT	3
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3043	.symtab	0x422344	17	OBJECT	<unknown>	DEFAULT	5

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 120
• 5060 undefined
• 443 (HTTPS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 28, 2025 16:28:02.406064987 CEST	45490	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:03.424252033 CEST	45490	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:04.016855001 CEST	5060	45490	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:04.016995907 CEST	45490	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:04.452573061 CEST	45490	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:04.624737978 CEST	5060	45490	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:04.624882936 CEST	45490	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:05.077768087 CEST	5060	45490	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:05.078382969 CEST	5060	45490	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:05.079633951 CEST	45490	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:05.719048023 CEST	5060	45490	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:10.081278086 CEST	45492	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:10.407466888 CEST	5060	45492	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:10.407666922 CEST	45492	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:11.093563080 CEST	45492	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:11.967436075 CEST	45492	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:12.649797916 CEST	5060	45492	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:12.649816036 CEST	5060	45492	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:12.649873972 CEST	45492	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:12.649955988 CEST	45492	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:13.343590021 CEST	48202	443	192.168.2.13	185.125.190.26
Apr 28, 2025 16:28:13.791527987 CEST	45492	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:14.117208004 CEST	5060	45492	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:14.117666960 CEST	5060	45492	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:14.117681980 CEST	5060	45492	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:14.117717028 CEST	45492	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:14.117820978 CEST	45492	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:14.443660021 CEST	5060	45492	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:19.119368076 CEST	45494	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:20.131447077 CEST	45494	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:20.905633926 CEST	5060	45494	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:20.905747890 CEST	45494	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:21.130306959 CEST	45494	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:21.240129948 CEST	5060	45494	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:21.240163088 CEST	5060	45494	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:21.240314007 CEST	45494	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:21.240314007 CEST	45494	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:21.240475893 CEST	45494	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:21.465801001 CEST	5060	45494	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:21.576191902 CEST	5060	45494	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:21.576205015 CEST	5060	45494	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:26.245563030 CEST	45496	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:26.563107967 CEST	5060	45496	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:26.563175917 CEST	45496	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:26.877916098 CEST	5060	45496	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:26.877934933 CEST	5060	45496	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:26.877973080 CEST	45496	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:26.877973080 CEST	45496	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:27.254919052 CEST	45496	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:27.256119967 CEST	45496	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:27.569431067 CEST	5060	45496	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:27.570394039 CEST	5060	45496	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:32.258189917 CEST	45498	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:33.279465914 CEST	45498	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:35.295645952 CEST	45498	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:35.958198071 CEST	5060	45498	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:35.958276987 CEST	45498	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:36.326276064 CEST	45498	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:36.630158901 CEST	5060	45498	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:36.630177021 CEST	5060	45498	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:36.630285025 CEST	45498	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:36.630285025 CEST	45498	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:36.630285025 CEST	45498	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:36.983282089 CEST	5060	45498	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:37.275818110 CEST	5060	45498	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:37.275840998 CEST	5060	45498	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:41.650137901 CEST	45500	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:42.655498028 CEST	45500	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:43.257255077 CEST	5060	45500	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:43.262254953 CEST	45500	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:43.661986113 CEST	45500	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:43.880631924 CEST	5060	45500	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:43.880686045 CEST	45500	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:43.881036043 CEST	5060	45500	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:43.881113052 CEST	45500	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:43.881166935 CEST	45500	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:44.254842043 CEST	5060	45500	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:44.451864004 CEST	5060	45500	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:44.452076912 CEST	5060	45500	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:45.599504948 CEST	48202	443	192.168.2.13	185.125.190.26
Apr 28, 2025 16:28:48.882958889 CEST	45502	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:49.203676939 CEST	5060	45502	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:49.203902006 CEST	45502	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:49.525221109 CEST	5060	45502	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:49.525244951 CEST	5060	45502	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:49.525392056 CEST	45502	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:49.525392056 CEST	45502	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:49.886746883 CEST	45502	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:49.886746883 CEST	45502	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:50.207225084 CEST	5060	45502	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:50.207246065 CEST	5060	45502	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:54.888303041 CEST	45504	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:55.210366011 CEST	5060	45504	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:55.210644007 CEST	45504	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:55.625803947 CEST	5060	45504	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:55.625828028 CEST	5060	45504	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:55.625873089 CEST	45504	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:55.625899076 CEST	45504	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:55.891655922 CEST	45504	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:55.892601013 CEST	45504	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:28:56.226882935 CEST	5060	45504	79.51.28.70	192.168.2.13
Apr 28, 2025 16:28:56.226898909 CEST	5060	45504	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:00.908761024 CEST	45506	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:01.229475975 CEST	5060	45506	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:01.229543924 CEST	45506	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:01.550569057 CEST	5060	45506	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:01.550616026 CEST	5060	45506	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:01.550699949 CEST	45506	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:01.550699949 CEST	45506	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:01.914578915 CEST	45506	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:01.915086031 CEST	45506	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:02.235471010 CEST	5060	45506	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:02.235486031 CEST	5060	45506	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:06.962286949 CEST	45508	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:07.556474924 CEST	5060	45508	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:07.556546926 CEST	45508	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:08.008286953 CEST	45508	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:08.171035051 CEST	5060	45508	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:08.171047926 CEST	5060	45508	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:08.171109915 CEST	45508	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:08.171142101 CEST	45508	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:08.171315908 CEST	45508	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:08.643862963 CEST	5060	45508	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:08.782633066 CEST	5060	45508	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:08.783054113 CEST	5060	45508	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:13.176059961 CEST	45510	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:13.749514103 CEST	5060	45510	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:13.749603987 CEST	45510	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:14.185173035 CEST	45510	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:14.343038082 CEST	5060	45510	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:14.343055010 CEST	5060	45510	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:14.343146086 CEST	45510	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:14.343147039 CEST	45510	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:14.343257904 CEST	45510	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:14.799870014 CEST	5060	45510	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:14.957782984 CEST	5060	45510	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:14.957799911 CEST	5060	45510	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:19.345793962 CEST	45512	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:19.729846954 CEST	5060	45512	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:19.729935884 CEST	45512	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:20.115328074 CEST	5060	45512	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:20.115345001 CEST	5060	45512	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:20.115432024 CEST	45512	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:20.115432024 CEST	45512	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:20.352305889 CEST	45512	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:20.355048895 CEST	45512	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:20.735865116 CEST	5060	45512	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:20.738336086 CEST	5060	45512	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:25.360485077 CEST	45514	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:26.367537022 CEST	45514	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:26.975399971 CEST	5060	45514	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:26.975492954 CEST	45514	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:27.376775980 CEST	45514	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:27.598897934 CEST	5060	45514	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:27.598978043 CEST	45514	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:27.974448919 CEST	5060	45514	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:27.974486113 CEST	5060	45514	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:27.974618912 CEST	45514	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:28.574419022 CEST	5060	45514	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:32.985323906 CEST	45516	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:33.597580910 CEST	5060	45516	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:33.597671986 CEST	45516	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:33.989712954 CEST	45516	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:34.228142023 CEST	5060	45516	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:34.228193998 CEST	45516	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:34.615201950 CEST	5060	45516	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:34.615221024 CEST	5060	45516	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:34.615417004 CEST	45516	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:35.186991930 CEST	5060	45516	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:39.624439001 CEST	45518	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:40.240889072 CEST	5060	45518	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:40.240988970 CEST	45518	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:40.634690046 CEST	45518	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:40.868772030 CEST	5060	45518	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:40.868962049 CEST	45518	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:42.079550028 CEST	45518	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:43.185000896 CEST	5060	45518	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:43.185020924 CEST	5060	45518	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:43.185034037 CEST	5060	45518	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:43.185153961 CEST	45518	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:43.185338020 CEST	45518	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:43.808098078 CEST	5060	45518	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:48.191639900 CEST	45520	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:48.744124889 CEST	5060	45520	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:48.744204998 CEST	45520	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:49.200376034 CEST	45520	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:49.314722061 CEST	5060	45520	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:49.314824104 CEST	45520	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:49.316587925 CEST	5060	45520	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:49.316641092 CEST	45520	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:49.316692114 CEST	45520	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:49.746150017 CEST	5060	45520	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:49.905158997 CEST	5060	45520	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:49.905580044 CEST	5060	45520	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:54.317991018 CEST	45522	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:54.646136045 CEST	5060	45522	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:54.646229029 CEST	45522	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:55.027393103 CEST	5060	45522	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:55.027439117 CEST	5060	45522	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:55.027554989 CEST	45522	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:55.027554989 CEST	45522	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:55.323709965 CEST	45522	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:55.325577974 CEST	45522	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:29:55.652390003 CEST	5060	45522	79.51.28.70	192.168.2.13
Apr 28, 2025 16:29:55.653384924 CEST	5060	45522	79.51.28.70	192.168.2.13
Apr 28, 2025 16:30:00.330377102 CEST	45524	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:30:01.343604088 CEST	45524	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:30:01.730235100 CEST	5060	45524	79.51.28.70	192.168.2.13
Apr 28, 2025 16:30:01.730526924 CEST	45524	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:30:02.339006901 CEST	45524	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:30:02.757755041 CEST	5060	45524	79.51.28.70	192.168.2.13
Apr 28, 2025 16:30:02.758011103 CEST	45524	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:30:03.327577114 CEST	45524	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:30:05.060143948 CEST	5060	45524	79.51.28.70	192.168.2.13
Apr 28, 2025 16:30:05.060159922 CEST	5060	45524	79.51.28.70	192.168.2.13
Apr 28, 2025 16:30:05.060197115 CEST	45524	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:30:05.060197115 CEST	45524	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:30:05.060250044 CEST	45524	5060	192.168.2.13	79.51.28.70
Apr 28, 2025 16:30:05.446883917 CEST	5060	45524	79.51.28.70	192.168.2.13

IRC Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 28, 2025 16:28:04.452573061 CEST	45490	5060	192.168.2.13	79.51.28.70	NICK [OSX\|MIPS]4YmC USER 4YmC localhost localhost :4YmC
Apr 28, 2025 16:28:11.093563080 CEST	45492	5060	192.168.2.13	79.51.28.70	NICK [OSX\|MIPS]4YmC USER 4YmC localhost localhost :4YmC
Apr 28, 2025 16:28:11.967436075 CEST	45492	5060	192.168.2.13	79.51.28.70	NICK [OSX\|MIPS]4YmC USER 4YmC localhost localhost :4YmC
Apr 28, 2025 16:28:13.791527987 CEST	45492	5060	192.168.2.13	79.51.28.70	NICK [OSX\|MIPS]4YmC USER 4YmC localhost localhost :4YmC
Apr 28, 2025 16:28:21.130306959 CEST	45494	5060	192.168.2.13	79.51.28.70	NICK [OSX\|MIPS]4YmC USER 4YmC localhost localhost :4YmC
Apr 28, 2025 16:28:27.254919052 CEST	45496	5060	192.168.2.13	79.51.28.70	NICK [OSX\|MIPS]4YmC USER 4YmC localhost localhost :4YmC
Apr 28, 2025 16:28:36.326276064 CEST	45498	5060	192.168.2.13	79.51.28.70	NICK [OSX\|MIPS]4YmC USER 4YmC localhost localhost :4YmC
Apr 28, 2025 16:28:43.661986113 CEST	45500	5060	192.168.2.13	79.51.28.70	NICK [OSX\|MIPS]4YmC USER 4YmC localhost localhost :4YmC
Apr 28, 2025 16:28:49.886746883 CEST	45502	5060	192.168.2.13	79.51.28.70	NICK [OSX\|MIPS]4YmC USER 4YmC localhost localhost :4YmC
Apr 28, 2025 16:28:55.891655922 CEST	45504	5060	192.168.2.13	79.51.28.70	NICK [OSX\|MIPS]4YmC USER 4YmC localhost localhost :4YmC
Apr 28, 2025 16:29:01.914578915 CEST	45506	5060	192.168.2.13	79.51.28.70	NICK [OSX\|MIPS]4YmC USER 4YmC localhost localhost :4YmC
Apr 28, 2025 16:29:08.008286953 CEST	45508	5060	192.168.2.13	79.51.28.70	NICK [OSX\|MIPS]4YmC USER 4YmC localhost localhost :4YmC
Apr 28, 2025 16:29:14.185173035 CEST	45510	5060	192.168.2.13	79.51.28.70	NICK [OSX\|MIPS]4YmC USER 4YmC localhost localhost :4YmC
Apr 28, 2025 16:29:20.352305889 CEST	45512	5060	192.168.2.13	79.51.28.70	NICK [OSX\|MIPS]4YmC USER 4YmC localhost localhost :4YmC
Apr 28, 2025 16:29:27.376775980 CEST	45514	5060	192.168.2.13	79.51.28.70	NICK [OSX\|MIPS]4YmC USER 4YmC localhost localhost :4YmC
Apr 28, 2025 16:29:33.989712954 CEST	45516	5060	192.168.2.13	79.51.28.70	NICK [OSX\|MIPS]4YmC USER 4YmC localhost localhost :4YmC
Apr 28, 2025 16:29:40.634690046 CEST	45518	5060	192.168.2.13	79.51.28.70	NICK [OSX\|MIPS]4YmC USER 4YmC localhost localhost :4YmC
Apr 28, 2025 16:29:42.079550028 CEST	45518	5060	192.168.2.13	79.51.28.70	NICK [OSX\|MIPS]4YmC USER 4YmC localhost localhost :4YmC
Apr 28, 2025 16:29:49.200376034 CEST	45520	5060	192.168.2.13	79.51.28.70	NICK [OSX\|MIPS]4YmC USER 4YmC localhost localhost :4YmC
Apr 28, 2025 16:29:55.323709965 CEST	45522	5060	192.168.2.13	79.51.28.70	NICK [OSX\|MIPS]4YmC USER 4YmC localhost localhost :4YmC
Apr 28, 2025 16:30:02.339006901 CEST	45524	5060	192.168.2.13	79.51.28.70	NICK [OSX\|MIPS]4YmC USER 4YmC localhost localhost :4YmC
Apr 28, 2025 16:30:03.327577114 CEST	45524	5060	192.168.2.13	79.51.28.70	NICK [OSX\|MIPS]4YmC USER 4YmC localhost localhost :4YmC

System Behavior

Analysis Process: mqms.elf PID: 5435, Parent PID: 5357

General

Start time (UTC):	14:28:01
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	/tmp/mqms.elf
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

File Activities

File Opened

File Read

Process Activities

Process Forked

Thread Sleep

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: mqms.elf PID: 5437, Parent PID: 5435

General

Start time (UTC):	14:28:01
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Process Activities

Process Forked

Thread Sleep

Chronological Activities

Analysis Process: mqms.elf PID: 5443, Parent PID: 5437

General

Start time (UTC):	14:28:01
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Process Activities

Thread Sleep

Chronological Activities

Analysis Process: mqms.elf PID: 5444, Parent PID: 5437

General

Start time (UTC):	14:28:01
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

File Activities

File Opened

Process Activities

Thread Sleep

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: mqms.elf PID: 5446, Parent PID: 5437

General

Start time (UTC):	14:28:01
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 5446, Parent PID: 5437

General

Start time (UTC):	14:28:01
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 902i13 \|\| busybox pkill -9 902i13"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 5449, Parent PID: 5446

General

Start time (UTC):	14:28:01
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: pkill PID: 5449, Parent PID: 5446

General

Start time (UTC):	14:28:01
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 902i13
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

File Activities

File Opened

File Read

Directory Enumerated

Chronological Activities

Analysis Process: sh PID: 5450, Parent PID: 5446

General

Start time (UTC):	14:28:03
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: busybox PID: 5450, Parent PID: 5446

General

Start time (UTC):	14:28:03
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 902i13
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Process Activities

Prctl Requested

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: mqms.elf PID: 5451, Parent PID: 5437

General

Start time (UTC):	14:28:04
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 5451, Parent PID: 5437

General

Start time (UTC):	14:28:04
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 BzSxLxBxeY \|\| busybox pkill -9 BzSxLxBxeY"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 5453, Parent PID: 5451

General

Start time (UTC):	14:28:04
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: pkill PID: 5453, Parent PID: 5451

General

Start time (UTC):	14:28:04
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 BzSxLxBxeY
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

File Activities

File Opened

File Read

Directory Enumerated

Chronological Activities

Analysis Process: sh PID: 5456, Parent PID: 5451

General

Start time (UTC):	14:28:05
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: busybox PID: 5456, Parent PID: 5451

General

Start time (UTC):	14:28:05
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 BzSxLxBxeY
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Process Activities

Prctl Requested

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: mqms.elf PID: 5457, Parent PID: 5437

General

Start time (UTC):	14:28:06
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 5457, Parent PID: 5437

General

Start time (UTC):	14:28:06
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 HOHO-LUGO7 \|\| busybox pkill -9 HOHO-LUGO7"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 5459, Parent PID: 5457

General

Start time (UTC):	14:28:06
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: pkill PID: 5459, Parent PID: 5457

General

Start time (UTC):	14:28:06
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 HOHO-LUGO7
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

File Activities

File Opened

File Read

Directory Enumerated

Chronological Activities

Analysis Process: sh PID: 5466, Parent PID: 5457

General

Start time (UTC):	14:28:07
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: busybox PID: 5466, Parent PID: 5457

General

Start time (UTC):	14:28:07
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 HOHO-LUGO7
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Process Activities

Prctl Requested

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: mqms.elf PID: 5467, Parent PID: 5437

General

Start time (UTC):	14:28:08
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 5467, Parent PID: 5437

General

Start time (UTC):	14:28:08
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 HOHO-U79OL \|\| busybox pkill -9 HOHO-U79OL"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 5469, Parent PID: 5467

General

Start time (UTC):	14:28:08
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: pkill PID: 5469, Parent PID: 5467

General

Start time (UTC):	14:28:08
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 HOHO-U79OL
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

File Activities

File Opened

File Read

Directory Enumerated

Chronological Activities

Analysis Process: sh PID: 5470, Parent PID: 5467

General

Start time (UTC):	14:28:09
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: busybox PID: 5470, Parent PID: 5467

General

Start time (UTC):	14:28:09
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 HOHO-U79OL
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Process Activities

Prctl Requested

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: mqms.elf PID: 5473, Parent PID: 5437

General

Start time (UTC):	14:28:10
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 5473, Parent PID: 5437

General

Start time (UTC):	14:28:10
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 JuYfouyf87 \|\| busybox pkill -9 JuYfouyf87"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 5479, Parent PID: 5473

General

Start time (UTC):	14:28:10
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: pkill PID: 5479, Parent PID: 5473

General

Start time (UTC):	14:28:10
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 JuYfouyf87
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

File Activities

File Opened

File Read

Directory Enumerated

Chronological Activities

Analysis Process: sh PID: 5480, Parent PID: 5473

General

Start time (UTC):	14:28:12
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: busybox PID: 5480, Parent PID: 5473

General

Start time (UTC):	14:28:12
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 JuYfouyf87
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Process Activities

Prctl Requested

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: mqms.elf PID: 5481, Parent PID: 5437

General

Start time (UTC):	14:28:13
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 5481, Parent PID: 5437

General

Start time (UTC):	14:28:13
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 5486, Parent PID: 5481

General

Start time (UTC):	14:28:13
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: pkill PID: 5486, Parent PID: 5481

General

Start time (UTC):	14:28:13
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeR69xd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

File Activities

File Opened

File Read

Directory Enumerated

Chronological Activities

Analysis Process: sh PID: 5487, Parent PID: 5481

General

Start time (UTC):	14:28:14
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: busybox PID: 5487, Parent PID: 5481

General

Start time (UTC):	14:28:14
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeR69xd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Process Activities

Prctl Requested

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: mqms.elf PID: 5490, Parent PID: 5437

General

Start time (UTC):	14:28:15
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 5490, Parent PID: 5437

General

Start time (UTC):	14:28:15
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 5492, Parent PID: 5490

General

Start time (UTC):	14:28:15
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: pkill PID: 5492, Parent PID: 5490

General

Start time (UTC):	14:28:15
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 SO190Ij1X
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

File Activities

File Opened

File Read

Directory Enumerated

Chronological Activities

Analysis Process: sh PID: 5493, Parent PID: 5490

General

Start time (UTC):	14:28:17
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: busybox PID: 5493, Parent PID: 5490

General

Start time (UTC):	14:28:17
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SO190Ij1X
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Process Activities

Prctl Requested

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: mqms.elf PID: 5494, Parent PID: 5437

General

Start time (UTC):	14:28:18
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 5494, Parent PID: 5437

General

Start time (UTC):	14:28:18
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 LOLKIKEEEDDE \|\| busybox pkill -9 LOLKIKEEEDDE"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 5499, Parent PID: 5494

General

Start time (UTC):	14:28:18
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: pkill PID: 5499, Parent PID: 5494

General

Start time (UTC):	14:28:18
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 LOLKIKEEEDDE
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

File Activities

File Opened

File Read

Directory Enumerated

Chronological Activities

Analysis Process: sh PID: 5500, Parent PID: 5494

General

Start time (UTC):	14:28:19
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: busybox PID: 5500, Parent PID: 5494

General

Start time (UTC):	14:28:19
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 LOLKIKEEEDDE
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Process Activities

Prctl Requested

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: mqms.elf PID: 5503, Parent PID: 5437

General

Start time (UTC):	14:28:20
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 5503, Parent PID: 5437

General

Start time (UTC):	14:28:20
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ekjheory98e \|\| busybox pkill -9 ekjheory98e"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 5509, Parent PID: 5503

General

Start time (UTC):	14:28:20
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: pkill PID: 5509, Parent PID: 5503

General

Start time (UTC):	14:28:20
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 ekjheory98e
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

File Activities

File Opened

File Read

Directory Enumerated

Chronological Activities

Analysis Process: sh PID: 5526, Parent PID: 5503

General

Start time (UTC):	14:28:22
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: busybox PID: 5526, Parent PID: 5503

General

Start time (UTC):	14:28:22
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ekjheory98e
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Process Activities

Prctl Requested

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: mqms.elf PID: 5527, Parent PID: 5437

General

Start time (UTC):	14:28:23
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 5527, Parent PID: 5437

General

Start time (UTC):	14:28:23
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scansh4 \|\| busybox pkill -9 scansh4"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 5529, Parent PID: 5527

General

Start time (UTC):	14:28:23
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: pkill PID: 5529, Parent PID: 5527

General

Start time (UTC):	14:28:23
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 scansh4
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

File Activities

File Opened

File Read

Directory Enumerated

Chronological Activities

Analysis Process: sh PID: 5530, Parent PID: 5527

General

Start time (UTC):	14:28:24
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: busybox PID: 5530, Parent PID: 5527

General

Start time (UTC):	14:28:24
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scansh4
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Process Activities

Prctl Requested

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: mqms.elf PID: 5533, Parent PID: 5437

General

Start time (UTC):	14:28:25
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 5533, Parent PID: 5437

General

Start time (UTC):	14:28:25
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MDMA \|\| busybox pkill -9 MDMA"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 5535, Parent PID: 5533

General

Start time (UTC):	14:28:25
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: pkill PID: 5535, Parent PID: 5533

General

Start time (UTC):	14:28:25
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 MDMA
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

File Activities

File Opened

File Read

Directory Enumerated

Chronological Activities

Analysis Process: sh PID: 5536, Parent PID: 5533

General

Start time (UTC):	14:28:26
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: busybox PID: 5536, Parent PID: 5533

General

Start time (UTC):	14:28:26
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MDMA
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Process Activities

Prctl Requested

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: mqms.elf PID: 5537, Parent PID: 5437

General

Start time (UTC):	14:28:27
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 5537, Parent PID: 5437

General

Start time (UTC):	14:28:27
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 fdevalvex \|\| busybox pkill -9 fdevalvex"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 5542, Parent PID: 5537

General

Start time (UTC):	14:28:27
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: pkill PID: 5542, Parent PID: 5537

General

Start time (UTC):	14:28:27
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 fdevalvex
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

File Activities

File Opened

File Read

Directory Enumerated

Chronological Activities

Analysis Process: sh PID: 5543, Parent PID: 5537

General

Start time (UTC):	14:28:29
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: busybox PID: 5543, Parent PID: 5537

General

Start time (UTC):	14:28:29
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 fdevalvex
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Process Activities

Prctl Requested

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: mqms.elf PID: 5546, Parent PID: 5437

General

Start time (UTC):	14:28:30
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 5546, Parent PID: 5437

General

Start time (UTC):	14:28:30
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scanspc \|\| busybox pkill -9 scanspc"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 5551, Parent PID: 5546

General

Start time (UTC):	14:28:30
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: pkill PID: 5551, Parent PID: 5546

General

Start time (UTC):	14:28:30
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 scanspc
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

File Activities

File Opened

File Read

Directory Enumerated

Chronological Activities

Analysis Process: sh PID: 5552, Parent PID: 5546

General

Start time (UTC):	14:28:31
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: busybox PID: 5552, Parent PID: 5546

General

Start time (UTC):	14:28:31
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scanspc
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Process Activities

Prctl Requested

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: mqms.elf PID: 5553, Parent PID: 5437

General

Start time (UTC):	14:28:32
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 5553, Parent PID: 5437

General

Start time (UTC):	14:28:32
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MELTEDNINJAREALZ \|\| busybox pkill -9 MELTEDNINJAREALZ"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 5555, Parent PID: 5553

General

Start time (UTC):	14:28:32
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: pkill PID: 5555, Parent PID: 5553

General

Start time (UTC):	14:28:32
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 MELTEDNINJAREALZ
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

File Activities

File Opened

File Read

Directory Enumerated

Chronological Activities

Analysis Process: sh PID: 5556, Parent PID: 5553

General

Start time (UTC):	14:28:33
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: busybox PID: 5556, Parent PID: 5553

General

Start time (UTC):	14:28:33
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MELTEDNINJAREALZ
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Process Activities

Prctl Requested

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: mqms.elf PID: 5557, Parent PID: 5437

General

Start time (UTC):	14:28:34
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 5557, Parent PID: 5437

General

Start time (UTC):	14:28:34
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 flexsonskids \|\| busybox pkill -9 flexsonskids"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 5559, Parent PID: 5557

General

Start time (UTC):	14:28:34
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: pkill PID: 5559, Parent PID: 5557

General

Start time (UTC):	14:28:34
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 flexsonskids
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: sh PID: 5562, Parent PID: 5557

General

Start time (UTC):	14:28:36
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5562, Parent PID: 5557

General

Start time (UTC):	14:28:36
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 flexsonskids
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5563, Parent PID: 5437

General

Start time (UTC):	14:28:37
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5563, Parent PID: 5437

General

Start time (UTC):	14:28:37
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scanx86 \|\| busybox pkill -9 scanx86"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5565, Parent PID: 5563

General

Start time (UTC):	14:28:37
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5565, Parent PID: 5563

General

Start time (UTC):	14:28:37
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 scanx86
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5566, Parent PID: 5563

General

Start time (UTC):	14:28:38
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5566, Parent PID: 5563

General

Start time (UTC):	14:28:38
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scanx86
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5567, Parent PID: 5437

General

Start time (UTC):	14:28:39
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5567, Parent PID: 5437

General

Start time (UTC):	14:28:39
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MISAKI-U79OL \|\| busybox pkill -9 MISAKI-U79OL"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5573, Parent PID: 5567

General

Start time (UTC):	14:28:39
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5573, Parent PID: 5567

General

Start time (UTC):	14:28:39
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 MISAKI-U79OL
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5576, Parent PID: 5567

General

Start time (UTC):	14:28:42
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5576, Parent PID: 5567

General

Start time (UTC):	14:28:42
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MISAKI-U79OL
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5577, Parent PID: 5437

General

Start time (UTC):	14:28:43
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5577, Parent PID: 5437

General

Start time (UTC):	14:28:43
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 foAxi102kxe \|\| busybox pkill -9 foAxi102kxe"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5581, Parent PID: 5577

General

Start time (UTC):	14:28:43
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5581, Parent PID: 5577

General

Start time (UTC):	14:28:43
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 foAxi102kxe
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5583, Parent PID: 5577

General

Start time (UTC):	14:28:44
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5583, Parent PID: 5577

General

Start time (UTC):	14:28:44
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 foAxi102kxe
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5586, Parent PID: 5437

General

Start time (UTC):	14:28:45
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5586, Parent PID: 5437

General

Start time (UTC):	14:28:45
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 swodjwodjwoj \|\| busybox pkill -9 swodjwodjwoj"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5591, Parent PID: 5586

General

Start time (UTC):	14:28:45
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5591, Parent PID: 5586

General

Start time (UTC):	14:28:45
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 swodjwodjwoj
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5592, Parent PID: 5586

General

Start time (UTC):	14:28:47
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5592, Parent PID: 5586

General

Start time (UTC):	14:28:47
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 swodjwodjwoj
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5593, Parent PID: 5437

General

Start time (UTC):	14:28:48
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5593, Parent PID: 5437

General

Start time (UTC):	14:28:48
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MmKiy7f87l \|\| busybox pkill -9 MmKiy7f87l"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5598, Parent PID: 5593

General

Start time (UTC):	14:28:48
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5598, Parent PID: 5593

General

Start time (UTC):	14:28:48
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 MmKiy7f87l
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5601, Parent PID: 5593

General

Start time (UTC):	14:28:50
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5601, Parent PID: 5593

General

Start time (UTC):	14:28:50
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MmKiy7f87l
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5605, Parent PID: 5437

General

Start time (UTC):	14:28:51
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5605, Parent PID: 5437

General

Start time (UTC):	14:28:51
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 freecookiex86 \|\| busybox pkill -9 freecookiex86"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5611, Parent PID: 5605

General

Start time (UTC):	14:28:51
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5611, Parent PID: 5605

General

Start time (UTC):	14:28:51
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 freecookiex86
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5612, Parent PID: 5605

General

Start time (UTC):	14:28:53
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5612, Parent PID: 5605

General

Start time (UTC):	14:28:53
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 freecookiex86
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5613, Parent PID: 5437

General

Start time (UTC):	14:28:54
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5613, Parent PID: 5437

General

Start time (UTC):	14:28:54
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 sysgpu \|\| busybox pkill -9 sysgpu"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5615, Parent PID: 5613

General

Start time (UTC):	14:28:54
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5615, Parent PID: 5613

General

Start time (UTC):	14:28:54
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 sysgpu
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5618, Parent PID: 5613

General

Start time (UTC):	14:28:57
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5618, Parent PID: 5613

General

Start time (UTC):	14:28:57
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 sysgpu
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5619, Parent PID: 5437

General

Start time (UTC):	14:28:58
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5619, Parent PID: 5437

General

Start time (UTC):	14:28:58
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5621, Parent PID: 5619

General

Start time (UTC):	14:28:58
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5621, Parent PID: 5619

General

Start time (UTC):	14:28:58
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeR69xd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5624, Parent PID: 5619

General

Start time (UTC):	14:29:00
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5624, Parent PID: 5619

General

Start time (UTC):	14:29:00
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeR69xd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5625, Parent PID: 5437

General

Start time (UTC):	14:29:01
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5625, Parent PID: 5437

General

Start time (UTC):	14:29:01
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 frgege \|\| busybox pkill -9 frgege"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5627, Parent PID: 5625

General

Start time (UTC):	14:29:01
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5627, Parent PID: 5625

General

Start time (UTC):	14:29:01
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 frgege
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5628, Parent PID: 5625

General

Start time (UTC):	14:29:02
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5628, Parent PID: 5625

General

Start time (UTC):	14:29:02
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 frgege
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5629, Parent PID: 5437

General

Start time (UTC):	14:29:03
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5629, Parent PID: 5437

General

Start time (UTC):	14:29:03
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 sysupdater \|\| busybox pkill -9 sysupdater"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5631, Parent PID: 5629

General

Start time (UTC):	14:29:03
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5631, Parent PID: 5629

General

Start time (UTC):	14:29:03
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 sysupdater
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5634, Parent PID: 5629

General

Start time (UTC):	14:29:05
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5634, Parent PID: 5629

General

Start time (UTC):	14:29:05
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 sysupdater
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5635, Parent PID: 5437

General

Start time (UTC):	14:29:06
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5635, Parent PID: 5437

General

Start time (UTC):	14:29:06
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 0DnAzepd \|\| busybox pkill -9 0DnAzepd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5641, Parent PID: 5635

General

Start time (UTC):	14:29:06
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5641, Parent PID: 5635

General

Start time (UTC):	14:29:06
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 0DnAzepd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5642, Parent PID: 5635

General

Start time (UTC):	14:29:08
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5642, Parent PID: 5635

General

Start time (UTC):	14:29:08
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 0DnAzepd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5643, Parent PID: 5437

General

Start time (UTC):	14:29:09
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5643, Parent PID: 5437

General

Start time (UTC):	14:29:09
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeRD0nks69 \|\| busybox pkill -9 NiGGeRD0nks69"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5645, Parent PID: 5643

General

Start time (UTC):	14:29:09
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5645, Parent PID: 5643

General

Start time (UTC):	14:29:09
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeRD0nks69
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5648, Parent PID: 5643

General

Start time (UTC):	14:29:11
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5648, Parent PID: 5643

General

Start time (UTC):	14:29:11
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeRD0nks69
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5649, Parent PID: 5437

General

Start time (UTC):	14:29:12
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5649, Parent PID: 5437

General

Start time (UTC):	14:29:12
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 frgreu \|\| busybox pkill -9 frgreu"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5654, Parent PID: 5649

General

Start time (UTC):	14:29:12
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5654, Parent PID: 5649

General

Start time (UTC):	14:29:12
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 frgreu
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5655, Parent PID: 5649

General

Start time (UTC):	14:29:13
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5655, Parent PID: 5649

General

Start time (UTC):	14:29:13
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 frgreu
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5656, Parent PID: 5437

General

Start time (UTC):	14:29:14
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5656, Parent PID: 5437

General

Start time (UTC):	14:29:14
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 telnetd \|\| busybox pkill -9 telnetd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5658, Parent PID: 5656

General

Start time (UTC):	14:29:14
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5658, Parent PID: 5656

General

Start time (UTC):	14:29:14
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 telnetd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5661, Parent PID: 5656

General

Start time (UTC):	14:29:17
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5661, Parent PID: 5656

General

Start time (UTC):	14:29:17
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 telnetd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5662, Parent PID: 5437

General

Start time (UTC):	14:29:18
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5662, Parent PID: 5437

General

Start time (UTC):	14:29:18
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 0x766f6964 \|\| busybox pkill -9 0x766f6964"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5664, Parent PID: 5662

General

Start time (UTC):	14:29:18
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5664, Parent PID: 5662

General

Start time (UTC):	14:29:18
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 0x766f6964
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5668, Parent PID: 5662

General

Start time (UTC):	14:29:21
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5668, Parent PID: 5662

General

Start time (UTC):	14:29:21
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 0x766f6964
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5669, Parent PID: 5437

General

Start time (UTC):	14:29:22
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5669, Parent PID: 5437

General

Start time (UTC):	14:29:22
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeRd0nks1337 \|\| busybox pkill -9 NiGGeRd0nks1337"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5671, Parent PID: 5669

General

Start time (UTC):	14:29:22
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5671, Parent PID: 5669

General

Start time (UTC):	14:29:22
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeRd0nks1337
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5672, Parent PID: 5669

General

Start time (UTC):	14:29:24
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5672, Parent PID: 5669

General

Start time (UTC):	14:29:24
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeRd0nks1337
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5675, Parent PID: 5437

General

Start time (UTC):	14:29:25
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5675, Parent PID: 5437

General

Start time (UTC):	14:29:25
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 gaft \|\| busybox pkill -9 gaft"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5677, Parent PID: 5675

General

Start time (UTC):	14:29:25
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5677, Parent PID: 5675

General

Start time (UTC):	14:29:25
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 gaft
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5678, Parent PID: 5675

General

Start time (UTC):	14:29:28
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5678, Parent PID: 5675

General

Start time (UTC):	14:29:28
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 gaft
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5679, Parent PID: 5437

General

Start time (UTC):	14:29:29
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5679, Parent PID: 5437

General

Start time (UTC):	14:29:29
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 urasgbsigboa \|\| busybox pkill -9 urasgbsigboa"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5681, Parent PID: 5679

General

Start time (UTC):	14:29:29
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5681, Parent PID: 5679

General

Start time (UTC):	14:29:29
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 urasgbsigboa
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5684, Parent PID: 5679

General

Start time (UTC):	14:29:30
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5684, Parent PID: 5679

General

Start time (UTC):	14:29:30
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 urasgbsigboa
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5685, Parent PID: 5437

General

Start time (UTC):	14:29:31
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5685, Parent PID: 5437

General

Start time (UTC):	14:29:31
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 120i3UI49 \|\| busybox pkill -9 120i3UI49"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5687, Parent PID: 5685

General

Start time (UTC):	14:29:32
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5687, Parent PID: 5685

General

Start time (UTC):	14:29:32
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 120i3UI49
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5688, Parent PID: 5685

General

Start time (UTC):	14:29:33
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5688, Parent PID: 5685

General

Start time (UTC):	14:29:33
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 120i3UI49
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5689, Parent PID: 5437

General

Start time (UTC):	14:29:34
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5689, Parent PID: 5437

General

Start time (UTC):	14:29:34
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 OaF3 \|\| busybox pkill -9 OaF3"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5691, Parent PID: 5689

General

Start time (UTC):	14:29:34
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5691, Parent PID: 5689

General

Start time (UTC):	14:29:34
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 OaF3
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5694, Parent PID: 5689

General

Start time (UTC):	14:29:36
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5694, Parent PID: 5689

General

Start time (UTC):	14:29:36
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 OaF3
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5695, Parent PID: 5437

General

Start time (UTC):	14:29:37
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5695, Parent PID: 5437

General

Start time (UTC):	14:29:37
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 geae \|\| busybox pkill -9 geae"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5697, Parent PID: 5695

General

Start time (UTC):	14:29:37
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5697, Parent PID: 5695

General

Start time (UTC):	14:29:37
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 geae
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5698, Parent PID: 5695

General

Start time (UTC):	14:29:40
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5698, Parent PID: 5695

General

Start time (UTC):	14:29:40
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 geae
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5701, Parent PID: 5437

General

Start time (UTC):	14:29:41
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5701, Parent PID: 5437

General

Start time (UTC):	14:29:41
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 vaiolmao \|\| busybox pkill -9 vaiolmao"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5707, Parent PID: 5701

General

Start time (UTC):	14:29:41
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5707, Parent PID: 5701

General

Start time (UTC):	14:29:41
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 vaiolmao
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5708, Parent PID: 5701

General

Start time (UTC):	14:29:42
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5708, Parent PID: 5701

General

Start time (UTC):	14:29:42
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 vaiolmao
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5709, Parent PID: 5437

General

Start time (UTC):	14:29:43
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5709, Parent PID: 5437

General

Start time (UTC):	14:29:43
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 123123a \|\| busybox pkill -9 123123a"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5711, Parent PID: 5709

General

Start time (UTC):	14:29:43
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5711, Parent PID: 5709

General

Start time (UTC):	14:29:43
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 123123a
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5714, Parent PID: 5709

General

Start time (UTC):	14:29:45
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5714, Parent PID: 5709

General

Start time (UTC):	14:29:45
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 123123a
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5716, Parent PID: 5437

General

Start time (UTC):	14:29:46
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5716, Parent PID: 5437

General

Start time (UTC):	14:29:46
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 Ofurain0n4H34D \|\| busybox pkill -9 Ofurain0n4H34D"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5721, Parent PID: 5716

General

Start time (UTC):	14:29:46
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5721, Parent PID: 5716

General

Start time (UTC):	14:29:46
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 Ofurain0n4H34D
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5722, Parent PID: 5716

General

Start time (UTC):	14:29:48
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5722, Parent PID: 5716

General

Start time (UTC):	14:29:48
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 Ofurain0n4H34D
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5723, Parent PID: 5437

General

Start time (UTC):	14:29:49
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5723, Parent PID: 5437

General

Start time (UTC):	14:29:49
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggTrex \|\| busybox pkill -9 ggTrex"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5730, Parent PID: 5723

General

Start time (UTC):	14:29:50
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5730, Parent PID: 5723

General

Start time (UTC):	14:29:50
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggTrex
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5734, Parent PID: 5723

General

Start time (UTC):	14:29:51
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5734, Parent PID: 5723

General

Start time (UTC):	14:29:51
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggTrex
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5735, Parent PID: 5437

General

Start time (UTC):	14:29:53
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5735, Parent PID: 5437

General

Start time (UTC):	14:29:53
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 wasads \|\| busybox pkill -9 wasads"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5737, Parent PID: 5735

General

Start time (UTC):	14:29:53
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5737, Parent PID: 5735

General

Start time (UTC):	14:29:53
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 wasads
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5740, Parent PID: 5735

General

Start time (UTC):	14:29:55
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5740, Parent PID: 5735

General

Start time (UTC):	14:29:55
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 wasads
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5741, Parent PID: 5437

General

Start time (UTC):	14:29:56
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5741, Parent PID: 5437

General

Start time (UTC):	14:29:56
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1293194hjXD \|\| busybox pkill -9 1293194hjXD"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5747, Parent PID: 5741

General

Start time (UTC):	14:29:56
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5747, Parent PID: 5741

General

Start time (UTC):	14:29:56
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 1293194hjXD
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5748, Parent PID: 5741

General

Start time (UTC):	14:29:58
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5748, Parent PID: 5741

General

Start time (UTC):	14:29:58
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1293194hjXD
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5749, Parent PID: 5437

General

Start time (UTC):	14:29:59
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5749, Parent PID: 5437

General

Start time (UTC):	14:29:59
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 OthLaLosn \|\| busybox pkill -9 OthLaLosn"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5751, Parent PID: 5749

General

Start time (UTC):	14:29:59
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5751, Parent PID: 5749

General

Start time (UTC):	14:29:59
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 OthLaLosn
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5754, Parent PID: 5749

General

Start time (UTC):	14:30:01
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5754, Parent PID: 5749

General

Start time (UTC):	14:30:01
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 OthLaLosn
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5755, Parent PID: 5437

General

Start time (UTC):	14:30:02
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5755, Parent PID: 5437

General

Start time (UTC):	14:30:02
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggt \|\| busybox pkill -9 ggt"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5760, Parent PID: 5755

General

Start time (UTC):	14:30:02
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5760, Parent PID: 5755

General

Start time (UTC):	14:30:02
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggt
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5761, Parent PID: 5755

General

Start time (UTC):	14:30:04
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5761, Parent PID: 5755

General

Start time (UTC):	14:30:04
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggt
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: mqms.elf PID: 5764, Parent PID: 5437

General

Start time (UTC):	14:30:05
Start date (UTC):	28/04/2025
Path:	/tmp/mqms.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Analysis Process: sh PID: 5764, Parent PID: 5437

General

Start time (UTC):	14:30:05
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	sh -c "pkill -9 wget-log \|\| busybox pkill -9 wget-log"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5766, Parent PID: 5764

General

Start time (UTC):	14:30:05
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5766, Parent PID: 5764

General

Start time (UTC):	14:30:05
Start date (UTC):	28/04/2025
Path:	/usr/bin/pkill
Arguments:	pkill -9 wget-log
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5767, Parent PID: 5764

General

Start time (UTC):	14:30:06
Start date (UTC):	28/04/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5767, Parent PID: 5764

General

Start time (UTC):	14:30:06
Start date (UTC):	28/04/2025
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 wget-log
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.
Tactics:	Credential Access
Data Sources:	Application Log: Application Log Content, Command: Command Execution, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report mqms.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

IRC Packets

System Behavior

Analysis Process: mqms.elf PID: 5435, Parent PID: 5357

General

File Activities

File Opened

File Read

Process Activities

Process Forked

Thread Sleep

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: mqms.elf PID: 5437, Parent PID: 5435

General

Process Activities

Process Forked

Thread Sleep

Linux Analysis Report
mqms.elf