Source: 6236.1.00007fe1f8017000.00007fe1f8025000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 6236.1.00007fe1f8017000.00007fe1f8025000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 6230.1.00007fe1f8017000.00007fe1f8025000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 6230.1.00007fe1f8017000.00007fe1f8025000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 6234.1.00007fe1f8017000.00007fe1f8025000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 6234.1.00007fe1f8017000.00007fe1f8025000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: Process Memory Space: TvhJo1pOSe PID: 6230, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: Process Memory Space: TvhJo1pOSe PID: 6230, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: Process Memory Space: TvhJo1pOSe PID: 6234, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: Process Memory Space: TvhJo1pOSe PID: 6234, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: Process Memory Space: TvhJo1pOSe PID: 6236, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: Process Memory Space: TvhJo1pOSe PID: 6236, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 2018, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 2077, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 2078, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 2079, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 2080, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 2083, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 2084, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 2114, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 2156, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 6236, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 6243, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 6244, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 6245, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 6246, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 6247, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 6248, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 6267, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 6277, result: successful |
Source: 6236.1.00007fe1f8017000.00007fe1f8025000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 6236.1.00007fe1f8017000.00007fe1f8025000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 6230.1.00007fe1f8017000.00007fe1f8025000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 6230.1.00007fe1f8017000.00007fe1f8025000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 6234.1.00007fe1f8017000.00007fe1f8025000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 6234.1.00007fe1f8017000.00007fe1f8025000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: Process Memory Space: TvhJo1pOSe PID: 6230, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: TvhJo1pOSe PID: 6230, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: Process Memory Space: TvhJo1pOSe PID: 6234, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: TvhJo1pOSe PID: 6234, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: Process Memory Space: TvhJo1pOSe PID: 6236, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: TvhJo1pOSe PID: 6236, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 2018, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 2077, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 2078, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 2079, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 2080, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 2083, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 2084, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 2114, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 2156, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 6236, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 6243, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 6244, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 6245, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 6246, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 6247, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 6248, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 6267, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | SIGKILL sent: pid: 6277, result: successful |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/6236/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1582/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/2033/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/2275/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/3088/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/6191/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/6192/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1612/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1579/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1699/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1335/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1698/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/2028/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1334/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1576/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/2302/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/3236/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/2025/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/2146/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/910/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/912/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/517/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/759/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/2307/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/918/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/6243/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/6245/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/6244/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/6247/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/6246/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1594/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/2285/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/2281/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1349/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1623/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/761/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1622/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/884/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1983/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/2038/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1344/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1465/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1586/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1463/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/2156/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/800/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/801/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1629/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/6239/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1627/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1900/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/3021/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/491/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/2294/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/2050/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1877/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/772/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1633/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1599/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1632/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/774/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1477/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/654/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/896/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1476/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1872/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/2048/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/655/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1475/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/2289/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/656/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/777/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/657/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/4466/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/658/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/4467/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/6248/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/4468/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/4469/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/4502/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/419/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/936/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1639/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1638/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/2208/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/2180/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/6267/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1809/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1494/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1890/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/2063/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/2062/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1888/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1886/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/420/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1489/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/785/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1642/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/788/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/667/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/789/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/1648/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/6277/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/4497/cmdline |
Source: /tmp/TvhJo1pOSe (PID: 6233) | File opened: /proc/6158/cmdline |