Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: unknown |
TCP traffic detected without corresponding DNS query: 37.221.93.146 |
Source: 5568.1.00007f9adc400000.00007f9adc411000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 5568.1.00007f9adc400000.00007f9adc411000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 5573.1.00007f9adc400000.00007f9adc411000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 5573.1.00007f9adc400000.00007f9adc411000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 5571.1.00007f9adc400000.00007f9adc411000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 5571.1.00007f9adc400000.00007f9adc411000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: Process Memory Space: na.elf PID: 5568, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: Process Memory Space: na.elf PID: 5568, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: Process Memory Space: na.elf PID: 5571, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: Process Memory Space: na.elf PID: 5571, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: Process Memory Space: na.elf PID: 5573, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: Process Memory Space: na.elf PID: 5573, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 3129, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 3184, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 3187, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 3188, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 3189, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 3190, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 3193, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 3207, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 3215, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 3235, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 5573, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 5583, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 5584, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 5585, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 5586, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 5587, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 5588, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 5606, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 3129, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 3184, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 3187, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 3188, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 3189, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 3190, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 3193, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 3207, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 3215, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 3235, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 5573, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 5583, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 5584, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 5585, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 5586, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 5587, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 5588, result: successful |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
SIGKILL sent: pid: 5606, result: successful |
Jump to behavior |
Source: 5568.1.00007f9adc400000.00007f9adc411000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 5568.1.00007f9adc400000.00007f9adc411000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 5573.1.00007f9adc400000.00007f9adc411000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 5573.1.00007f9adc400000.00007f9adc411000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 5571.1.00007f9adc400000.00007f9adc411000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 5571.1.00007f9adc400000.00007f9adc411000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: Process Memory Space: na.elf PID: 5568, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: na.elf PID: 5568, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: Process Memory Space: na.elf PID: 5571, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: na.elf PID: 5571, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: Process Memory Space: na.elf PID: 5573, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: na.elf PID: 5573, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5583) |
Directory: /home/saturnino/.Xdefaults-galassia |
Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5584) |
Directory: /home/saturnino/.Xdefaults-galassia |
Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5585) |
Directory: /home/saturnino/.Xdefaults-galassia |
Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5586) |
Directory: /home/saturnino/.Xdefaults-galassia |
Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5587) |
Directory: /home/saturnino/.Xdefaults-galassia |
Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5587) |
Directory: /home/saturnino/.cache |
Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5587) |
Directory: /home/saturnino/.local |
Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5587) |
Directory: /home/saturnino/.config |
Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5588) |
Directory: /home/saturnino/.Xdefaults-galassia |
Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5606) |
Directory: /home/saturnino/.cache |
Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5606) |
Directory: /home/saturnino/.local |
Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5606) |
Directory: /home/saturnino/.config |
Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5606) |
Directory: /home/saturnino/.config |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3760/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3761/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/2672/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/1583/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3244/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3120/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3361/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3759/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3239/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/1577/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/1610/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/512/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/1299/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3235/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/514/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3872/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/519/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/2946/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/917/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3758/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/5553/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/5554/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3134/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/1593/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3011/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3094/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3406/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/1589/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3129/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/1588/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3402/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3125/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3246/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3245/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/767/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/800/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/888/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/801/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/769/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/803/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/5702/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/806/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/807/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/928/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/2956/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3420/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/490/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3142/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/1635/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/1633/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/1599/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3139/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/1873/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/1630/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3412/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/657/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/658/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/659/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/418/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/419/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/1639/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/1638/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/5573/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3673/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3398/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/1371/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3392/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/780/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/660/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/661/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/782/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/1369/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3304/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3425/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/785/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/1642/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/940/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/941/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/1640/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3147/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3268/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/1364/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/548/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/1647/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/5606/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/5583/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/5584/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/5585/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/5586/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/5587/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/2991/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/1383/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/1382/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/1381/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/791/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/671/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/794/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/1655/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/2986/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/795/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/674/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/1653/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/797/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/2983/cmdline |
Jump to behavior |
Source: /tmp/na.elf (PID: 5570) |
File opened: /proc/3159/cmdline |
Jump to behavior |
Source: na.elf, 5568.1.00007ffe7e18c000.00007ffe7e1ad000.rw-.sdmp, na.elf, 5571.1.00007ffe7e18c000.00007ffe7e1ad000.rw-.sdmp, na.elf, 5573.1.00007ffe7e18c000.00007ffe7e1ad000.rw-.sdmp |
Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf |
Source: na.elf, 5568.1.00005576bcec8000.00005576bcf4f000.rw-.sdmp, na.elf, 5571.1.00005576bcec8000.00005576bcf4f000.rw-.sdmp, na.elf, 5573.1.00005576bcec8000.00005576bcf4f000.rw-.sdmp |
Binary or memory string: vU!/etc/qemu-binfmt/mips |
Source: na.elf, 5568.1.00005576bcec8000.00005576bcf4f000.rw-.sdmp, na.elf, 5571.1.00005576bcec8000.00005576bcf4f000.rw-.sdmp, na.elf, 5573.1.00005576bcec8000.00005576bcf4f000.rw-.sdmp |
Binary or memory string: /etc/qemu-binfmt/mips |
Source: na.elf, 5568.1.00007ffe7e18c000.00007ffe7e1ad000.rw-.sdmp, na.elf, 5571.1.00007ffe7e18c000.00007ffe7e1ad000.rw-.sdmp, na.elf, 5573.1.00007ffe7e18c000.00007ffe7e1ad000.rw-.sdmp |
Binary or memory string: /usr/bin/qemu-mips |