IOC Report
yakuza.arm6.elf

loading gif

Processes

Path
Cmdline
Malicious
/tmp/yakuza.arm6.elf
/tmp/yakuza.arm6.elf
/tmp/yakuza.arm6.elf
-
/tmp/yakuza.arm6.elf
-
/tmp/yakuza.arm6.elf
-
/tmp/yakuza.arm6.elf
-
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 902i13 || busybox pkill -9 902i13"
/bin/sh
-
/usr/bin/pkill
pkill -9 902i13
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 902i13
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 BzSxLxBxeY || busybox pkill -9 BzSxLxBxeY"
/bin/sh
-
/usr/bin/pkill
pkill -9 BzSxLxBxeY
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 BzSxLxBxeY
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 HOHO-LUGO7 || busybox pkill -9 HOHO-LUGO7"
/bin/sh
-
/usr/bin/pkill
pkill -9 HOHO-LUGO7
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 HOHO-LUGO7
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 HOHO-U79OL || busybox pkill -9 HOHO-U79OL"
/bin/sh
-
/usr/bin/pkill
pkill -9 HOHO-U79OL
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 HOHO-U79OL
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 JuYfouyf87 || busybox pkill -9 JuYfouyf87"
/bin/sh
-
/usr/bin/pkill
pkill -9 JuYfouyf87
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 JuYfouyf87
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"
/bin/sh
-
/usr/bin/pkill
pkill -9 NiGGeR69xd
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 NiGGeR69xd
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 SO190Ij1X || busybox pkill -9 SO190Ij1X"
/bin/sh
-
/usr/bin/pkill
pkill -9 SO190Ij1X
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 SO190Ij1X
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 LOLKIKEEEDDE || busybox pkill -9 LOLKIKEEEDDE"
/bin/sh
-
/usr/bin/pkill
pkill -9 LOLKIKEEEDDE
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 LOLKIKEEEDDE
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 ekjheory98e || busybox pkill -9 ekjheory98e"
/bin/sh
-
/usr/bin/pkill
pkill -9 ekjheory98e
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 ekjheory98e
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 scansh4 || busybox pkill -9 scansh4"
/bin/sh
-
/usr/bin/pkill
pkill -9 scansh4
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 scansh4
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 MDMA || busybox pkill -9 MDMA"
/bin/sh
-
/usr/bin/pkill
pkill -9 MDMA
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 MDMA
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 fdevalvex || busybox pkill -9 fdevalvex"
/bin/sh
-
/usr/bin/pkill
pkill -9 fdevalvex
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 fdevalvex
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 scanspc || busybox pkill -9 scanspc"
/bin/sh
-
/usr/bin/pkill
pkill -9 scanspc
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 scanspc
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 MELTEDNINJAREALZ || busybox pkill -9 MELTEDNINJAREALZ"
/bin/sh
-
/usr/bin/pkill
pkill -9 MELTEDNINJAREALZ
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 MELTEDNINJAREALZ
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 flexsonskids || busybox pkill -9 flexsonskids"
/bin/sh
-
/usr/bin/pkill
pkill -9 flexsonskids
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 flexsonskids
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 scanx86 || busybox pkill -9 scanx86"
/bin/sh
-
/usr/bin/pkill
pkill -9 scanx86
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 scanx86
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 MISAKI-U79OL || busybox pkill -9 MISAKI-U79OL"
/bin/sh
-
/usr/bin/pkill
pkill -9 MISAKI-U79OL
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 MISAKI-U79OL
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 foAxi102kxe || busybox pkill -9 foAxi102kxe"
/bin/sh
-
/usr/bin/pkill
pkill -9 foAxi102kxe
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 foAxi102kxe
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 swodjwodjwoj || busybox pkill -9 swodjwodjwoj"
/bin/sh
-
/usr/bin/pkill
pkill -9 swodjwodjwoj
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 swodjwodjwoj
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 MmKiy7f87l || busybox pkill -9 MmKiy7f87l"
/bin/sh
-
/usr/bin/pkill
pkill -9 MmKiy7f87l
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 MmKiy7f87l
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 freecookiex86 || busybox pkill -9 freecookiex86"
/bin/sh
-
/usr/bin/pkill
pkill -9 freecookiex86
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 freecookiex86
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 sysgpu || busybox pkill -9 sysgpu"
/bin/sh
-
/usr/bin/pkill
pkill -9 sysgpu
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 sysgpu
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"
/bin/sh
-
/usr/bin/pkill
pkill -9 NiGGeR69xd
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 NiGGeR69xd
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 frgege || busybox pkill -9 frgege"
/bin/sh
-
/usr/bin/pkill
pkill -9 frgege
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 frgege
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 sysupdater || busybox pkill -9 sysupdater"
/bin/sh
-
/usr/bin/pkill
pkill -9 sysupdater
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 sysupdater
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 0DnAzepd || busybox pkill -9 0DnAzepd"
/bin/sh
-
/usr/bin/pkill
pkill -9 0DnAzepd
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 0DnAzepd
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 NiGGeRD0nks69 || busybox pkill -9 NiGGeRD0nks69"
/bin/sh
-
/usr/bin/pkill
pkill -9 NiGGeRD0nks69
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 NiGGeRD0nks69
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 frgreu || busybox pkill -9 frgreu"
/bin/sh
-
/usr/bin/pkill
pkill -9 frgreu
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 frgreu
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 telnetd || busybox pkill -9 telnetd"
/bin/sh
-
/usr/bin/pkill
pkill -9 telnetd
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 telnetd
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 0x766f6964 || busybox pkill -9 0x766f6964"
/bin/sh
-
/usr/bin/pkill
pkill -9 0x766f6964
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 0x766f6964
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 NiGGeRd0nks1337 || busybox pkill -9 NiGGeRd0nks1337"
/bin/sh
-
/usr/bin/pkill
pkill -9 NiGGeRd0nks1337
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 NiGGeRd0nks1337
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 gaft || busybox pkill -9 gaft"
/bin/sh
-
/usr/bin/pkill
pkill -9 gaft
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 gaft
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 urasgbsigboa || busybox pkill -9 urasgbsigboa"
/bin/sh
-
/usr/bin/pkill
pkill -9 urasgbsigboa
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 urasgbsigboa
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 120i3UI49 || busybox pkill -9 120i3UI49"
/bin/sh
-
/usr/bin/pkill
pkill -9 120i3UI49
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 120i3UI49
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 OaF3 || busybox pkill -9 OaF3"
/bin/sh
-
/usr/bin/pkill
pkill -9 OaF3
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 OaF3
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 geae || busybox pkill -9 geae"
/bin/sh
-
/usr/bin/pkill
pkill -9 geae
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 geae
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 vaiolmao || busybox pkill -9 vaiolmao"
/bin/sh
-
/usr/bin/pkill
pkill -9 vaiolmao
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 vaiolmao
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 123123a || busybox pkill -9 123123a"
/bin/sh
-
/usr/bin/pkill
pkill -9 123123a
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 123123a
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 Ofurain0n4H34D || busybox pkill -9 Ofurain0n4H34D"
/bin/sh
-
/usr/bin/pkill
pkill -9 Ofurain0n4H34D
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 Ofurain0n4H34D
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 ggTrex || busybox pkill -9 ggTrex"
/bin/sh
-
/usr/bin/pkill
pkill -9 ggTrex
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 ggTrex
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 wasads || busybox pkill -9 wasads"
/bin/sh
-
/usr/bin/pkill
pkill -9 wasads
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 wasads
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 1293194hjXD || busybox pkill -9 1293194hjXD"
/bin/sh
-
/usr/bin/pkill
pkill -9 1293194hjXD
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 1293194hjXD
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 OthLaLosn || busybox pkill -9 OthLaLosn"
/bin/sh
-
/usr/bin/pkill
pkill -9 OthLaLosn
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 OthLaLosn
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 ggt || busybox pkill -9 ggt"
/bin/sh
-
/usr/bin/pkill
pkill -9 ggt
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 ggt
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 wget-log || busybox pkill -9 wget-log"
/bin/sh
-
/usr/bin/pkill
pkill -9 wget-log
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 wget-log
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 1337SoraLOADER || busybox pkill -9 1337SoraLOADER"
/bin/sh
-
/usr/bin/pkill
pkill -9 1337SoraLOADER
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 1337SoraLOADER
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 SAIAKINA || busybox pkill -9 SAIAKINA"
/bin/sh
-
/usr/bin/pkill
pkill -9 SAIAKINA
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 SAIAKINA
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 ggtq || busybox pkill -9 ggtq"
/bin/sh
-
/usr/bin/pkill
pkill -9 ggtq
/bin/sh
-
/usr/bin/busybox
busybox pkill -9 ggtq
/tmp/yakuza.arm6.elf
-
/bin/sh
sh -c "pkill -9 1378bfp919GRB1Q2 || busybox pkill -9 1378bfp919GRB1Q2"
/bin/sh
-
/usr/bin/pkill
pkill -9 1378bfp919GRB1Q2
There are 287 hidden processes, click here to show them.

URLs

Name
IP
Malicious
https://youtu.be/dQw4w9WgXcQ
unknown
https://youtu.be/dQw4w9WgXcQNever
unknown
http://87.10.220.221/yak.sh;
unknown

Domains

Name
IP
Malicious
daisy.ubuntu.com
162.213.35.24

IPs

IP
Domain
Country
Malicious
194.110.247.46
unknown
unknown
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
7feeadce3000
page read and write
7feeae2b0000
page read and write
5592700f1000
page read and write
7ffcf8bef000
page read and write
5592720ef000
page execute and read and write
7feead449000
page read and write
7feeae94f000
page read and write
7feeae994000
page read and write
7feeae2b0000
page read and write
7feda8045000
page read and write
7feeae94f000
page read and write
7feda8035000
page execute read
7feea8021000
page read and write
5592720ef000
page execute and read and write
7feeae045000
page read and write
7feeadce3000
page read and write
7ffcf8bef000
page read and write
5592700f1000
page read and write
7feeae802000
page read and write
7ffcf8bef000
page read and write
7feeae802000
page read and write
7feeae43f000
page read and write
7feeae43f000
page read and write
7feeadc51000
page read and write
7feda8045000
page read and write
7feea8021000
page read and write
7feea7fff000
page read and write
7feeae802000
page read and write
7feda8035000
page execute read
559272d17000
page read and write
7feeadc51000
page read and write
7feeae045000
page read and write
7feeadce3000
page read and write
7ffcf8bfa000
page execute read
7feda8045000
page read and write
5592720ef000
page execute and read and write
7feeae92b000
page read and write
7feeae43f000
page read and write
7ffcf8bfa000
page execute read
55926fe97000
page execute read
559272106000
page read and write
559272d17000
page read and write
7feeadc51000
page read and write
5592700e8000
page read and write
7feda8048000
page read and write
7feeae94f000
page read and write
7feea7fff000
page read and write
5592700e8000
page read and write
7feda8046000
page read and write
559272d37000
page read and write
7feda803d000
page read and write
7feda8035000
page execute read
559272106000
page read and write
7feeae621000
page read and write
7feeae2d3000
page read and write
7feeae2b0000
page read and write
55926fe97000
page execute read
7feeae2d3000
page read and write
55926fe97000
page execute read
559272106000
page read and write
7feead449000
page read and write
7feeae92b000
page read and write
7feead449000
page read and write
7feeae994000
page read and write
7feda803d000
page read and write
7feea7fff000
page read and write
7feeae621000
page read and write
5592700f1000
page read and write
7feeae994000
page read and write
7feda803d000
page read and write
7feeae92b000
page read and write
7feeae621000
page read and write
5592700e8000
page read and write
7feeae2d3000
page read and write
7ffcf8bfa000
page execute read
7feeae045000
page read and write
7feea8021000
page read and write
559272d17000
page read and write
There are 68 hidden memdumps, click here to show them.