Linux Analysis Report
9IseFevRH6.elf

Overview

General Information

Sample name: 9IseFevRH6.elf
renamed because original name is a hash value
Original sample name: ea5e9f7997234e11e0b0287de4c74278.elf
Analysis ID: 1428403
MD5: ea5e9f7997234e11e0b0287de4c74278
SHA1: ac0e6d85fa6ee5016b760dd90271884b94bed36a
SHA256: de4b8bcc2443ba753603e83ee20d7ba1e35f4d38d9892a67ee5d286f7703f1df
Tags: 32elfmirairenesas
Infos:

Detection

Mirai
Score: 100
Range: 0 - 100
Whitelisted: false

Signatures

Antivirus / Scanner detection for submitted sample
Detected Mirai
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample tries to kill a massive number of system processes
Snort IDS alert for network traffic
Yara detected Mirai
Performs DNS queries to domains with low reputation
Sample tries to kill multiple processes (SIGKILL)
Uses known network protocols on non-standard ports
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample contains strings that are user agent strings indicative of HTTP manipulation
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Mirai Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: 9IseFevRH6.elf Avira: detected
Multi AV Scanner detection for submitted file
Source: 9IseFevRH6.elf ReversingLabs: Detection: 42%
Found strings indicative of a multi-platform dropper
Source: 9IseFevRH6.elf String: /proc/self/exe/proc/proc//comm/root//tmp//dev//bin//etc//boot//usr//mnt//var//lib//lib64/wgettftpcurl/exe/mapsqllwnf-{zy

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.13:58592 -> 186.129.107.136:23
Source: Traffic Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.13:37598 -> 190.173.194.205:23
Source: Traffic Snort IDS: 2023333 ET TROJAN Linux.Mirai Login Attempt (xc3511) 192.168.2.13:39882 -> 220.163.249.40:23
Source: Traffic Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.13:39882 -> 220.163.249.40:23
Source: Traffic Snort IDS: 2027973 ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound 192.168.2.13:57276 -> 222.183.233.154:23
Performs DNS queries to domains with low reputation
Source: DNS query: rootme.xyz
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36656
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36660
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36664
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36676
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36682
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36688
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36694
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36696
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36698
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36708
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41742
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41754
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41762
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41764
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41766
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41768
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41770
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41774
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41778
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41780
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.13:51472 -> 45.128.232.208:33335
Sample listens on a socket
Source: /tmp/9IseFevRH6.elf (PID: 5403) Socket: 127.0.0.1::33337 Jump to behavior
Source: unknown TCP traffic detected without corresponding DNS query: 219.164.111.123
Source: unknown TCP traffic detected without corresponding DNS query: 73.78.116.47
Source: unknown TCP traffic detected without corresponding DNS query: 199.139.211.129
Source: unknown TCP traffic detected without corresponding DNS query: 54.174.61.197
Source: unknown TCP traffic detected without corresponding DNS query: 217.29.60.173
Source: unknown TCP traffic detected without corresponding DNS query: 16.125.174.161
Source: unknown TCP traffic detected without corresponding DNS query: 47.57.112.151
Source: unknown TCP traffic detected without corresponding DNS query: 95.1.5.21
Source: unknown TCP traffic detected without corresponding DNS query: 152.72.24.126
Source: unknown TCP traffic detected without corresponding DNS query: 184.94.108.115
Source: unknown TCP traffic detected without corresponding DNS query: 214.159.136.226
Source: unknown TCP traffic detected without corresponding DNS query: 240.220.189.47
Source: unknown TCP traffic detected without corresponding DNS query: 158.1.230.20
Source: unknown TCP traffic detected without corresponding DNS query: 158.156.225.88
Source: unknown TCP traffic detected without corresponding DNS query: 242.44.225.76
Source: unknown TCP traffic detected without corresponding DNS query: 112.63.30.40
Source: unknown TCP traffic detected without corresponding DNS query: 46.109.70.251
Source: unknown TCP traffic detected without corresponding DNS query: 176.143.243.222
Source: unknown TCP traffic detected without corresponding DNS query: 136.244.106.167
Source: unknown TCP traffic detected without corresponding DNS query: 120.136.75.157
Source: unknown TCP traffic detected without corresponding DNS query: 148.6.176.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.249.165.179
Source: unknown TCP traffic detected without corresponding DNS query: 253.196.202.170
Source: unknown TCP traffic detected without corresponding DNS query: 158.243.71.179
Source: unknown TCP traffic detected without corresponding DNS query: 171.15.113.23
Source: unknown TCP traffic detected without corresponding DNS query: 109.32.158.217
Source: unknown TCP traffic detected without corresponding DNS query: 255.139.219.125
Source: unknown TCP traffic detected without corresponding DNS query: 106.242.53.65
Source: unknown TCP traffic detected without corresponding DNS query: 33.184.218.226
Source: unknown TCP traffic detected without corresponding DNS query: 80.17.91.61
Source: unknown TCP traffic detected without corresponding DNS query: 192.207.232.97
Source: unknown TCP traffic detected without corresponding DNS query: 221.80.27.93
Source: unknown TCP traffic detected without corresponding DNS query: 55.132.114.9
Source: unknown TCP traffic detected without corresponding DNS query: 77.129.102.230
Source: unknown TCP traffic detected without corresponding DNS query: 208.230.62.139
Source: unknown TCP traffic detected without corresponding DNS query: 222.21.120.72
Source: unknown TCP traffic detected without corresponding DNS query: 167.22.167.204
Source: unknown TCP traffic detected without corresponding DNS query: 27.240.0.247
Source: unknown TCP traffic detected without corresponding DNS query: 16.44.77.233
Source: unknown TCP traffic detected without corresponding DNS query: 62.192.234.140
Source: unknown TCP traffic detected without corresponding DNS query: 157.189.105.43
Source: unknown TCP traffic detected without corresponding DNS query: 157.3.203.161
Source: unknown TCP traffic detected without corresponding DNS query: 181.195.11.190
Source: unknown TCP traffic detected without corresponding DNS query: 38.226.23.65
Source: unknown TCP traffic detected without corresponding DNS query: 145.239.183.78
Source: unknown TCP traffic detected without corresponding DNS query: 18.204.123.14
Source: unknown TCP traffic detected without corresponding DNS query: 53.66.207.53
Source: unknown TCP traffic detected without corresponding DNS query: 68.32.90.15
Source: unknown TCP traffic detected without corresponding DNS query: 71.92.140.185
Source: unknown TCP traffic detected without corresponding DNS query: 24.198.196.203
Source: unknown DNS traffic detected: queries for: rootme.xyz

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 9IseFevRH6.elf, type: SAMPLE Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5403.1.00007fb044400000.00007fb04440d000.r-x.sdmp, type: MEMORY Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Sample tries to kill a massive number of system processes
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 2, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 3, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 4, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 5, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 6, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 7, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 8, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 9, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 10, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 11, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 12, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 13, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 14, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 15, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 16, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 17, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 18, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 19, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 20, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 21, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 22, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 23, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 24, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 25, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 26, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 27, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 28, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 29, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 30, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 35, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 77, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 78, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 79, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 80, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 81, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 82, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 83, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 84, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 85, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 86, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 88, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 89, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 91, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 92, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 93, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 94, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 95, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 96, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 97, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 98, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 99, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 100, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 101, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 102, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 103, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 104, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 105, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 106, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 107, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 108, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 109, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 110, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 111, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 112, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 113, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 114, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 115, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 116, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 117, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 118, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 119, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 120, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 121, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 122, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 123, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 124, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 125, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 126, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 127, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 128, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 129, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 130, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 131, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 132, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 134, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 142, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 145, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 158, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 202, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 203, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 204, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 205, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 206, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 207, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 216, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 219, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 220, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 221, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 222, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 223, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 224, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 225, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 226, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 227, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 228, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 229, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 230, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 231, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 232, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 233, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 234, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 235, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 236, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 237, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 238, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 239, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 240, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 241, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 242, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 243, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 244, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 245, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 246, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 247, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 248, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 249, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 250, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 251, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 252, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 253, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 254, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 255, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 256, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 257, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 258, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 259, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 260, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 261, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 262, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 263, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 264, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 265, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 266, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 267, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 268, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 269, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 270, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 271, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 272, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 273, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 274, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 275, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 276, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 291, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 293, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 298, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 299, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 303, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 304, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 306, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 307, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 308, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 309, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 310, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 311, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 312, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 313, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 314, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 315, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 316, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 317, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 318, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 319, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 320, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 321, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 322, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 323, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 324, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 325, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 326, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 327, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 328, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 332, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 347, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 371, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 378, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 418, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 419, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 508, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 518, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 519, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 656, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 657, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 658, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 659, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 672, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 674, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 676, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 678, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 679, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent to PID below 1000: pid: 680, result: successful Jump to behavior
Sample tries to kill multiple processes (SIGKILL)
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 2, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 3, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 4, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 5, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 6, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 7, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 8, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 9, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 10, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 11, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 12, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 13, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 14, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 15, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 16, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 17, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 18, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 19, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 20, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 21, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 22, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 23, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 24, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 25, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 26, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 27, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 28, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 29, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 30, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 35, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 77, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 78, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 79, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 80, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 81, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 82, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 83, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 84, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 85, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 86, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 88, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 89, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 91, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 92, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 93, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 94, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 95, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 96, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 97, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 98, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 99, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 100, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 101, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 102, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 103, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 104, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 105, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 106, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 107, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 108, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 109, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 110, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 111, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 112, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 113, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 114, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 115, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 116, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 117, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 118, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 119, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 120, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 121, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 122, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 123, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 124, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 125, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 126, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 127, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 128, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 129, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 130, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 131, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 132, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 134, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 142, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 145, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 158, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 202, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 203, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 204, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 205, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 206, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 207, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 216, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 219, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 220, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 221, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 222, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 223, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 224, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 225, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 226, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 227, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 228, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 229, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 230, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 231, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 232, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 233, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 234, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 235, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 236, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 237, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 238, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 239, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 240, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 241, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 242, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 243, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 244, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 245, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 246, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 247, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 248, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 249, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 250, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 251, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 252, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 253, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 254, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 255, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 256, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 257, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 258, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 259, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 260, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 261, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 262, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 263, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 264, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 265, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 266, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 267, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 268, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 269, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 270, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 271, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 272, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 273, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 274, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 275, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 276, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 291, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 293, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 298, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 299, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 303, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 304, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 306, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 307, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 308, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 309, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 310, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 311, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 312, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 313, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 314, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 315, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 316, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 317, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 318, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 319, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 320, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 321, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 322, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 323, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 324, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 325, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 326, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 327, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 328, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 332, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 347, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 371, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 378, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 418, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 419, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 508, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 518, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 519, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 656, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 657, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 658, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 659, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 672, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 674, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 676, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 678, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 679, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 680, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 1238, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 1320, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 1648, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 2496, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 3455, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 3708, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 3709, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 3710, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 3711, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 5120, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 5350, result: successful Jump to behavior
Sample has stripped symbol table
Source: ELF static info symbol of initial sample .symtab present: no
Sample tries to kill a process (SIGKILL)
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 2, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 3, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 4, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 5, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 6, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 7, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 8, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 9, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 10, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 11, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 12, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 13, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 14, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 15, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 16, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 17, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 18, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 19, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 20, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 21, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 22, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 23, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 24, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 25, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 26, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 27, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 28, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 29, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 30, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 35, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 77, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 78, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 79, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 80, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 81, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 82, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 83, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 84, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 85, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 86, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 88, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 89, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 91, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 92, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 93, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 94, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 95, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 96, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 97, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 98, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 99, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 100, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 101, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 102, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 103, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 104, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 105, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 106, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 107, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 108, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 109, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 110, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 111, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 112, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 113, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 114, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 115, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 116, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 117, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 118, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 119, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 120, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 121, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 122, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 123, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 124, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 125, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 126, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 127, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 128, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 129, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 130, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 131, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 132, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 134, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 142, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 145, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 158, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 202, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 203, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 204, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 205, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 206, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 207, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 216, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 219, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 220, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 221, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 222, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 223, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 224, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 225, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 226, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 227, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 228, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 229, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 230, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 231, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 232, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 233, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 234, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 235, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 236, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 237, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 238, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 239, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 240, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 241, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 242, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 243, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 244, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 245, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 246, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 247, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 248, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 249, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 250, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 251, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 252, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 253, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 254, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 255, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 256, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 257, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 258, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 259, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 260, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 261, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 262, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 263, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 264, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 265, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 266, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 267, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 268, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 269, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 270, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 271, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 272, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 273, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 274, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 275, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 276, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 291, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 293, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 298, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 299, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 303, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 304, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 306, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 307, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 308, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 309, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 310, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 311, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 312, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 313, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 314, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 315, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 316, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 317, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 318, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 319, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 320, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 321, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 322, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 323, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 324, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 325, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 326, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 327, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 328, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 332, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 347, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 371, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 378, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 418, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 419, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 508, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 518, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 519, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 656, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 657, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 658, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 659, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 672, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 674, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 676, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 678, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 679, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 680, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 1238, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 1320, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 1648, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 2496, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 3455, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 3708, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 3709, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 3710, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 3711, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 5120, result: successful Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) SIGKILL sent: pid: 5350, result: successful Jump to behavior
Yara signature match
Source: 9IseFevRH6.elf, type: SAMPLE Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5403.1.00007fb044400000.00007fb04440d000.r-x.sdmp, type: MEMORY Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: classification engine Classification label: mal100.spre.troj.linELF@0/0@3/0
Enumerates processes within the "proc" file system
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/5387/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/5387/comm Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/5388/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/5388/comm Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/230/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/110/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/231/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/3638/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/3638/comm Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/3759/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/3759/comm Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/111/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/232/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/112/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/233/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/113/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/234/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/114/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/235/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/115/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/236/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/116/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/237/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/117/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/238/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/118/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/239/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/119/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/914/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/914/comm Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/10/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/917/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/917/comm Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/11/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/12/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/13/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/14/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/15/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/16/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/17/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/18/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/19/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/240/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/3095/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/3095/comm Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/120/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/241/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/121/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/242/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/1/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/1/comm Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/122/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/243/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/2/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/123/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/244/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/3/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/124/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/245/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/1588/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/1588/comm Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/125/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/4/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/246/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/126/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/5/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/247/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/127/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/6/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/248/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/128/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/7/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/249/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/129/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/8/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/800/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/800/comm Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/9/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/1906/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/1906/comm Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/802/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/802/comm Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/803/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/803/comm Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/20/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/21/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/22/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/23/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/24/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/25/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/26/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/27/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/28/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/29/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/3420/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/3420/comm Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/1482/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/1482/comm Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/490/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/490/comm Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/1480/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/1480/comm Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/250/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/371/maps Jump to behavior
Source: /tmp/9IseFevRH6.elf (PID: 5405) File opened: /proc/130/maps Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Uses known network protocols on non-standard ports
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36656
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36660
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36664
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36676
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36682
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36688
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36694
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36696
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36698
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 36708
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41742
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41754
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41762
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41764
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41766
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41768
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41770
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41774
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41778
Source: unknown Network traffic detected: HTTP traffic on port 23 -> 41780
Uses the "uname" system call to query kernel version information (possible evasion)
Source: /tmp/9IseFevRH6.elf (PID: 5403) Queries kernel information via 'uname': Jump to behavior
Source: 9IseFevRH6.elf, 5403.1.00007ffc4291c000.00007ffc4293d000.rw-.sdmp Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/9IseFevRH6.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/9IseFevRH6.elf
Source: 9IseFevRH6.elf, 5403.1.00007ffc4291c000.00007ffc4293d000.rw-.sdmp Binary or memory string: /usr/bin/qemu-sh4
Source: 9IseFevRH6.elf, 5403.1.0000558120d72000.0000558120dd5000.rw-.sdmp Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: 9IseFevRH6.elf, 5403.1.0000558120d72000.0000558120dd5000.rw-.sdmp Binary or memory string: /etc/qemu-binfmt/sh4

Stealing of Sensitive Information
barindex
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 9IseFevRH6.elf, type: SAMPLE
Source: Yara match File source: 5403.1.00007fb044400000.00007fb04440d000.r-x.sdmp, type: MEMORY
Sample contains strings that are user agent strings indicative of HTTP manipulation
Source: Initial sample User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
Source: Initial sample User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
Source: Initial sample User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
Source: Initial sample User agent string found: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
Source: Initial sample User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7

Remote Access Functionality
barindex
Detected Mirai
Source: Traffic Snort IDS: ET TROJAN Linux.Mirai Login Attempt (xc3511)
Yara detected Mirai
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 9IseFevRH6.elf, type: SAMPLE
Source: Yara match File source: 5403.1.00007fb044400000.00007fb04440d000.r-x.sdmp, type: MEMORY

No Screenshots

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
186.100.167.11
 unknown Argentina
11315 TelefonicaMovilesArgentinaSAMovistarArgentinaAR false
94.161.59.234
 unknown Italy
24608 WINDTRE-ASIT false
87.17.154.80
 unknown Italy
3269 ASN-IBSNAZIT false
29.22.179.67
 unknown United States
7922 COMCAST-7922US false
197.93.232.115
 unknown South Africa
10474 OPTINETZA false
121.75.50.158
 unknown New Zealand
9500 VODAFONE-TRANSIT-ASVodafoneNZLtdNZ false
253.217.112.173
 unknown Reserved
unknown unknown false
173.45.40.71
 unknown United States
33597 ATLANTIC-METRO-COMMUNICATIONS-II-INCUS false
139.78.108.34
 unknown United States
395421 OKSTATEUS false
48.38.254.183
 unknown United States
2686 ATGS-MMD-ASUS false
112.254.80.156
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
21.68.157.6
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
78.74.7.58
 unknown Sweden
3301 TELIANET-SWEDENTeliaCompanySE false
18.92.224.194
 unknown United States
3 MIT-GATEWAYSUS false
199.220.15.129
 unknown United States
1778 DNIC-AS-01778US false
93.201.51.192
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
196.51.100.145
 unknown South Africa
37518 FIBERGRIDSC false
85.23.76.205
 unknown Finland
16086 DNAFI false
35.233.151.196
 unknown United States
15169 GOOGLEUS false
182.28.247.252
 unknown Indonesia
4795 INDOSATM2-IDINDOSATM2ASNID false
142.230.101.168
 unknown Canada
6327 SHAWCA false
6.25.147.7
 unknown United States
3356 LEVEL3US false
178.117.22.1
 unknown Belgium
6848 TELENET-ASBE false
175.200.190.191
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR false
218.38.131.101
 unknown Korea Republic of
9574 TP-AS-KRTeachersPensionKR false
136.102.165.127
 unknown United States
60311 ONEFMCH false
195.223.150.208
 unknown Italy
3269 ASN-IBSNAZIT false
144.62.227.218
 unknown United States
3410 CORNELLCOLLEGEUS false
26.159.196.200
 unknown United States
7922 COMCAST-7922US false
103.51.120.204
 unknown unknown
134090 XINTEGRATION-AS-APXINTEGRATIONPTYLTDAU false
105.5.146.56
 unknown South Africa
37168 CELL-CZA false
160.218.242.22
 unknown Czech Republic
5610 O2-CZECH-REPUBLICCZ false
209.158.58.82
 unknown United States
701 UUNETUS false
47.1.138.67
 unknown United States
34533 ESAMARA-ASRU false
62.76.28.55
 unknown Russian Federation
57645 LICARD-ASMoscowRU false
208.45.0.31
 unknown United States
209 CENTURYLINK-US-LEGACY-QWESTUS false
183.219.95.157
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
169.74.17.57
 unknown United States
37611 AfrihostZA false
114.255.32.243
 unknown China
4808 CHINA169-BJChinaUnicomBeijingProvinceNetworkCN false
54.137.39.213
 unknown United States
14618 AMAZON-AESUS false
205.117.55.139
 unknown United States
5972 DNIC-ASBLK-05800-06055US false
185.204.53.219
 unknown Netherlands
59931 LEBOL-ASLB false
110.252.87.93
 unknown China
4837 CHINA169-BACKBONECHINAUNICOMChina169BackboneCN false
75.99.251.47
 unknown United States
6128 CABLE-NET-1US false
43.56.164.147
 unknown Japan 4249 LILLY-ASUS false
57.119.174.252
 unknown Belgium
51964 ORANGE-BUSINESS-SERVICES-IPSN-ASNFR false
204.91.202.204
 unknown United States
2828 XO-AS15US false
90.51.99.192
 unknown France
3215 FranceTelecom-OrangeFR false
41.77.181.140
 unknown Algeria
36974 AFNET-ASCI false
186.52.126.217
 unknown Uruguay
6057 AdministracionNacionaldeTelecomunicacionesUY false
110.194.57.97
 unknown China
45069 CNNIC-CTTSDNET-APchinatietongShandongnetCN false
184.125.1.131
 unknown United States
7922 COMCAST-7922US false
190.75.249.42
 unknown Venezuela
8048 CANTVServiciosVenezuelaVE false
244.237.209.218
 unknown Reserved
unknown unknown false
78.25.186.40
 unknown Russian Federation
39493 RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU false
207.100.91.239
 unknown United States
6079 RCN-ASUS false
105.197.220.26
 unknown Egypt
24835 RAYA-ASEG false
9.42.128.36
 unknown United States
3356 LEVEL3US false
204.104.131.208
 unknown United States
1239 SPRINTLINKUS false
200.255.254.138
 unknown Brazil
4230 CLAROSABR false
216.163.68.64
 unknown United States
26919 ASN-CBCBHUS false
174.55.183.236
 unknown United States
7922 COMCAST-7922US false
6.183.124.112
 unknown United States
3356 LEVEL3US false
39.192.245.76
 unknown Indonesia
23693 TELKOMSEL-ASN-IDPTTelekomunikasiSelularID false
31.231.31.15
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
45.47.13.122
 unknown United States
11351 TWC-11351-NORTHEASTUS false
218.200.88.233
 unknown China
9808 CMNET-GDGuangdongMobileCommunicationCoLtdCN false
184.209.159.10
 unknown United States
10507 SPCSUS false
61.17.252.83
 unknown India
17908 TCISLTataCommunicationsIN false
44.44.42.168
 unknown United States
7377 UCSDUS false
156.240.33.243
 unknown Seychelles
328608 Africa-on-Cloud-ASZA false
15.44.206.39
 unknown United States
13979 ATT-IPFRUS false
179.241.239.225
 unknown Brazil
22085 ClaroSABR false
145.102.107.34
 unknown Netherlands
1103 SURFNET-NLSURFnetTheNetherlandsNL false
187.102.169.204
 unknown Brazil
17222 MundivoxLTDABR false
218.42.124.1
 unknown Japan 2518 BIGLOBEBIGLOBEIncJP false
115.73.156.26
 unknown Viet Nam
7552 VIETEL-AS-APViettelGroupVN false
32.141.146.161
 unknown United States
7018 ATT-INTERNET4US false
184.27.120.54
 unknown United States
20940 AKAMAI-ASN1EU false
140.137.89.212
 unknown Taiwan; Republic of China (ROC)
38845 FJU-AS-TWFuJenCatholicUniversityTW false
96.103.99.210
 unknown United States
7922 COMCAST-7922US false
145.209.54.6
 unknown Netherlands
1101 IP-EEND-ASIP-EENDBVNL false
81.153.99.16
 unknown United Kingdom
2856 BT-UK-ASBTnetUKRegionalnetworkGB false
81.104.146.11
 unknown United Kingdom
5089 NTLGB false
109.211.102.134
 unknown France
3215 FranceTelecom-OrangeFR false
246.97.205.145
 unknown Reserved
unknown unknown false
109.178.49.219
 unknown Greece
29247 COSMOTE-GRCosmoteMobileTelecommunicationsSAGR false
130.104.128.50
 unknown Belgium
2611 BELNETBE false
46.12.28.98
 unknown Greece
1241 FORTHNET-GRForthnetEU false
1.0.134.118
 unknown Thailand
23969 TOT-NETTOTPublicCompanyLimitedTH false
56.18.72.11
 unknown United States
2686 ATGS-MMD-ASUS false
145.119.197.200
 unknown Netherlands
1136 KPNKPNNationalEU false
208.197.203.173
 unknown United States
701 UUNETUS false
82.161.216.127
 unknown Netherlands
3265 XS4ALL-NLAmsterdamNL false
42.252.142.192
 unknown China
4134 CHINANET-BACKBONENo31Jin-rongStreetCN false
59.188.177.123
 unknown Hong Kong
17444 NWT-AS-APASnumberforNewWorldTelephoneLtdHK false
28.207.184.25
 unknown United States
7922 COMCAST-7922US false
77.164.186.228
 unknown Netherlands
1136 KPNKPNNationalEU false
79.218.236.46
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
4.129.222.44
 unknown United States
3356 LEVEL3US false

Contacted Domains

Name IP Active
daisy.ubuntu.com 162.213.35.24 true
rootme.xyz 45.128.232.208 true