Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 3129, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 3184, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 3187, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 3188, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 3189, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 3190, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 3193, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 3207, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 3215, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 3235, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 5636, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 5641, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 5642, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 5643, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 5644, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 5645, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 5646, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 5662, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 5688, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 5694, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 3129, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 3184, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 3187, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 3188, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 3189, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 3190, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 3193, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 3207, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 3215, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 3235, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 5636, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 5641, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 5642, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 5643, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 5644, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 5645, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 5646, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 5662, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 5688, result: successful | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | SIGKILL sent: pid: 5694, result: successful | Jump to behavior |
Source: 5634.1.00007f0ac4017000.00007f0ac4023000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 5636.1.00007f0ac4017000.00007f0ac4023000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 5630.1.00007f0ac4017000.00007f0ac4023000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: boatnet.arm.elf PID: 5634, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: boatnet.arm.elf PID: 5636, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5641) | Directory: /home/saturnino/.Xdefaults-galassia | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5642) | Directory: /home/saturnino/.Xdefaults-galassia | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5643) | Directory: /home/saturnino/.Xdefaults-galassia | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5644) | Directory: /home/saturnino/.Xdefaults-galassia | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645) | Directory: /home/saturnino/.Xdefaults-galassia | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645) | Directory: /usr/share/fonts/.uuid | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645) | Directory: /usr/local/share/fonts/.uuid | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645) | Directory: /home/saturnino/.local/share/fonts/.uuid | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645) | Directory: /home/saturnino/.fonts/.uuid | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645) | Directory: /usr/share/fonts/X11/.uuid | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645) | Directory: /usr/share/fonts/cMap/.uuid | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645) | Directory: /usr/share/fonts/cmap/.uuid | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645) | Directory: /usr/share/fonts/opentype/.uuid | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645) | Directory: /usr/share/fonts/truetype/.uuid | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645) | Directory: /usr/share/fonts/type1/.uuid | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645) | Directory: /usr/share/fonts/X11/Type1/.uuid | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645) | Directory: /usr/share/fonts/X11/encodings/.uuid | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645) | Directory: /usr/share/fonts/X11/misc/.uuid | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645) | Directory: /home/saturnino/.cache | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645) | Directory: /home/saturnino/.local | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5645) | Directory: /home/saturnino/.config | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5646) | Directory: /home/saturnino/.Xdefaults-galassia | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5662) | Directory: /home/saturnino/.cache | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5662) | Directory: /home/saturnino/.local | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5662) | Directory: /home/saturnino/.config | Jump to behavior |
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5662) | Directory: /home/saturnino/.config | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/5662/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3760/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3761/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/5785/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/2672/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/1583/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3244/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3120/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3361/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3759/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3239/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/1577/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/1610/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/512/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/1299/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3235/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/514/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3874/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/519/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/2946/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/917/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3758/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/5673/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/5674/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/5675/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3134/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/1593/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3011/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3094/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3406/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/1589/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3129/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/1588/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3402/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3125/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3246/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3245/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/767/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/800/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/888/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/801/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/769/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/803/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/806/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/807/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/928/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/2956/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3420/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/490/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3142/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/1635/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/1633/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/1599/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3139/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/1873/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/1630/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3412/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/657/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/5676/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/658/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/5677/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/659/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/5678/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/418/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/5679/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/419/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/1639/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/1638/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/5693/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/5694/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3398/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/1371/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3392/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/780/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/660/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/661/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/782/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/1369/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3304/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3425/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/785/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/1642/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/940/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/941/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/1640/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3147/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/3268/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/1364/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/548/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/5688/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/5569/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/1647/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/5463/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/2991/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/1383/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/1382/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/1381/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/791/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/671/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/794/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/1655/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/2986/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/795/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/674/cmdline | Jump to behavior |
Source: /tmp/boatnet.arm.elf (PID: 5632) | File opened: /proc/1653/cmdline | Jump to behavior |
Source: boatnet.arm.elf, 5630.1.00007ffe3c157000.00007ffe3c178000.rw-.sdmp, boatnet.arm.elf, 5634.1.00007ffe3c157000.00007ffe3c178000.rw-.sdmp, boatnet.arm.elf, 5636.1.00007ffe3c157000.00007ffe3c178000.rw-.sdmp | Binary or memory string: ^x86_64/usr/bin/qemu-arm/tmp/boatnet.arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/boatnet.arm.elf |
Source: boatnet.arm.elf, 5630.1.0000557af10f8000.0000557af1306000.rw-.sdmp, boatnet.arm.elf, 5634.1.0000557af10f8000.0000557af1306000.rw-.sdmp, boatnet.arm.elf, 5636.1.0000557af10f8000.0000557af1306000.rw-.sdmp | Binary or memory string: zU!/etc/qemu-binfmt/arm |
Source: boatnet.arm.elf, 5630.1.0000557af10f8000.0000557af1306000.rw-.sdmp, boatnet.arm.elf, 5634.1.0000557af10f8000.0000557af1306000.rw-.sdmp, boatnet.arm.elf, 5636.1.0000557af10f8000.0000557af1306000.rw-.sdmp | Binary or memory string: /etc/qemu-binfmt/arm |
Source: boatnet.arm.elf, 5630.1.00007ffe3c157000.00007ffe3c178000.rw-.sdmp, boatnet.arm.elf, 5634.1.00007ffe3c157000.00007ffe3c178000.rw-.sdmp, boatnet.arm.elf, 5636.1.00007ffe3c157000.00007ffe3c178000.rw-.sdmp | Binary or memory string: /usr/bin/qemu-arm |