Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 47518 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 47568 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 47580 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 47586 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 47592 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 47602 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 47614 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 47628 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 47634 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 47644 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 52720 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 62798 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 52728 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 48038 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 52742 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 52754 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 52766 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 52782 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 52804 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 52826 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 52840 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 52860 |
Source: unknown | TCP traffic detected without corresponding DNS query: 208.67.106.33 |
Source: unknown | TCP traffic detected without corresponding DNS query: 245.40.181.194 |
Source: unknown | TCP traffic detected without corresponding DNS query: 164.92.228.246 |
Source: unknown | TCP traffic detected without corresponding DNS query: 76.120.202.204 |
Source: unknown | TCP traffic detected without corresponding DNS query: 148.109.60.52 |
Source: unknown | TCP traffic detected without corresponding DNS query: 102.89.49.148 |
Source: unknown | TCP traffic detected without corresponding DNS query: 85.213.130.29 |
Source: unknown | TCP traffic detected without corresponding DNS query: 174.208.22.39 |
Source: unknown | TCP traffic detected without corresponding DNS query: 250.161.197.250 |
Source: unknown | TCP traffic detected without corresponding DNS query: 63.177.207.85 |
Source: unknown | TCP traffic detected without corresponding DNS query: 38.238.223.94 |
Source: unknown | TCP traffic detected without corresponding DNS query: 217.105.135.72 |
Source: unknown | TCP traffic detected without corresponding DNS query: 57.37.168.56 |
Source: unknown | TCP traffic detected without corresponding DNS query: 197.172.131.188 |
Source: unknown | TCP traffic detected without corresponding DNS query: 248.209.105.134 |
Source: unknown | TCP traffic detected without corresponding DNS query: 183.111.93.225 |
Source: unknown | TCP traffic detected without corresponding DNS query: 147.60.167.215 |
Source: unknown | TCP traffic detected without corresponding DNS query: 213.157.228.177 |
Source: unknown | TCP traffic detected without corresponding DNS query: 70.225.215.51 |
Source: unknown | TCP traffic detected without corresponding DNS query: 152.64.229.223 |
Source: unknown | TCP traffic detected without corresponding DNS query: 100.216.249.100 |
Source: unknown | TCP traffic detected without corresponding DNS query: 202.75.139.202 |
Source: unknown | TCP traffic detected without corresponding DNS query: 70.86.148.199 |
Source: unknown | TCP traffic detected without corresponding DNS query: 248.15.158.48 |
Source: unknown | TCP traffic detected without corresponding DNS query: 85.83.225.145 |
Source: unknown | TCP traffic detected without corresponding DNS query: 1.77.86.28 |
Source: unknown | TCP traffic detected without corresponding DNS query: 59.252.246.10 |
Source: unknown | TCP traffic detected without corresponding DNS query: 64.18.74.27 |
Source: unknown | TCP traffic detected without corresponding DNS query: 79.191.203.255 |
Source: unknown | TCP traffic detected without corresponding DNS query: 244.229.218.198 |
Source: unknown | TCP traffic detected without corresponding DNS query: 99.61.106.137 |
Source: unknown | TCP traffic detected without corresponding DNS query: 223.138.122.19 |
Source: unknown | TCP traffic detected without corresponding DNS query: 9.190.101.13 |
Source: unknown | TCP traffic detected without corresponding DNS query: 5.212.128.241 |
Source: unknown | TCP traffic detected without corresponding DNS query: 88.142.3.40 |
Source: unknown | TCP traffic detected without corresponding DNS query: 107.173.254.234 |
Source: unknown | TCP traffic detected without corresponding DNS query: 109.99.140.187 |
Source: unknown | TCP traffic detected without corresponding DNS query: 200.9.78.234 |
Source: unknown | TCP traffic detected without corresponding DNS query: 217.182.126.141 |
Source: unknown | TCP traffic detected without corresponding DNS query: 218.140.242.166 |
Source: unknown | TCP traffic detected without corresponding DNS query: 4.45.73.154 |
Source: unknown | TCP traffic detected without corresponding DNS query: 154.147.176.168 |
Source: unknown | TCP traffic detected without corresponding DNS query: 100.194.40.185 |
Source: unknown | TCP traffic detected without corresponding DNS query: 242.172.138.190 |
Source: unknown | TCP traffic detected without corresponding DNS query: 58.199.253.174 |
Source: unknown | TCP traffic detected without corresponding DNS query: 195.95.14.34 |
Source: unknown | TCP traffic detected without corresponding DNS query: 87.43.28.146 |
Source: unknown | TCP traffic detected without corresponding DNS query: 190.249.121.182 |
Source: unknown | TCP traffic detected without corresponding DNS query: 8.88.27.159 |
Source: unknown | TCP traffic detected without corresponding DNS query: 246.28.207.35 |
Source: 6349.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 6349.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 6231.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 6231.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 6340.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 6340.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 6235.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 6235.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 6331.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 6331.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 6234.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 6234.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 6241.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 6241.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 6332.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 6332.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: Process Memory Space: CQbdBGQLxY PID: 6231, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: Process Memory Space: CQbdBGQLxY PID: 6231, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: Process Memory Space: CQbdBGQLxY PID: 6234, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: Process Memory Space: CQbdBGQLxY PID: 6235, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: Process Memory Space: CQbdBGQLxY PID: 6235, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: Process Memory Space: CQbdBGQLxY PID: 6331, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: Process Memory Space: CQbdBGQLxY PID: 6331, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: Process Memory Space: CQbdBGQLxY PID: 6340, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: Process Memory Space: CQbdBGQLxY PID: 6340, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: Process Memory Space: CQbdBGQLxY PID: 6349, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: Process Memory Space: CQbdBGQLxY PID: 6349, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 6349.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 6349.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 6231.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 6231.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 6340.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 6340.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 6235.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 6235.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 6331.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 6331.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 6234.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 6234.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 6241.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 6241.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 6332.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 6332.1.00007f94a8400000.00007f94a8415000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: Process Memory Space: CQbdBGQLxY PID: 6231, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: CQbdBGQLxY PID: 6231, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: Process Memory Space: CQbdBGQLxY PID: 6234, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: CQbdBGQLxY PID: 6235, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: CQbdBGQLxY PID: 6235, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: Process Memory Space: CQbdBGQLxY PID: 6331, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: CQbdBGQLxY PID: 6331, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: Process Memory Space: CQbdBGQLxY PID: 6340, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: CQbdBGQLxY PID: 6340, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: Process Memory Space: CQbdBGQLxY PID: 6349, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: CQbdBGQLxY PID: 6349, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: /tmp/CQbdBGQLxY (PID: 6234) | File opened: /proc/491/fd |
Source: /tmp/CQbdBGQLxY (PID: 6234) | File opened: /proc/793/fd |
Source: /tmp/CQbdBGQLxY (PID: 6234) | File opened: /proc/772/fd |
Source: /tmp/CQbdBGQLxY (PID: 6234) | File opened: /proc/796/fd |
Source: /tmp/CQbdBGQLxY (PID: 6234) | File opened: /proc/774/fd |
Source: /tmp/CQbdBGQLxY (PID: 6234) | File opened: /proc/797/fd |
Source: /tmp/CQbdBGQLxY (PID: 6234) | File opened: /proc/777/fd |
Source: /tmp/CQbdBGQLxY (PID: 6234) | File opened: /proc/799/fd |
Source: /tmp/CQbdBGQLxY (PID: 6234) | File opened: /proc/658/fd |
Source: /tmp/CQbdBGQLxY (PID: 6234) | File opened: /proc/912/fd |
Source: /tmp/CQbdBGQLxY (PID: 6234) | File opened: /proc/759/fd |
Source: /tmp/CQbdBGQLxY (PID: 6234) | File opened: /proc/936/fd |
Source: /tmp/CQbdBGQLxY (PID: 6234) | File opened: /proc/918/fd |
Source: /tmp/CQbdBGQLxY (PID: 6234) | File opened: /proc/1/fd |
Source: /tmp/CQbdBGQLxY (PID: 6234) | File opened: /proc/761/fd |
Source: /tmp/CQbdBGQLxY (PID: 6234) | File opened: /proc/785/fd |
Source: /tmp/CQbdBGQLxY (PID: 6234) | File opened: /proc/884/fd |
Source: /tmp/CQbdBGQLxY (PID: 6234) | File opened: /proc/720/fd |
Source: /tmp/CQbdBGQLxY (PID: 6234) | File opened: /proc/721/fd |
Source: /tmp/CQbdBGQLxY (PID: 6234) | File opened: /proc/788/fd |
Source: /tmp/CQbdBGQLxY (PID: 6234) | File opened: /proc/789/fd |
Source: /tmp/CQbdBGQLxY (PID: 6234) | File opened: /proc/800/fd |
Source: /tmp/CQbdBGQLxY (PID: 6234) | File opened: /proc/801/fd |
Source: /tmp/CQbdBGQLxY (PID: 6234) | File opened: /proc/847/fd |
Source: /tmp/CQbdBGQLxY (PID: 6234) | File opened: /proc/904/fd |
Source: /tmp/CQbdBGQLxY (PID: 6239) | File opened: /proc/491/fd |
Source: /tmp/CQbdBGQLxY (PID: 6239) | File opened: /proc/793/fd |
Source: /tmp/CQbdBGQLxY (PID: 6239) | File opened: /proc/772/fd |
Source: /tmp/CQbdBGQLxY (PID: 6239) | File opened: /proc/796/fd |
Source: /tmp/CQbdBGQLxY (PID: 6239) | File opened: /proc/774/fd |
Source: /tmp/CQbdBGQLxY (PID: 6239) | File opened: /proc/797/fd |
Source: /tmp/CQbdBGQLxY (PID: 6239) | File opened: /proc/777/fd |
Source: /tmp/CQbdBGQLxY (PID: 6239) | File opened: /proc/799/fd |
Source: /tmp/CQbdBGQLxY (PID: 6239) | File opened: /proc/658/fd |
Source: /tmp/CQbdBGQLxY (PID: 6239) | File opened: /proc/912/fd |
Source: /tmp/CQbdBGQLxY (PID: 6239) | File opened: /proc/759/fd |
Source: /tmp/CQbdBGQLxY (PID: 6239) | File opened: /proc/936/fd |
Source: /tmp/CQbdBGQLxY (PID: 6239) | File opened: /proc/918/fd |
Source: /tmp/CQbdBGQLxY (PID: 6239) | File opened: /proc/1/fd |
Source: /tmp/CQbdBGQLxY (PID: 6239) | File opened: /proc/761/fd |
Source: /tmp/CQbdBGQLxY (PID: 6239) | File opened: /proc/785/fd |
Source: /tmp/CQbdBGQLxY (PID: 6239) | File opened: /proc/884/fd |
Source: /tmp/CQbdBGQLxY (PID: 6239) | File opened: /proc/720/fd |
Source: /tmp/CQbdBGQLxY (PID: 6239) | File opened: /proc/721/fd |
Source: /tmp/CQbdBGQLxY (PID: 6239) | File opened: /proc/788/fd |
Source: /tmp/CQbdBGQLxY (PID: 6239) | File opened: /proc/789/fd |
Source: /tmp/CQbdBGQLxY (PID: 6239) | File opened: /proc/800/fd |
Source: /tmp/CQbdBGQLxY (PID: 6239) | File opened: /proc/801/fd |
Source: /tmp/CQbdBGQLxY (PID: 6239) | File opened: /proc/847/fd |
Source: /tmp/CQbdBGQLxY (PID: 6239) | File opened: /proc/904/fd |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 47518 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 47568 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 47580 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 47586 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 47592 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 47602 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 47614 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 47628 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 47634 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 47644 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 52720 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 62798 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 52728 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 48038 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 52742 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 52754 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 52766 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 52782 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 52804 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 52826 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 52840 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 52860 |
Source: CQbdBGQLxY, 6231.1.000055e9f96aa000.000055e9f9731000.rw-.sdmp, CQbdBGQLxY, 6234.1.000055e9f96aa000.000055e9f9731000.rw-.sdmp, CQbdBGQLxY, 6332.1.000055e9f96aa000.000055e9f9731000.rw-.sdmp, CQbdBGQLxY, 6349.1.000055e9f96aa000.000055e9f9731000.rw-.sdmp, CQbdBGQLxY, 6340.1.000055e9f96aa000.000055e9f9731000.rw-.sdmp, CQbdBGQLxY, 6235.1.000055e9f96aa000.000055e9f9731000.rw-.sdmp, CQbdBGQLxY, 6331.1.000055e9f96aa000.000055e9f9731000.rw-.sdmp, CQbdBGQLxY, 6241.1.000055e9f96aa000.000055e9f9731000.rw-.sdmp | Binary or memory string: /etc/qemu-binfmt/mipsel |
Source: CQbdBGQLxY, 6231.1.000055e9f96aa000.000055e9f9731000.rw-.sdmp, CQbdBGQLxY, 6234.1.000055e9f96aa000.000055e9f9731000.rw-.sdmp, CQbdBGQLxY, 6332.1.000055e9f96aa000.000055e9f9731000.rw-.sdmp, CQbdBGQLxY, 6349.1.000055e9f96aa000.000055e9f9731000.rw-.sdmp, CQbdBGQLxY, 6340.1.000055e9f96aa000.000055e9f9731000.rw-.sdmp, CQbdBGQLxY, 6235.1.000055e9f96aa000.000055e9f9731000.rw-.sdmp, CQbdBGQLxY, 6331.1.000055e9f96aa000.000055e9f9731000.rw-.sdmp, CQbdBGQLxY, 6241.1.000055e9f96aa000.000055e9f9731000.rw-.sdmp | Binary or memory string: U!/etc/qemu-binfmt/mipsel |
Source: CQbdBGQLxY, 6231.1.00007ffc38e37000.00007ffc38e58000.rw-.sdmp, CQbdBGQLxY, 6234.1.00007ffc38e37000.00007ffc38e58000.rw-.sdmp, CQbdBGQLxY, 6332.1.00007ffc38e37000.00007ffc38e58000.rw-.sdmp, CQbdBGQLxY, 6349.1.00007ffc38e37000.00007ffc38e58000.rw-.sdmp, CQbdBGQLxY, 6340.1.00007ffc38e37000.00007ffc38e58000.rw-.sdmp, CQbdBGQLxY, 6235.1.00007ffc38e37000.00007ffc38e58000.rw-.sdmp, CQbdBGQLxY, 6331.1.00007ffc38e37000.00007ffc38e58000.rw-.sdmp, CQbdBGQLxY, 6241.1.00007ffc38e37000.00007ffc38e58000.rw-.sdmp | Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/CQbdBGQLxYSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/CQbdBGQLxY |
Source: CQbdBGQLxY, 6231.1.00007ffc38e37000.00007ffc38e58000.rw-.sdmp, CQbdBGQLxY, 6234.1.00007ffc38e37000.00007ffc38e58000.rw-.sdmp, CQbdBGQLxY, 6332.1.00007ffc38e37000.00007ffc38e58000.rw-.sdmp, CQbdBGQLxY, 6349.1.00007ffc38e37000.00007ffc38e58000.rw-.sdmp, CQbdBGQLxY, 6340.1.00007ffc38e37000.00007ffc38e58000.rw-.sdmp, CQbdBGQLxY, 6235.1.00007ffc38e37000.00007ffc38e58000.rw-.sdmp, CQbdBGQLxY, 6331.1.00007ffc38e37000.00007ffc38e58000.rw-.sdmp, CQbdBGQLxY, 6241.1.00007ffc38e37000.00007ffc38e58000.rw-.sdmp | Binary or memory string: /usr/bin/qemu-mipsel |