Source: 6226.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 6226.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 6222.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 6222.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 6228.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 6228.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: Process Memory Space: ZuCtGOdazy.elf PID: 6226, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: Process Memory Space: ZuCtGOdazy.elf PID: 6226, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2018, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2077, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2078, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2079, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2080, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2083, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2084, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2114, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2156, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6228, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6235, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6236, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6237, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6238, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6239, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6240, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6246, result: successful | Jump to behavior |
Source: ZuCtGOdazy.elf, type: SAMPLE | Matched rule: SUSP_ELF_LNX_UPX_Compressed_File date = 2018-12-12, author = Florian Roth, description = Detects a suspicious ELF binary with UPX compression, score = 038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4, reference = Internal Research |
Source: 6226.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 6226.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 6222.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 6222.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 6228.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 6228.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: Process Memory Space: ZuCtGOdazy.elf PID: 6226, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: ZuCtGOdazy.elf PID: 6226, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2018, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2077, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2078, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2079, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2080, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2083, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2084, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2114, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2156, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6228, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6235, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6236, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6237, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6238, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6239, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6240, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6246, result: successful | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/6230/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/6236/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/6235/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1582/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2033/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2275/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/3088/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1612/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1579/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1699/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1335/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1698/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2028/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1334/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1576/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2302/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/3236/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2025/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2146/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/910/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/912/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/517/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/759/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/6228/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2307/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/918/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/6240/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/6246/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1594/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2285/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2281/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1349/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1623/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/761/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1622/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/884/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1983/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2038/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1344/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1465/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1586/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1463/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2156/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/800/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/6238/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/801/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/6237/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1629/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/6239/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1627/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1900/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/4470/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/3021/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/491/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2294/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2050/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1877/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/772/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1633/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1599/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1632/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/774/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1477/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/654/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/896/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1476/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1872/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2048/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/655/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1475/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2289/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/656/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/777/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/657/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/658/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/4467/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/4468/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/4469/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/419/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/936/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1639/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1638/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2208/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2180/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1809/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1494/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1890/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2063/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2062/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1888/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1886/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/420/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1489/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/785/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1642/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/788/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/667/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/789/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1648/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/4491/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/6157/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/6159/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2078/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2077/cmdline | Jump to behavior |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2074/cmdline | Jump to behavior |
Source: ZuCtGOdazy.elf, 6222.1.00005646580d9000.00005646582a7000.rw-.sdmp, ZuCtGOdazy.elf, 6226.1.00005646580d9000.00005646582a7000.rw-.sdmp, ZuCtGOdazy.elf, 6228.1.00005646580d9000.00005646582a7000.rw-.sdmp | Binary or memory string: /etc/qemu-binfmt/arm |
Source: ZuCtGOdazy.elf, 6222.1.00007ffe2a6af000.00007ffe2a6d0000.rw-.sdmp, ZuCtGOdazy.elf, 6226.1.00007ffe2a6af000.00007ffe2a6d0000.rw-.sdmp, ZuCtGOdazy.elf, 6228.1.00007ffe2a6af000.00007ffe2a6d0000.rw-.sdmp | Binary or memory string: /usr/bin/qemu-arm |
Source: ZuCtGOdazy.elf, 6222.1.00007ffe2a6af000.00007ffe2a6d0000.rw-.sdmp, ZuCtGOdazy.elf, 6226.1.00007ffe2a6af000.00007ffe2a6d0000.rw-.sdmp, ZuCtGOdazy.elf, 6228.1.00007ffe2a6af000.00007ffe2a6d0000.rw-.sdmp | Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/ZuCtGOdazy.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/ZuCtGOdazy.elf |
Source: ZuCtGOdazy.elf, 6222.1.00005646580d9000.00005646582a7000.rw-.sdmp, ZuCtGOdazy.elf, 6226.1.00005646580d9000.00005646582a7000.rw-.sdmp, ZuCtGOdazy.elf, 6228.1.00005646580d9000.00005646582a7000.rw-.sdmp | Binary or memory string: XFV!/etc/qemu-binfmt/arm |