Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2018, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2077, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2078, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2079, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2080, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2083, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2084, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2114, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2156, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6228, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6235, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6236, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6237, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6238, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6239, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6240, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6246, result: successful |
Source: ZuCtGOdazy.elf, type: SAMPLE | Matched rule: SUSP_ELF_LNX_UPX_Compressed_File date = 2018-12-12, author = Florian Roth, description = Detects a suspicious ELF binary with UPX compression, score = 038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4, reference = Internal Research |
Source: 6226.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 6226.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 6222.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 6222.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 6228.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 6228.1.00007f85f7f96000.00007f85f7faa000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: Process Memory Space: ZuCtGOdazy.elf PID: 6226, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: ZuCtGOdazy.elf PID: 6226, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2018, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2077, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2078, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2079, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2080, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2083, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2084, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2114, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 2156, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6228, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6235, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6236, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6237, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6238, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6239, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6240, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | SIGKILL sent: pid: 6246, result: successful |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/6230/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/6236/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/6235/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1582/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2033/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2275/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/3088/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1612/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1579/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1699/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1335/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1698/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2028/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1334/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1576/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2302/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/3236/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2025/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2146/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/910/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/912/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/517/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/759/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/6228/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2307/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/918/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/6240/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/6246/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1594/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2285/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2281/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1349/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1623/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/761/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1622/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/884/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1983/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2038/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1344/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1465/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1586/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1463/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2156/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/800/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/6238/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/801/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/6237/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1629/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/6239/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1627/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1900/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/4470/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/3021/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/491/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2294/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2050/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1877/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/772/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1633/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1599/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1632/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/774/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1477/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/654/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/896/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1476/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1872/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2048/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/655/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1475/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2289/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/656/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/777/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/657/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/658/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/4467/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/4468/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/4469/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/419/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/936/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1639/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1638/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2208/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2180/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1809/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1494/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1890/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2063/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2062/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1888/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1886/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/420/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1489/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/785/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1642/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/788/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/667/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/789/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/1648/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/4491/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/6157/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/6159/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2078/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2077/cmdline |
Source: /tmp/ZuCtGOdazy.elf (PID: 6224) | File opened: /proc/2074/cmdline |