e55e33ad6adcdaffb331b91eb4384a88cb8d186c9321a26f28933f9919a0395b

ELF

HOSTILE

e55e33ad6adcdaffb331b91eb4384a88cb8d186c9321a26f28933f9919a0395b · 100%

AI Gafgyt botnet trojan binary

Mal-ecule

K(Li)O₄(XeCEr₂La)H₃(Cm₄FPo₄)Md₃(BiBkHe)Th

Size 61.7 KB download

First seen 21 days ago

Analyzed 20 days ago

Ecosystem linux

Source abuse.ch

Also detected by 3 sources

ELF executes covert shell resolver C2 logic: x86_64:0xd070

ELF executes covert shell resolver C2 with prctl control: x86_64:0x2f6f

Busybox command injection (Bot names): x86_64:0xccdc

x86_64 elf

0x2d58	542430c7042418000000488944240848	T$0..$....H.D$.H
0x2d68	8d44242048894424104883c010488b10	.D$ H.D$.H...H..
0x2d78	b8480000000f05483d00f0ffff4889c3	.H.....H=....H..
0x2d88	760fe82903000089da4883cbfff7da89	v..).....H......
0x2d98	1089d84881c4d00000005bc353b85000	...H......[.S.P.
0x2da8	00000f05483d00f0ffff4889c3760fe8	....H=....H..v..
0x2db8	fc02000089da4883cbfff7da891089d8	......H.........
0x2dc8	5bc39090534863ffb8030000000f0548	[...SHc........H
0x2dd8	3d00f0ffff4889c3760fe8d102000089	=....H..v.......
0x2de8	da4883cbfff7da891089d85bc3909090	.H.........[....
0x2df8	53b8390000000f05483d00f0ffff4889	S.9.....H=....H.
0x2e08	c3760fe8a802000089da4883cbfff7da	.v........H.....
0x2e18	891089d85bc3909053b8270000000f05	....[...S.'.....
0x2e28	483d00f0ffff4889c3760fe880020000	H=....H..v......
0x2e38	89da4883cbfff7da891089d85bc39090	..H.........[...
0x2e48	53b86e0000000f05483d00f0ffff4889	S.n.....H=....H.
0x2e58	c3760fe85802000089da4883cbfff7da	.v..X.....H.....
0x2e68	891089d85bc390905389ffb861000000	....[...S...a...
0x2e78	0f05483d00f0ffff4889c3760fe82e02	..H=....H..v....
0x2e88	000089da4883cbfff7da891089d85bc3	....H.........[.
0x2e98	534863f64863ffb83e0000000f05483d	SHc.Hc..>.....H=
0x2ea8	00f0ffff4889c3760fe80202000089da	....H..v........
0x2eb8	4883cbfff7da891089d85bc35331c048	H.........[.S1.H
0x2ec8	81ecd000000040f6c640488954243074	......@..@H.T$0t
0x2ed8	24488d8424e0000000c7042418000000	$H..$......$....
0x2ee8	4889442408488d442420488944241048	H.D$.H.D$ H.D$.H
0x2ef8	83c0108b0089c24863f6b8020000000f	.......Hc.......
0x2f08	05483d00f0ffff4889c3760fe89f0100	.H=....H..v.....
0x2f18	0089da4883cbfff7da891089d84881c4	...H.........H..
0x2f28	d00000005bc389f231c0be41020000e9	....[...1..A....
0x2f38	88ffffff534863d2b8070000000f0548	....SHc........H
0x2f48	3d00f0ffff4889c3760fe86101000089	=....H..v..a....
0x2f58	da4883cbfff7da891089d85bc3909090	.H.........[....
0x2f68	534989ca4863ffb89d0000000f05483d	SI..Hc........H=ELF executes covert shell resolver C2 with prctl control
0x2f78	00f0ffff4889c3760fe83201000089da	....H..v..2.....
0x2f88	4883cbfff7da891089d85bc3534863ff	H.........[.SHc.
0x2f98	31c00f05483d00f0ffff4889c3760fe8	1...H=....H..v..
0x2fa8	0c01000089da4883cbfff7da89104889	......H.......H.
0x2fb8	d85bc39053b8590000000f05483d00f0	.[..S.Y.....H=..
0x2fc8	ffff4889c3760fe8e400000089da4883	..H..v........H.
0x2fd8	cbfff7da89104889d85bc3905389ffb8	......H..[..S...
0x2fe8	a00000000f05483d00f0ffff4889c376	......H=....H..v
0x2ff8	0fe8ba00000089da4883cbfff7da8910	........H.......
0x3008	89d85bc353b8700000000f05483d00f0	..[.S.p.....H=..
0x3018	ffff4889c3760fe89400000089da4883	..H..v........H.
0x3028	cbfff7da891089d85bc3909053b8c900	........[...S...
0x3038	00000f05483d00f0ffff4889c3760fe8	....H=....H..v..
0x3048	6c00000089da4883cbfff7da89104889	l.....H.......H.

0xcc16	0000c8c740000000000040c840000000	....@.....@.@...
0xcc26	0000b0c840000000000038c940000000	....@.....8.@...
0xcc36	0000b0c94000000000002f70726f632f	....@...../proc/
0xcc46	73656c662f6f6f6d5f73636f72655f61	self/oom_score_a
0xcc56	646a002d31303030002f70726f632f73	dj.-1000./proc/s
0xcc66	656c662f6f6f6d5f61646a002d313700	elf/oom_adj.-17.
0xcc76	5b6b776f726b65722f75343a305d002f	[kworker/u4:0]./
0xcc86	70726f632f73656c662f657865002573	proc/self/exe.%s
0xcc96	0a0056617065426f7420686173206265	..VapeBot has be
0xcca6	656e206578656375746564007375746c	en executed.sutl
0xccb6	74776c73767a6c70737500514a474e4e	twlsvzlpsu.QJGNN
0xccc6	2200474c43404e472200515b5156474f	".GLC@NG".Q[QVGO
0xccd6	2200514a22000d404b4c0d4057515b40	".QJ"..@KL.@WQ[@Busybox probe via non-existent applet
0xcce6	4d5a026f6b70636b22006f6b70636b18	MZ.okpck".okpck.
0xccf6	024352524e4756024c4d5602444d574c	.CRRNGV.LMV.DMWL
0xcd06	4622004c414d50504741562200000000	F".LAMPPGAV"....
0xcd16	00000000000000000000000000000000	................
0xcd26	00000000000000000000000000000000	................
0xcd36	00000000000000000000000000000000	................
0xcd46	00000000000000000000000000000000	................
0xcd56	00000000000000000000000000000000	................
0xcd66	00000000000000000000000000000000	................
0xcd76	00000000000000000000000000000000	................
0xcd86	00000000000000000000000000000000	................
0xcd96	00000000000000000000000000000000	................
0xcda6	0000000000000000	........

0xcff0	00000000000000000000000000000000	................
0xd000	00000000000000000000000000000000	................
0xd010	00000000000000000000000000000000	................
0xd020	00000000000000000000000000000000	................
0xd030	01000000000000000000000000000000	................
0xd040	0000000000000000286e696c2900286e	........(nil).(n
0xd050	756c6c29002b002d0020003078003058	ull).+.-. .0x.0X
0xd060	00101010080a0a0a0000000000000000	................
0xd070	686c4c6a7a74715a0002040804040408	hlLjztqZ........ELF executes covert shell resolver C2 logic
0xd080	04000108000000000000000000000000	................
0xd090	001f0500000f07080200040001000300	................
0xd0a0	00100500000007000200040001000300	................
0xd0b0	0001070f101112131500000000000000	................
0xd0c0	6e7078586f7564696646654567476141	npxXoudifFeEgGaAELF executes covert shell resolver C2 with prctl control
0xd0d0	4353637300202b302d23274900000000	CScs. +0-#'I....
0xd0e0	08000500030004000100000200000004	................
0xd0f0	00080200070007080001010104020101	................
0xd100	01010101556e6b6e6f776e206572726f	....Unknown erro
0xd110	72200000000000000000000000000000	r ..............
0xd120	53756363657373004f7065726174696f	Success.Operatio
0xd130	6e206e6f74207065726d697474656400	n not permitted.
0xd140	4e6f20737563682066696c65206f7220	No such file or
0xd150	6469726563746f7279004e6f20737563	directory.No suc
0xd160	682070726f6365737300496e74657272	h process.Interr
0xd170	75707465642073797374656d2063616c	upted system cal
0xd180	6c00496e7075742f6f75747075742065	l.Input/output e
0xd190	72726f72	rror

0xdcfc	00000000000000000000000000000000	................
0xdd0c	00000000303132333435363738396162	....0123456789ab
0xdd1c	63646566002578000000000000000000	cdef.%x.........
0xdd2c	00000000000000000000000000000000	................
0xdd3c	00000000000000000000000000000000	................
0xdd4c	0000000125752e25752e25752e25752e	....%u.%u.%u.%u.
0xdd5c	696e2d616464722e617270610025782e	in-addr.arpa.%x.
0xdd6c	25782e006970362e61727061002d6300	%x..ip6.arpa.-c.
0xdd7c	2f62696e2f736800000000006f814000	/bin/sh.....o.@.ELF executes covert shell resolver C2 with prctl control
0xdd8c	00000000518240000000000079814000	....Q.@.....y.@.
0xdd9c	0000000083814000000000008d814000	......@.......@.
0xddac	000000003c8240000000000094814000	....<.@.......@.
0xddbc	00000000558140000000000055814000	....U.@.....U.@.
0xddcc	00000000558140000000000055814000	....U.@.....U.@.
0xdddc	00000000558140000000000055814000	....U.@.....U.@.
0xddec	00000000558140000000000055814000	....U.@.....U.@.
0xddfc	00000000558140000000000055814000	....U.@.....U.@.
0xde0c	00000000558140000000000055814000	....U.@.....U.@.
0xde1c	00000000558140000000000055814000	....U.@.....U.@.
0xde2c	00000000558140000000000055814000	....U.@.....U.@.
0xde3c	00000000518240000000000051824000	....Q.@.....Q.@.
0xde4c	000000007c824000000000006c824000	....\|.@.....l.@.
0xde5c	000000005182400000000000aa814000	....Q.@.......@.
0xde6c	0000000043824000000000009e814000	....C.@.......@.
0xde7c	000000005e8240	....^.@

0xe607	c2d340000000000000e08ce980c947ba	..@...........G.
0xe617	93a8410000000000008edef99dfbeb7e	..A............~
0xe627	aa5143000000000000c7910ea6aea019	.QC.............
0xe637	e3a346000000000000170c7581867576	..F........u..uv
0xe647	c9484d000000000000e55d3dc55d3b8b	.HM.......]=.];.
0xe657	9e925a0000000000009b97208a025260	..Z........ ..R`
0xe667	c425750000000000002f6574632f7365	.%u....../etc/seELF executes covert shell resolver C2 with prctl control
0xe677	72766963657300230a002009002c2f00	rvices.#.. ..,/.
0xe687	2f6574632f7265736f6c762e636f6e66	/etc/resolv.confELF executes covert shell resolver C2 logic
0xe697	002f6574632f636f6e6669672f726573	./etc/config/resStatic uClibc ELF with shell and resolver access
0xe6a7	6f6c762e636f6e66006e616d65736572	olv.conf.nameser
0xe6b7	76657200646f6d61696e007365617263	ver.domain.searc
0xe6c7	68000000000000000009b84000000000	h..........@....
0xe6d7	0020b840000000000095b74000000000	. .@.......@....
0xe6e7	00aab7400000000000bfb74000000000	...@.......@....
0xe6f7	00d4b7400000000000e6b74000000000	...@.......@....
0xe707	00f8b74000000000002f6574632f686f	...@...../etc/ho
0xe717	737473002f6574632f636f6e6669672f	sts./etc/config/
0xe727	686f7374730000000000000000000000	hosts...........
0xe737	00000000000000000000000000000000	................
0xe747	00000000000000000000000000000000	................
0xe757	00000000000000000000000000000000	................
0xe767	00000000000000000000000000000000	................
0xe777	00000000000000000000000000000000	................
0xe787	00000000000000000000000000000000	................
0xe797	00000000000000000000000000000000	................
0xe7a7	00000000000000000000000000000000	................
0xe7b7	00000000000000000000000000000000	................
0xe7c7	00000000000000000000000000000000	................
0xe7d7	000000000000000000	.........

Well-known

0xcff0	00000000000000000000000000000000	................
0xd000	00000000000000000000000000000000	................
0xd010	00000000000000000000000000000000	................
0xd020	00000000000000000000000000000000	................
0xd030	01000000000000000000000000000000	................
0xd040	0000000000000000286e696c2900286e	........(nil).(n
0xd050	756c6c29002b002d0020003078003058	ull).+.-. .0x.0X
0xd060	00101010080a0a0a0000000000000000	................
0xd070	686c4c6a7a74715a0002040804040408	hlLjztqZ........
0xd080	04000108000000000000000000000000	................
0xd090	001f0500000f07080200040001000300	................
0xd0a0	00100500000007000200040001000300	................
0xd0b0	0001070f101112131500000000000000	................
0xd0c0	6e7078586f7564696646654567476141	npxXoudifFeEgGaA
0xd0d0	4353637300202b302d23274900000000	CScs. +0-#'I....
0xd0e0	08000500030004000100000200000004	................
0xd0f0	00080200070007080001010104020101	................
0xd100	01010101556e6b6e6f776e206572726f	....Unknown erro
0xd110	72200000000000000000000000000000	r ..............
0xd120	53756363657373004f7065726174696f	Success.Operatio
0xd130	6e206e6f74207065726d697474656400	n not permitted.
0xd140	4e6f20737563682066696c65206f7220	No such file or
0xd150	6469726563746f7279004e6f20737563	directory.No suc
0xd160	682070726f6365737300496e74657272	h process.Interr
0xd170	75707465642073797374656d2063616c	upted system cal
0xd180	6c00496e7075742f6f75747075742065	l.Input/output e
0xd190	72726f72	rror

Objectives

0xcff0	00000000000000000000000000000000	................
0xd000	00000000000000000000000000000000	................
0xd010	00000000000000000000000000000000	................
0xd020	00000000000000000000000000000000	................
0xd030	01000000000000000000000000000000	................
0xd040	0000000000000000286e696c2900286e	........(nil).(n
0xd050	756c6c29002b002d0020003078003058	ull).+.-. .0x.0X
0xd060	00101010080a0a0a0000000000000000	................
0xd070	686c4c6a7a74715a0002040804040408	hlLjztqZ........
0xd080	04000108000000000000000000000000	................
0xd090	001f0500000f07080200040001000300	................
0xd0a0	00100500000007000200040001000300	................
0xd0b0	0001070f101112131500000000000000	................
0xd0c0	6e7078586f7564696646654567476141	npxXoudifFeEgGaA
0xd0d0	4353637300202b302d23274900000000	CScs. +0-#'I....
0xd0e0	08000500030004000100000200000004	................
0xd0f0	00080200070007080001010104020101	................
0xd100	01010101556e6b6e6f776e206572726f	....Unknown erro
0xd110	72200000000000000000000000000000	r ..............
0xd120	53756363657373004f7065726174696f	Success.Operatio
0xd130	6e206e6f74207065726d697474656400	n not permitted.
0xd140	4e6f20737563682066696c65206f7220	No such file or
0xd150	6469726563746f7279004e6f20737563	directory.No suc
0xd160	682070726f6365737300496e74657272	h process.Interr
0xd170	75707465642073797374656d2063616c	upted system cal
0xd180	6c00496e7075742f6f75747075742065	l.Input/output e
0xd190	72726f72	rror

0xdcfc	00000000000000000000000000000000	................
0xdd0c	00000000303132333435363738396162	....0123456789ab
0xdd1c	63646566002578000000000000000000	cdef.%x.........
0xdd2c	00000000000000000000000000000000	................
0xdd3c	00000000000000000000000000000000	................
0xdd4c	0000000125752e25752e25752e25752e	....%u.%u.%u.%u.
0xdd5c	696e2d616464722e617270610025782e	in-addr.arpa.%x.
0xdd6c	25782e006970362e61727061002d6300	%x..ip6.arpa.-c.
0xdd7c	2f62696e2f736800000000006f814000	/bin/sh.....o.@.
0xdd8c	00000000518240000000000079814000	....Q.@.....y.@.
0xdd9c	0000000083814000000000008d814000	......@.......@.
0xddac	000000003c8240000000000094814000	....<.@.......@.
0xddbc	00000000558140000000000055814000	....U.@.....U.@.
0xddcc	00000000558140000000000055814000	....U.@.....U.@.
0xdddc	00000000558140000000000055814000	....U.@.....U.@.
0xddec	00000000558140000000000055814000	....U.@.....U.@.
0xddfc	00000000558140000000000055814000	....U.@.....U.@.
0xde0c	00000000558140000000000055814000	....U.@.....U.@.
0xde1c	00000000558140000000000055814000	....U.@.....U.@.
0xde2c	00000000558140000000000055814000	....U.@.....U.@.
0xde3c	00000000518240000000000051824000	....Q.@.....Q.@.
0xde4c	000000007c824000000000006c824000	....\|.@.....l.@.
0xde5c	000000005182400000000000aa814000	....Q.@.......@.
0xde6c	0000000043824000000000009e814000	....C.@.......@.
0xde7c	000000005e8240	....^.@

0xe607	c2d340000000000000e08ce980c947ba	..@...........G.
0xe617	93a8410000000000008edef99dfbeb7e	..A............~
0xe627	aa5143000000000000c7910ea6aea019	.QC.............
0xe637	e3a346000000000000170c7581867576	..F........u..uv
0xe647	c9484d000000000000e55d3dc55d3b8b	.HM.......]=.];.
0xe657	9e925a0000000000009b97208a025260	..Z........ ..R`
0xe667	c425750000000000002f6574632f7365	.%u....../etc/se
0xe677	72766963657300230a002009002c2f00	rvices.#.. ..,/.
0xe687	2f6574632f7265736f6c762e636f6e66	/etc/resolv.conf
0xe697	002f6574632f636f6e6669672f726573	./etc/config/res
0xe6a7	6f6c762e636f6e66006e616d65736572	olv.conf.nameser
0xe6b7	76657200646f6d61696e007365617263	ver.domain.searc
0xe6c7	68000000000000000009b84000000000	h..........@....
0xe6d7	0020b840000000000095b74000000000	. .@.......@....
0xe6e7	00aab7400000000000bfb74000000000	...@.......@....
0xe6f7	00d4b7400000000000e6b74000000000	...@.......@....
0xe707	00f8b74000000000002f6574632f686f	...@...../etc/ho
0xe717	737473002f6574632f636f6e6669672f	sts./etc/config/
0xe727	686f7374730000000000000000000000	hosts...........
0xe737	00000000000000000000000000000000	................
0xe747	00000000000000000000000000000000	................
0xe757	00000000000000000000000000000000	................
0xe767	00000000000000000000000000000000	................
0xe777	00000000000000000000000000000000	................
0xe787	00000000000000000000000000000000	................
0xe797	00000000000000000000000000000000	................
0xe7a7	00000000000000000000000000000000	................
0xe7b7	00000000000000000000000000000000	................
0xe7c7	00000000000000000000000000000000	................
0xe7d7	000000000000000000	.........

0x2d58	542430c7042418000000488944240848	T$0..$....H.D$.H
0x2d68	8d44242048894424104883c010488b10	.D$ H.D$.H...H..
0x2d78	b8480000000f05483d00f0ffff4889c3	.H.....H=....H..
0x2d88	760fe82903000089da4883cbfff7da89	v..).....H......
0x2d98	1089d84881c4d00000005bc353b85000	...H......[.S.P.
0x2da8	00000f05483d00f0ffff4889c3760fe8	....H=....H..v..
0x2db8	fc02000089da4883cbfff7da891089d8	......H.........
0x2dc8	5bc39090534863ffb8030000000f0548	[...SHc........H
0x2dd8	3d00f0ffff4889c3760fe8d102000089	=....H..v.......
0x2de8	da4883cbfff7da891089d85bc3909090	.H.........[....
0x2df8	53b8390000000f05483d00f0ffff4889	S.9.....H=....H.
0x2e08	c3760fe8a802000089da4883cbfff7da	.v........H.....
0x2e18	891089d85bc3909053b8270000000f05	....[...S.'.....
0x2e28	483d00f0ffff4889c3760fe880020000	H=....H..v......
0x2e38	89da4883cbfff7da891089d85bc39090	..H.........[...
0x2e48	53b86e0000000f05483d00f0ffff4889	S.n.....H=....H.
0x2e58	c3760fe85802000089da4883cbfff7da	.v..X.....H.....
0x2e68	891089d85bc390905389ffb861000000	....[...S...a...
0x2e78	0f05483d00f0ffff4889c3760fe82e02	..H=....H..v....
0x2e88	000089da4883cbfff7da891089d85bc3	....H.........[.
0x2e98	534863f64863ffb83e0000000f05483d	SHc.Hc..>.....H=
0x2ea8	00f0ffff4889c3760fe80202000089da	....H..v........
0x2eb8	4883cbfff7da891089d85bc35331c048	H.........[.S1.H
0x2ec8	81ecd000000040f6c640488954243074	......@..@H.T$0t
0x2ed8	24488d8424e0000000c7042418000000	$H..$......$....
0x2ee8	4889442408488d442420488944241048	H.D$.H.D$ H.D$.H
0x2ef8	83c0108b0089c24863f6b8020000000f	.......Hc.......
0x2f08	05483d00f0ffff4889c3760fe89f0100	.H=....H..v.....
0x2f18	0089da4883cbfff7da891089d84881c4	...H.........H..
0x2f28	d00000005bc389f231c0be41020000e9	....[...1..A....
0x2f38	88ffffff534863d2b8070000000f0548	....SHc........H
0x2f48	3d00f0ffff4889c3760fe86101000089	=....H..v..a....
0x2f58	da4883cbfff7da891089d85bc3909090	.H.........[....
0x2f68	534989ca4863ffb89d0000000f05483d	SI..Hc........H=
0x2f78	00f0ffff4889c3760fe83201000089da	....H..v..2.....
0x2f88	4883cbfff7da891089d85bc3534863ff	H.........[.SHc.
0x2f98	31c00f05483d00f0ffff4889c3760fe8	1...H=....H..v..
0x2fa8	0c01000089da4883cbfff7da89104889	......H.......H.
0x2fb8	d85bc39053b8590000000f05483d00f0	.[..S.Y.....H=..
0x2fc8	ffff4889c3760fe8e400000089da4883	..H..v........H.
0x2fd8	cbfff7da89104889d85bc3905389ffb8	......H..[..S...
0x2fe8	a00000000f05483d00f0ffff4889c376	......H=....H..v
0x2ff8	0fe8ba00000089da4883cbfff7da8910	........H.......
0x3008	89d85bc353b8700000000f05483d00f0	..[.S.p.....H=..
0x3018	ffff4889c3760fe89400000089da4883	..H..v........H.
0x3028	cbfff7da891089d85bc3909053b8c900	........[...S...
0x3038	00000f05483d00f0ffff4889c3760fe8	....H=....H..v..
0x3048	6c00000089da4883cbfff7da89104889	l.....H.......H.

0xcff0	00000000000000000000000000000000	................
0xd000	00000000000000000000000000000000	................
0xd010	00000000000000000000000000000000	................
0xd020	00000000000000000000000000000000	................
0xd030	01000000000000000000000000000000	................
0xd040	0000000000000000286e696c2900286e	........(nil).(n
0xd050	756c6c29002b002d0020003078003058	ull).+.-. .0x.0X
0xd060	00101010080a0a0a0000000000000000	................
0xd070	686c4c6a7a74715a0002040804040408	hlLjztqZ........
0xd080	04000108000000000000000000000000	................
0xd090	001f0500000f07080200040001000300	................
0xd0a0	00100500000007000200040001000300	................
0xd0b0	0001070f101112131500000000000000	................
0xd0c0	6e7078586f7564696646654567476141	npxXoudifFeEgGaA
0xd0d0	4353637300202b302d23274900000000	CScs. +0-#'I....
0xd0e0	08000500030004000100000200000004	................
0xd0f0	00080200070007080001010104020101	................
0xd100	01010101556e6b6e6f776e206572726f	....Unknown erro
0xd110	72200000000000000000000000000000	r ..............
0xd120	53756363657373004f7065726174696f	Success.Operatio
0xd130	6e206e6f74207065726d697474656400	n not permitted.
0xd140	4e6f20737563682066696c65206f7220	No such file or
0xd150	6469726563746f7279004e6f20737563	directory.No suc
0xd160	682070726f6365737300496e74657272	h process.Interr
0xd170	75707465642073797374656d2063616c	upted system cal
0xd180	6c00496e7075742f6f75747075742065	l.Input/output e
0xd190	72726f72	rror

0xdcfc	00000000000000000000000000000000	................
0xdd0c	00000000303132333435363738396162	....0123456789ab
0xdd1c	63646566002578000000000000000000	cdef.%x.........
0xdd2c	00000000000000000000000000000000	................
0xdd3c	00000000000000000000000000000000	................
0xdd4c	0000000125752e25752e25752e25752e	....%u.%u.%u.%u.
0xdd5c	696e2d616464722e617270610025782e	in-addr.arpa.%x.
0xdd6c	25782e006970362e61727061002d6300	%x..ip6.arpa.-c.
0xdd7c	2f62696e2f736800000000006f814000	/bin/sh.....o.@.
0xdd8c	00000000518240000000000079814000	....Q.@.....y.@.
0xdd9c	0000000083814000000000008d814000	......@.......@.
0xddac	000000003c8240000000000094814000	....<.@.......@.
0xddbc	00000000558140000000000055814000	....U.@.....U.@.
0xddcc	00000000558140000000000055814000	....U.@.....U.@.
0xdddc	00000000558140000000000055814000	....U.@.....U.@.
0xddec	00000000558140000000000055814000	....U.@.....U.@.
0xddfc	00000000558140000000000055814000	....U.@.....U.@.
0xde0c	00000000558140000000000055814000	....U.@.....U.@.
0xde1c	00000000558140000000000055814000	....U.@.....U.@.
0xde2c	00000000558140000000000055814000	....U.@.....U.@.
0xde3c	00000000518240000000000051824000	....Q.@.....Q.@.
0xde4c	000000007c824000000000006c824000	....\|.@.....l.@.
0xde5c	000000005182400000000000aa814000	....Q.@.......@.
0xde6c	0000000043824000000000009e814000	....C.@.......@.
0xde7c	000000005e8240	....^.@

0xe607	c2d340000000000000e08ce980c947ba	..@...........G.
0xe617	93a8410000000000008edef99dfbeb7e	..A............~
0xe627	aa5143000000000000c7910ea6aea019	.QC.............
0xe637	e3a346000000000000170c7581867576	..F........u..uv
0xe647	c9484d000000000000e55d3dc55d3b8b	.HM.......]=.];.
0xe657	9e925a0000000000009b97208a025260	..Z........ ..R`
0xe667	c425750000000000002f6574632f7365	.%u....../etc/se
0xe677	72766963657300230a002009002c2f00	rvices.#.. ..,/.
0xe687	2f6574632f7265736f6c762e636f6e66	/etc/resolv.conf
0xe697	002f6574632f636f6e6669672f726573	./etc/config/res
0xe6a7	6f6c762e636f6e66006e616d65736572	olv.conf.nameser
0xe6b7	76657200646f6d61696e007365617263	ver.domain.searc
0xe6c7	68000000000000000009b84000000000	h..........@....
0xe6d7	0020b840000000000095b74000000000	. .@.......@....
0xe6e7	00aab7400000000000bfb74000000000	...@.......@....
0xe6f7	00d4b7400000000000e6b74000000000	...@.......@....
0xe707	00f8b74000000000002f6574632f686f	...@...../etc/ho
0xe717	737473002f6574632f636f6e6669672f	sts./etc/config/
0xe727	686f7374730000000000000000000000	hosts...........
0xe737	00000000000000000000000000000000	................
0xe747	00000000000000000000000000000000	................
0xe757	00000000000000000000000000000000	................
0xe767	00000000000000000000000000000000	................
0xe777	00000000000000000000000000000000	................
0xe787	00000000000000000000000000000000	................
0xe797	00000000000000000000000000000000	................
0xe7a7	00000000000000000000000000000000	................
0xe7b7	00000000000000000000000000000000	................
0xe7c7	00000000000000000000000000000000	................
0xe7d7	000000000000000000	.........

0xcc16	0000c8c740000000000040c840000000	....@.....@.@...
0xcc26	0000b0c840000000000038c940000000	....@.....8.@...
0xcc36	0000b0c94000000000002f70726f632f	....@...../proc/
0xcc46	73656c662f6f6f6d5f73636f72655f61	self/oom_score_a
0xcc56	646a002d31303030002f70726f632f73	dj.-1000./proc/s
0xcc66	656c662f6f6f6d5f61646a002d313700	elf/oom_adj.-17.
0xcc76	5b6b776f726b65722f75343a305d002f	[kworker/u4:0]./
0xcc86	70726f632f73656c662f657865002573	proc/self/exe.%s
0xcc96	0a0056617065426f7420686173206265	..VapeBot has be
0xcca6	656e206578656375746564007375746c	en executed.sutl
0xccb6	74776c73767a6c70737500514a474e4e	twlsvzlpsu.QJGNN
0xccc6	2200474c43404e472200515b5156474f	".GLC@NG".Q[QVGO
0xccd6	2200514a22000d404b4c0d4057515b40	".QJ"..@KL.@WQ[@
0xcce6	4d5a026f6b70636b22006f6b70636b18	MZ.okpck".okpck.
0xccf6	024352524e4756024c4d5602444d574c	.CRRNGV.LMV.DMWL
0xcd06	4622004c414d50504741562200000000	F".LAMPPGAV"....
0xcd16	00000000000000000000000000000000	................
0xcd26	00000000000000000000000000000000	................
0xcd36	00000000000000000000000000000000	................
0xcd46	00000000000000000000000000000000	................
0xcd56	00000000000000000000000000000000	................
0xcd66	00000000000000000000000000000000	................
0xcd76	00000000000000000000000000000000	................
0xcd86	00000000000000000000000000000000	................
0xcd96	00000000000000000000000000000000	................
0xcda6	0000000000000000	........

0xcc16	0000c8c740000000000040c840000000	....@.....@.@...
0xcc26	0000b0c840000000000038c940000000	....@.....8.@...
0xcc36	0000b0c94000000000002f70726f632f	....@...../proc/
0xcc46	73656c662f6f6f6d5f73636f72655f61	self/oom_score_a
0xcc56	646a002d31303030002f70726f632f73	dj.-1000./proc/s
0xcc66	656c662f6f6f6d5f61646a002d313700	elf/oom_adj.-17.
0xcc76	5b6b776f726b65722f75343a305d002f	[kworker/u4:0]./
0xcc86	70726f632f73656c662f657865002573	proc/self/exe.%s
0xcc96	0a0056617065426f7420686173206265	..VapeBot has be
0xcca6	656e206578656375746564007375746c	en executed.sutl
0xccb6	74776c73767a6c70737500514a474e4e	twlsvzlpsu.QJGNN
0xccc6	2200474c43404e472200515b5156474f	".GLC@NG".Q[QVGO
0xccd6	2200514a22000d404b4c0d4057515b40	".QJ"..@KL.@WQ[@
0xcce6	4d5a026f6b70636b22006f6b70636b18	MZ.okpck".okpck.
0xccf6	024352524e4756024c4d5602444d574c	.CRRNGV.LMV.DMWL
0xcd06	4622004c414d50504741562200000000	F".LAMPPGAV"....
0xcd16	00000000000000000000000000000000	................
0xcd26	00000000000000000000000000000000	................
0xcd36	00000000000000000000000000000000	................
0xcd46	00000000000000000000000000000000	................
0xcd56	00000000000000000000000000000000	................
0xcd66	00000000000000000000000000000000	................
0xcd76	00000000000000000000000000000000	................
0xcd86	00000000000000000000000000000000	................
0xcd96	00000000000000000000000000000000	................
0xcda6	0000000000000000	........

Micro-behaviors

0xc6a8	00000000000000000000000000000000	................
0xc6b8	00000000000000000000000000000000	................
0xc6c8	00000000000000000000000000000000	................
0xc6d8	00000000000000000000000000000000	................
0xc6e8	20485454502f312e310d0a486f73743a	HTTP/1.1..Host:
0xc6f8	2025730d0a436f6e6e656374696f6e3a	%s..Connection:
0xc708	206b6565702d616c6976650d0a557365	keep-alive..Use
0xc718	722d4167656e743a2000000000000000	r-Agent: .......
0xc728	6162636465666768696a6b6c6d6e6f70	abcdefghijklmnop
0xc738	7172737475767778797a303132333435	qrstuvwxyz012345
0xc748	00000000000000004d6f7a696c6c612f	........Mozilla/
0xc758	352e30202857696e646f7773204e5420	5.0 (Windows NT
0xc768	31302e303b2057696e36343b20783634	10.0; Win64; x64
0xc778	29204170706c655765624b69742f3533	) AppleWebKit/53
0xc788	372e333620284b48544d4c2c206c696b	7.36 (KHTML, lik
0xc798	65204765636b6f29204368726f6d652f	e Gecko) Chrome/
0xc7a8	39312e302e343437322e313234205361	91.0.4472.124 Sa
0xc7b8	666172692f3533372e33360000000000	fari/537.36.....
0xc7c8	4d6f7a696c6c612f352e3020284d6163	Mozilla/5.0 (Mac
0xc7d8	696e746f73683b20496e74656c204d61	intosh; Intel Ma
0xc7e8	63204f5320582031305f31355f372920	c OS X 10_15_7)
0xc7f8	4170706c655765624b69742f3630352e	AppleWebKit/605.
0xc808	312e313520284b48544d4c2c206c696b	1.15 (KHTML, lik
0xc818	65204765636b6f292056657273696f6e	e Gecko) Version
0xc828	2f31342e312e31205361666172692f36	/14.1.1 Safari/6
0xc838	30352e312e3135004d6f7a696c6c612f	05.1.15.Mozilla/
0xc848	352e3020285831313b204c696e757820	5.0 (X11; Linux
0xc858	7838365f363429204170706c65576562	x86_64) AppleWeb
0xc868	4b69742f3533372e333620284b48544d	Kit/537.36 (KHTM
0xc878	4c2c206c696b65204765636b6f292043	L, like Gecko) C
0xc888	68726f6d652f39322e302e343531352e	hrome/92.0.4515.
0xc898	313037205361666172692f3533372e33	107 Safari/537.3
0xc8a8	36000000000000004d6f7a696c6c612f	6.......Mozilla/
0xc8b8	352e3020286950686f6e653b20435055	5.0 (iPhone; CPU
0xc8c8	206950686f6e65204f532031345f3620	iPhone OS 14_6
0xc8d8	6c696b65204d6163204f532058292041	like Mac OS X) A
0xc8e8	70706c655765624b69742f3630352e31	ppleWebKit/605.1
0xc8f8	2e313520284b48544d4c2c206c696b65	.15 (KHTML, like
0xc908	204765636b6f292056657273696f6e2f	Gecko) Version/
0xc918	31342e30204d6f62696c652f31354531	14.0 Mobile/15E1
0xc928	3438205361666172692f3630342e3100	48 Safari/604.1.
0xc938	4d6f7a696c	Mozil

0xc970	372e333620284b48544d4c2c206c696b	7.36 (KHTML, lik
0xc980	65204765636b6f29204368726f6d652f	e Gecko) Chrome/
0xc990	39332e302e343537372e363320536166	93.0.4577.63 Saf
0xc9a0	6172692f3533372e3336000000000000	ari/537.36......
0xc9b0	4d6f7a696c6c612f352e30202857696e	Mozilla/5.0 (Win
0xc9c0	646f7773204e542031302e303b205769	dows NT 10.0; Wi
0xc9d0	6e36343b207836343b2072763a39312e	n64; x64; rv:91.
0xc9e0	3029204765636b6f2f32303130303130	0) Gecko/2010010
0xc9f0	312046697265666f782f39312e300000	1 Firefox/91.0..
0xca00	4d6f7a696c6c612f352e3020284d6163	Mozilla/5.0 (Mac
0xca10	696e746f73683b20496e74656c204d61	intosh; Intel Ma
0xca20	63204f5320582031305f31355f372920	c OS X 10_15_7)
0xca30	4170706c655765624b69742f35	AppleWebKit/5

0xca40	333620284b48544d4c2c206c696b6520	36 (KHTML, like
0xca50	4765636b6f29204368726f6d652f3933	Gecko) Chrome/93
0xca60	2e302e343537372e3633205361666172	.0.4577.63 Safar
0xca70	692f3533372e33360000000000000000	i/537.36........
0xca80	4d6f7a696c6c612f352e302028583131	Mozilla/5.0 (X11
0xca90	3b205562756e74753b204c696e757820	; Ubuntu; Linux
0xcaa0	7838365f36343b2072763a39312e3029	x86_64; rv:91.0)
0xcab0	204765636b6f2f323031303031303120	Gecko/20100101
0xcac0	46697265666f782f39312e3000000000	Firefox/91.0....
0xcad0	4d6f7a696c6c612f352e302028416e64	Mozilla/5.0 (And
0xcae0	726f69642031313b204d6f62696c653b	roid 11; Mobile;
0xcaf0	2072763a36382e3029204765636b6f2f	rv:68.0) Gecko/
0xcb00	36382e302046697265666f782f38382e	68.0 Firefox/88.
0xcb10	30000000000000004d6f7a696c6c612f	0.......Mozilla/
0xcb20	352e3020286950686f6e653b20435055	5.0 (iPhone; CPU
0xcb30	206950686f6e65204f532031345f375f	iPhone OS 14_7_
0xcb40	31206c696b65204d6163204f53205829	1 like Mac OS X)
0xcb50	204170706c655765624b69742f	AppleWebKit/

0xcc16	0000c8c740000000000040c840000000	....@.....@.@...
0xcc26	0000b0c840000000000038c940000000	....@.....8.@...
0xcc36	0000b0c94000000000002f70726f632f	....@...../proc/
0xcc46	73656c662f6f6f6d5f73636f72655f61	self/oom_score_a
0xcc56	646a002d31303030002f70726f632f73	dj.-1000./proc/s
0xcc66	656c662f6f6f6d5f61646a002d313700	elf/oom_adj.-17.
0xcc76	5b6b776f726b65722f75343a305d002f	[kworker/u4:0]./
0xcc86	70726f632f73656c662f657865002573	proc/self/exe.%s
0xcc96	0a0056617065426f7420686173206265	..VapeBot has be
0xcca6	656e206578656375746564007375746c	en executed.sutl
0xccb6	74776c73767a6c70737500514a474e4e	twlsvzlpsu.QJGNN
0xccc6	2200474c43404e472200515b5156474f	".GLC@NG".Q[QVGO
0xccd6	2200514a22000d404b4c0d4057515b40	".QJ"..@KL.@WQ[@
0xcce6	4d5a026f6b70636b22006f6b70636b18	MZ.okpck".okpck.
0xccf6	024352524e4756024c4d5602444d574c	.CRRNGV.LMV.DMWL
0xcd06	4622004c414d50504741562200000000	F".LAMPPGAV"....
0xcd16	00000000000000000000000000000000	................
0xcd26	00000000000000000000000000000000	................
0xcd36	00000000000000000000000000000000	................
0xcd46	00000000000000000000000000000000	................
0xcd56	00000000000000000000000000000000	................
0xcd66	00000000000000000000000000000000	................
0xcd76	00000000000000000000000000000000	................
0xcd86	00000000000000000000000000000000	................
0xcd96	00000000000000000000000000000000	................
0xcda6	0000000000000000	........

0x6b42	0000005b5d415c415d415e415fc35389	...[]A\A]A^A_.S.
0x6b52	d24863ffb8310000000f05483d00f0ff	.Hc..1.....H=...
0x6b62	ff4889c3760fe84bc5ffff89da4883cb	.H..v..K.....H..
0x6b72	fff7da891089d85bc3905389d24863ff	.......[..S..Hc.
0x6b82	b82a0000000f05483d00f0ffff4889c3	.*.....H=....H..
0x6b92	760fe81fc5ffff89da4883cbfff7da89	v........H......
0x6ba2	1089d85bc3904531c94531c0e9010000	...[..E1.E1.....
0x6bb2	0090534589c94c63d14863ffb82c0000	..SE..Lc.Hc..,..
0x6bc2	000f05483d00f0ffff4889c3760fe8e3	...H=....H..v...
0x6bd2	c4ffff89da4883cbfff7da89104889d8	.....H.......H..
0x6be2	5bc3534589c04989ca4863d24863f648	[.SE..I..Hc.Hc.H
0x6bf2	63ffb8360000000f05483d00f0ffff48	c..6.....H=....H
0x6c02	89c3760fe8adc4ffff89da4883cbfff7	..v........H....
0x6c12	da891089d85bc3909090534863d24863	.....[....SHc.Hc
0x6c22	f64863ffb8290000000f05483d00f0ff	.Hc..).....H=...
0x6c32	ff4889c3760fe87bc4ffff89da4883cb	.H..v..{.....H..
0x6c42	fff7da891089d85bc390555389fb4881	.......[..US..H.
0x6c52	ec480100004883feff0f94c285ff0f9e	.H...H..........
0x6c62	c008c2750583ff407e0de847c4ffffc7	...u...@~..G....
0x6c72	0016000000eb6dba100000004889b424	......m.....H..$
0x6c82	a0000000eb0f4863c248c784c4a80000	......Hc.H......
0x6c92	0000000000ffca79ed488dac24a00000	.......y.H..$...
0x6ca2	0089de488d7d08e86600000085c07834	...H.}..f.....x4
0x6cb2	89debfc0165100e8	.....Q..

0xe607	c2d340000000000000e08ce980c947ba	..@...........G.
0xe617	93a8410000000000008edef99dfbeb7e	..A............~
0xe627	aa5143000000000000c7910ea6aea019	.QC.............
0xe637	e3a346000000000000170c7581867576	..F........u..uv
0xe647	c9484d000000000000e55d3dc55d3b8b	.HM.......]=.];.
0xe657	9e925a0000000000009b97208a025260	..Z........ ..R`
0xe667	c425750000000000002f6574632f7365	.%u....../etc/se
0xe677	72766963657300230a002009002c2f00	rvices.#.. ..,/.
0xe687	2f6574632f7265736f6c762e636f6e66	/etc/resolv.conf
0xe697	002f6574632f636f6e6669672f726573	./etc/config/res
0xe6a7	6f6c762e636f6e66006e616d65736572	olv.conf.nameser
0xe6b7	76657200646f6d61696e007365617263	ver.domain.searc
0xe6c7	68000000000000000009b84000000000	h..........@....
0xe6d7	0020b840000000000095b74000000000	. .@.......@....
0xe6e7	00aab7400000000000bfb74000000000	...@.......@....
0xe6f7	00d4b7400000000000e6b74000000000	...@.......@....
0xe707	00f8b74000000000002f6574632f686f	...@...../etc/ho
0xe717	737473002f6574632f636f6e6669672f	sts./etc/config/
0xe727	686f7374730000000000000000000000	hosts...........
0xe737	00000000000000000000000000000000	................
0xe747	00000000000000000000000000000000	................
0xe757	00000000000000000000000000000000	................
0xe767	00000000000000000000000000000000	................
0xe777	00000000000000000000000000000000	................
0xe787	00000000000000000000000000000000	................
0xe797	00000000000000000000000000000000	................
0xe7a7	00000000000000000000000000000000	................
0xe7b7	00000000000000000000000000000000	................
0xe7c7	00000000000000000000000000000000	................
0xe7d7	000000000000000000	.........

0x2d58	542430c7042418000000488944240848	T$0..$....H.D$.H
0x2d68	8d44242048894424104883c010488b10	.D$ H.D$.H...H..
0x2d78	b8480000000f05483d00f0ffff4889c3	.H.....H=....H..
0x2d88	760fe82903000089da4883cbfff7da89	v..).....H......
0x2d98	1089d84881c4d00000005bc353b85000	...H......[.S.P.
0x2da8	00000f05483d00f0ffff4889c3760fe8	....H=....H..v..
0x2db8	fc02000089da4883cbfff7da891089d8	......H.........
0x2dc8	5bc39090534863ffb8030000000f0548	[...SHc........H
0x2dd8	3d00f0ffff4889c3760fe8d102000089	=....H..v.......
0x2de8	da4883cbfff7da891089d85bc3909090	.H.........[....
0x2df8	53b8390000000f05483d00f0ffff4889	S.9.....H=....H.
0x2e08	c3760fe8a802000089da4883cbfff7da	.v........H.....
0x2e18	891089d85bc3909053b8270000000f05	....[...S.'.....
0x2e28	483d00f0ffff4889c3760fe880020000	H=....H..v......
0x2e38	89da4883cbfff7da891089d85bc39090	..H.........[...
0x2e48	53b86e0000000f05483d00f0ffff4889	S.n.....H=....H.
0x2e58	c3760fe85802000089da4883cbfff7da	.v..X.....H.....
0x2e68	891089d85bc390905389ffb861000000	....[...S...a...
0x2e78	0f05483d00f0ffff4889c3760fe82e02	..H=....H..v....
0x2e88	000089da4883cbfff7da891089d85bc3	....H.........[.
0x2e98	534863f64863ffb83e0000000f05483d	SHc.Hc..>.....H=
0x2ea8	00f0ffff4889c3760fe80202000089da	....H..v........
0x2eb8	4883cbfff7da891089d85bc35331c048	H.........[.S1.H
0x2ec8	81ecd000000040f6c640488954243074	......@..@H.T$0t
0x2ed8	24488d8424e0000000c7042418000000	$H..$......$....
0x2ee8	4889442408488d442420488944241048	H.D$.H.D$ H.D$.H
0x2ef8	83c0108b0089c24863f6b8020000000f	.......Hc.......
0x2f08	05483d00f0ffff4889c3760fe89f0100	.H=....H..v.....
0x2f18	0089da4883cbfff7da891089d84881c4	...H.........H..
0x2f28	d00000005bc389f231c0be41020000e9	....[...1..A....
0x2f38	88ffffff534863d2b8070000000f0548	....SHc........H
0x2f48	3d00f0ffff4889c3760fe86101000089	=....H..v..a....
0x2f58	da4883cbfff7da891089d85bc3909090	.H.........[....
0x2f68	534989ca4863ffb89d0000000f05483d	SI..Hc........H=
0x2f78	00f0ffff4889c3760fe83201000089da	....H..v..2.....
0x2f88	4883cbfff7da891089d85bc3534863ff	H.........[.SHc.
0x2f98	31c00f05483d00f0ffff4889c3760fe8	1...H=....H..v..
0x2fa8	0c01000089da4883cbfff7da89104889	......H.......H.
0x2fb8	d85bc39053b8590000000f05483d00f0	.[..S.Y.....H=..
0x2fc8	ffff4889c3760fe8e400000089da4883	..H..v........H.
0x2fd8	cbfff7da89104889d85bc3905389ffb8	......H..[..S...
0x2fe8	a00000000f05483d00f0ffff4889c376	......H=....H..v
0x2ff8	0fe8ba00000089da4883cbfff7da8910	........H.......
0x3008	89d85bc353b8700000000f05483d00f0	..[.S.p.....H=..
0x3018	ffff4889c3760fe89400000089da4883	..H..v........H.
0x3028	cbfff7da891089d85bc3909053b8c900	........[...S...
0x3038	00000f05483d00f0ffff4889c3760fe8	....H=....H..v..
0x3048	6c00000089da4883cbfff7da89104889	l.....H.......H.

0x2d58	542430c7042418000000488944240848	T$0..$....H.D$.H
0x2d68	8d44242048894424104883c010488b10	.D$ H.D$.H...H..
0x2d78	b8480000000f05483d00f0ffff4889c3	.H.....H=....H..
0x2d88	760fe82903000089da4883cbfff7da89	v..).....H......
0x2d98	1089d84881c4d00000005bc353b85000	...H......[.S.P.
0x2da8	00000f05483d00f0ffff4889c3760fe8	....H=....H..v..
0x2db8	fc02000089da4883cbfff7da891089d8	......H.........
0x2dc8	5bc39090534863ffb8030000000f0548	[...SHc........H
0x2dd8	3d00f0ffff4889c3760fe8d102000089	=....H..v.......
0x2de8	da4883cbfff7da891089d85bc3909090	.H.........[....
0x2df8	53b8390000000f05483d00f0ffff4889	S.9.....H=....H.
0x2e08	c3760fe8a802000089da4883cbfff7da	.v........H.....
0x2e18	891089d85bc3909053b8270000000f05	....[...S.'.....
0x2e28	483d00f0ffff4889c3760fe880020000	H=....H..v......
0x2e38	89da4883cbfff7da891089d85bc39090	..H.........[...
0x2e48	53b86e0000000f05483d00f0ffff4889	S.n.....H=....H.
0x2e58	c3760fe85802000089da4883cbfff7da	.v..X.....H.....
0x2e68	891089d85bc390905389ffb861000000	....[...S...a...
0x2e78	0f05483d00f0ffff4889c3760fe82e02	..H=....H..v....
0x2e88	000089da4883cbfff7da891089d85bc3	....H.........[.
0x2e98	534863f64863ffb83e0000000f05483d	SHc.Hc..>.....H=
0x2ea8	00f0ffff4889c3760fe80202000089da	....H..v........
0x2eb8	4883cbfff7da891089d85bc35331c048	H.........[.S1.H
0x2ec8	81ecd000000040f6c640488954243074	......@..@H.T$0t
0x2ed8	24488d8424e0000000c7042418000000	$H..$......$....
0x2ee8	4889442408488d442420488944241048	H.D$.H.D$ H.D$.H
0x2ef8	83c0108b0089c24863f6b8020000000f	.......Hc.......
0x2f08	05483d00f0ffff4889c3760fe89f0100	.H=....H..v.....
0x2f18	0089da4883cbfff7da891089d84881c4	...H.........H..
0x2f28	d00000005bc389f231c0be41020000e9	....[...1..A....
0x2f38	88ffffff534863d2b8070000000f0548	....SHc........H
0x2f48	3d00f0ffff4889c3760fe86101000089	=....H..v..a....
0x2f58	da4883cbfff7da891089d85bc3909090	.H.........[....
0x2f68	534989ca4863ffb89d0000000f05483d	SI..Hc........H=
0x2f78	00f0ffff4889c3760fe83201000089da	....H..v..2.....
0x2f88	4883cbfff7da891089d85bc3534863ff	H.........[.SHc.
0x2f98	31c00f05483d00f0ffff4889c3760fe8	1...H=....H..v..
0x2fa8	0c01000089da4883cbfff7da89104889	......H.......H.
0x2fb8	d85bc39053b8590000000f05483d00f0	.[..S.Y.....H=..
0x2fc8	ffff4889c3760fe8e400000089da4883	..H..v........H.
0x2fd8	cbfff7da89104889d85bc3905389ffb8	......H..[..S...
0x2fe8	a00000000f05483d00f0ffff4889c376	......H=....H..v
0x2ff8	0fe8ba00000089da4883cbfff7da8910	........H.......
0x3008	89d85bc353b8700000000f05483d00f0	..[.S.p.....H=..
0x3018	ffff4889c3760fe89400000089da4883	..H..v........H.
0x3028	cbfff7da891089d85bc3909053b8c900	........[...S...
0x3038	00000f05483d00f0ffff4889c3760fe8	....H=....H..v..
0x3048	6c00000089da4883cbfff7da89104889	l.....H.......H.

Metadata

build ELF omits compiler metadata (.comment)

Third-party

0x6b42	0000005b5d415c415d415e415fc35389	...[]A\A]A^A_.S.
0x6b52	d24863ffb8310000000f05483d00f0ff	.Hc..1.....H=...
0x6b62	ff4889c3760fe84bc5ffff89da4883cb	.H..v..K.....H..
0x6b72	fff7da891089d85bc3905389d24863ff	.......[..S..Hc.
0x6b82	b82a0000000f05483d00f0ffff4889c3	.*.....H=....H..
0x6b92	760fe81fc5ffff89da4883cbfff7da89	v........H......
0x6ba2	1089d85bc3904531c94531c0e9010000	...[..E1.E1.....
0x6bb2	0090534589c94c63d14863ffb82c0000	..SE..Lc.Hc..,..
0x6bc2	000f05483d00f0ffff4889c3760fe8e3	...H=....H..v...
0x6bd2	c4ffff89da4883cbfff7da89104889d8	.....H.......H..
0x6be2	5bc3534589c04989ca4863d24863f648	[.SE..I..Hc.Hc.H
0x6bf2	63ffb8360000000f05483d00f0ffff48	c..6.....H=....H
0x6c02	89c3760fe8adc4ffff89da4883cbfff7	..v........H....
0x6c12	da891089d85bc3909090534863d24863	.....[....SHc.Hc
0x6c22	f64863ffb8290000000f05483d00f0ff	.Hc..).....H=...
0x6c32	ff4889c3760fe87bc4ffff89da4883cb	.H..v..{.....H..
0x6c42	fff7da891089d85bc390555389fb4881	.......[..US..H.
0x6c52	ec480100004883feff0f94c285ff0f9e	.H...H..........
0x6c62	c008c2750583ff407e0de847c4ffffc7	...u...@~..G....
0x6c72	0016000000eb6dba100000004889b424	......m.....H..$
0x6c82	a0000000eb0f4863c248c784c4a80000	......Hc.H......
0x6c92	0000000000ffca79ed488dac24a00000	.......y.H..$...
0x6ca2	0089de488d7d08e86600000085c07834	...H.}..f.....x4
0x6cb2	89debfc0165100e8	.....Q..

Identity

SHA-256	e55e33ad6adcdaffb331b91eb4384a88cb8d186c9321a26f28933f9919a0395b
Filename	x86_64
Package	e55e33ad6adcdaffb331b91eb4384a88cb8d186c9321a26f28933f9919a0395b

Origin

Source	harvest
Feed	malwarebazaar
Ecosystem	linux
Domain	abuse.ch

Timeline

First seen	4 Aug 2026 08:31 UTC
First analyzed	5 Aug 2026 10:52 UTC
Last analyzed	5 Aug 2026 10:52 UTC
Last updated	5 Aug 2026 10:52 UTC

Labeling

Label	bad
Label source	harvest
Traits version	b5ca8

Not seeing what you expected? Let us know

0x86e1	89c376ebe8cea9ffff89daf7da8910eb	..v.............
0x86f1	de9090534863ffb8e50000000f05483d	...SHc........H=
0x8701	00f0ffff4889c3760fe8a9a9ffff89da	....H..v........
0x8711	4883cbfff7da891089d85bc390909053	H.........[....S
0x8721	b83b0000000f05483d00f0ffff4889c3	.;.....H=....H..
0x8731	760fe880a9ffff89da4883cbfff7da89	v........H......
0x8741	1089d85bc390904883ec18bf07000000	...[...H........
0x8751	4889e6e817a7ffff89c2b800010000ff	H...............
0x8761	c20f4f04244883c418c39053b86c0000	..O.$H.....S.l..
0x8771	000f05483d00f0ffff4889c3760fe834	...H=....H..v..4
0x8781	a9ffff89da4883cbfff7da891089d85b	.....H.........[
0x8791	c3909053b86b0000000f05483d00f0ff	...S.k.....H=...
0x87a1	ff4889c3760fe80ca9ffff89da4883cb	.H..v........H..
0x87b1	fff7da89	....