Edit tour

Linux Analysis Report
RjkHLuzLJH.elf

Overview

General Information

Sample name:	RjkHLuzLJH.elf renamed because original name is a hash value
Original sample name:	cf16ec2a41e6cef7ad7ea57deef73006.elf
Analysis ID:	1457970
MD5:	cf16ec2a41e6cef7ad7ea57deef73006
SHA1:	4474e428b759b143da9abaff8edc58c68d8e32df
SHA256:	b505f68abadced947bf0e934b518cad13569bc46e9ae37b5918585acb5dc45af
Tags:	32armelfmirai
Infos:

Detection

Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1457970
Start date and time:	2024-06-16 10:59:28 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	RjkHLuzLJH.elf renamed because original name is a hash value
Original Sample Name:	cf16ec2a41e6cef7ad7ea57deef73006.elf
Detection:	MAL
Classification:	mal92.spre.troj.evad.linELF@0/28@701/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/RjkHLuzLJH.elf
PID:	6270
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

RjkHLuzLJH.elf (PID: 6270, Parent: 6189, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/RjkHLuzLJH.elf

RjkHLuzLJH.elf New Fork (PID: 6272, Parent: 6270)

RjkHLuzLJH.elf New Fork (PID: 6274, Parent: 6272)

gnome-session-binary New Fork (PID: 6276, Parent: 1477)

sh (PID: 6276, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6276, Parent: 1477, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

gdm3 New Fork (PID: 6281, Parent: 1320)

Default (PID: 6281, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6298, Parent: 1320)

Default (PID: 6298, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6301, Parent: 1)

dbus-daemon (PID: 6301, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gvfsd-fuse New Fork (PID: 6315, Parent: 2038)

fusermount (PID: 6315, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6317, Parent: 1)

rsyslogd (PID: 6317, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6318, Parent: 1)

dbus-daemon (PID: 6318, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6332, Parent: 1)

systemd-logind (PID: 6332, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6392, Parent: 1)

agetty (PID: 6392, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 6393, Parent: 1320)

Default (PID: 6393, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6395, Parent: 1)

agetty (PID: 6395, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6396, Parent: 1)

rsyslogd (PID: 6396, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6397, Parent: 1)

gpu-manager (PID: 6397, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6399, Parent: 6397)

sh (PID: 6399, Parent: 6397, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6400, Parent: 6399)

grep (PID: 6400, Parent: 6399, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6401, Parent: 6397)

sh (PID: 6401, Parent: 6397, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6402, Parent: 6401)

grep (PID: 6402, Parent: 6401, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6406, Parent: 6397)

sh (PID: 6406, Parent: 6397, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6409, Parent: 6406)

grep (PID: 6409, Parent: 6406, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6410, Parent: 6397)

sh (PID: 6410, Parent: 6397, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6413, Parent: 6410)

grep (PID: 6413, Parent: 6410, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6414, Parent: 6397)

sh (PID: 6414, Parent: 6397, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6415, Parent: 6414)

grep (PID: 6415, Parent: 6414, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6416, Parent: 6397)

sh (PID: 6416, Parent: 6397, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6417, Parent: 6416)

grep (PID: 6417, Parent: 6416, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6420, Parent: 6397)

sh (PID: 6420, Parent: 6397, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6421, Parent: 6420)

grep (PID: 6421, Parent: 6420, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6484, Parent: 6397)

sh (PID: 6484, Parent: 6397, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6485, Parent: 6484)

grep (PID: 6485, Parent: 6484, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6408, Parent: 1)

dbus-daemon (PID: 6408, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6425, Parent: 1)

systemd-logind (PID: 6425, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6490, Parent: 1)

generate-config (PID: 6490, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6491, Parent: 6490)

pkill (PID: 6491, Parent: 6490, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6492, Parent: 1)

gdm-wait-for-drm (PID: 6492, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6518, Parent: 1)

gdm3 (PID: 6518, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6522, Parent: 6518)

plymouth (PID: 6522, Parent: 6518, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6547, Parent: 6518)

gdm-session-worker (PID: 6547, Parent: 6518, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6551, Parent: 6547)

gdm-wayland-session (PID: 6551, Parent: 6547, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6553, Parent: 6551)

dbus-daemon (PID: 6553, Parent: 6551, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6555, Parent: 6553)

dbus-daemon New Fork (PID: 6556, Parent: 6555)

false (PID: 6556, Parent: 6555, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6557, Parent: 6551)

dbus-run-session (PID: 6557, Parent: 6551, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6558, Parent: 6557)

dbus-daemon (PID: 6558, Parent: 6557, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6561, Parent: 6518)

Default (PID: 6561, Parent: 6518, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6562, Parent: 6518)

Default (PID: 6562, Parent: 6518, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6524, Parent: 1)

accounts-daemon (PID: 6524, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6536, Parent: 6524)

language-validate (PID: 6536, Parent: 6524, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6537, Parent: 6536)

language-options (PID: 6537, Parent: 6536, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6538, Parent: 6537)

sh (PID: 6538, Parent: 6537, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6539, Parent: 6538)

locale (PID: 6539, Parent: 6538, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6540, Parent: 6538)

grep (PID: 6540, Parent: 6538, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6543, Parent: 1)

polkitd (PID: 6543, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6588, Parent: 1860)

dbus-daemon (PID: 6588, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6589, Parent: 1860)

pulseaudio (PID: 6589, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6590, Parent: 1)

rtkit-daemon (PID: 6590, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
RjkHLuzLJH.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
RjkHLuzLJH.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x21dfc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21eb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21ec4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21ed8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21eec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21f00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21f14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21f28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21f3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21f50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21f64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21f78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21f8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
RjkHLuzLJH.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x21cd8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
6270.1.00007fd700017000.00007fd70003d000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6270.1.00007fd700017000.00007fd70003d000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x21dfc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21eb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21ec4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21ed8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21eec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21f00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21f14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21f28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21f3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21f50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21f64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21f78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21f8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6270.1.00007fd700017000.00007fd70003d000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x21cd8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6274.1.00007fd700017000.00007fd70003d000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6274.1.00007fd700017000.00007fd70003d000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x21dfc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21eb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21ec4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21ed8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21eec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21f00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21f14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21f28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21f3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21f50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21f64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21f78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21f8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6274.1.00007fd700017000.00007fd70003d000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x21cd8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: RjkHLuzLJH.elf PID: 6270	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: RjkHLuzLJH.elf PID: 6270	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xbbf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbd3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbe7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbfb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc0f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc23:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc37:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc4b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc5f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc73:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc87:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc9b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcaf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcc3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcd7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xceb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd13:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd27:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd4f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: RjkHLuzLJH.elf PID: 6270	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xaa9:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: RjkHLuzLJH.elf PID: 6274	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: RjkHLuzLJH.elf PID: 6274	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x12a14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12aa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ab4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ac8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12adc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12af0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ba4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: RjkHLuzLJH.elf PID: 6274	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x128fe:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 7 entries

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6317)	Reads hosts file: /etc/hosts			Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6396)	Reads hosts file: /etc/hosts			Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6518)	Socket: unknown address family			Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6553)	Socket: unknown address family			Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: raw.kovey-net.ru
Source: global traffic	DNS traffic detected: DNS query: raw.kovey-net.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.41.dr, syslog.29.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53278
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: RjkHLuzLJH.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: RjkHLuzLJH.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6270.1.00007fd700017000.00007fd70003d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6270.1.00007fd700017000.00007fd70003d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6274.1.00007fd700017000.00007fd70003d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6274.1.00007fd700017000.00007fd70003d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: RjkHLuzLJH.elf PID: 6270, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: RjkHLuzLJH.elf PID: 6270, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: RjkHLuzLJH.elf PID: 6274, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: RjkHLuzLJH.elf PID: 6274, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 6276, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 6252, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 6253, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 6301, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 6315, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 6316, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 6317, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 6318, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 6320, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 6392, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 6276, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 6252, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 6253, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 6301, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 6315, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 6316, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 6317, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 6318, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 6320, result: successful	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	SIGKILL sent: pid: 6392, result: successful	Jump to behavior

Source: RjkHLuzLJH.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: RjkHLuzLJH.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6270.1.00007fd700017000.00007fd70003d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6270.1.00007fd700017000.00007fd70003d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6274.1.00007fd700017000.00007fd70003d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6274.1.00007fd700017000.00007fd70003d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: RjkHLuzLJH.elf PID: 6270, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: RjkHLuzLJH.elf PID: 6270, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: RjkHLuzLJH.elf PID: 6274, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: RjkHLuzLJH.elf PID: 6274, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal92.spre.troj.evad.linELF@0/28@701/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6301)	File: /proc/6301/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6315)	File: /proc/6315/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6318)	File: /proc/6318/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6408)	File: /proc/6408/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6553)	File: /proc/6553/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6588)	File: /proc/6588/mounts	Jump to behavior

Source: /usr/libexec/gsd-rfkill (PID: 6276)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 6276)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6332)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6332)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6332)	File: /run/systemd/seats/.#seat0F6YCi1	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6425)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6425)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6425)	File: /run/systemd/seats/.#seat0lryFJZ	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6425)	File: /run/systemd/users/.#127uHHqR0	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6425)	File: /run/systemd/users/.#1275WFnd0	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6425)	File: /run/systemd/seats/.#seat0rS7Gd1	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6425)	File: /run/systemd/users/.#127pJ1Qk1	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6425)	File: /run/systemd/users/.#127B1Bo8Z	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6425)	File: /run/systemd/users/.#127gSIdNZ	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6425)	File: /run/systemd/users/.#127Gf8He2	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6551)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6524)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6524)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6543)	Directory: /root/.cache	Jump to behavior

Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/RjkHLuzLJH.elf (PID: 6274)	File opened: /proc/11/stat	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6399)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6401)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6406)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6410)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6414)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6416)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6420)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6484)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6538)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Source: /bin/sh (PID: 6400)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6402)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6409)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6413)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6415)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6417)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6421)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6485)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6540)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6491)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /sbin/agetty (PID: 6392)	Reads version info: /etc/issue			Jump to behavior
Source: /sbin/agetty (PID: 6395)	Reads version info: /etc/issue			Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6518)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6518)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6524)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6524)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6317)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6317)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6396)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6396)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 6397)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/RjkHLuzLJH.elf (PID: 6272)

File: /tmp/RjkHLuzLJH.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6397)

Truncated file: /var/log/gpu-manager.log

Jump to behavior

Source: /usr/bin/pkill (PID: 6491)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6589)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /tmp/RjkHLuzLJH.elf (PID: 6270)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6317)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6392)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6395)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6396)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6397)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6547)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6589)	Queries kernel information via 'uname':	Jump to behavior

Source: RjkHLuzLJH.elf, 6270.1.0000557363c1b000.0000557363d49000.rw-.sdmp, RjkHLuzLJH.elf, 6274.1.0000557363c1b000.0000557363d49000.rw-.sdmp	Binary or memory string: csU!/etc/qemu-binfmt/arm
Source: RjkHLuzLJH.elf, 6270.1.0000557363c1b000.0000557363d49000.rw-.sdmp, RjkHLuzLJH.elf, 6274.1.0000557363c1b000.0000557363d49000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: RjkHLuzLJH.elf, 6270.1.00007fff41815000.00007fff41836000.rw-.sdmp, RjkHLuzLJH.elf, 6274.1.00007fff41815000.00007fff41836000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: RjkHLuzLJH.elf, 6270.1.00007fff41815000.00007fff41836000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.MV1Rpl
Source: RjkHLuzLJH.elf, 6274.1.00007fff41815000.00007fff41836000.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Source: RjkHLuzLJH.elf, 6270.1.00007fff41815000.00007fff41836000.rw-.sdmp	Binary or memory string: _sU/tmp/qemu-open.MV1Rpl:%
Source: RjkHLuzLJH.elf, 6270.1.00007fff41815000.00007fff41836000.rw-.sdmp, RjkHLuzLJH.elf, 6274.1.00007fff41815000.00007fff41836000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/RjkHLuzLJH.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/RjkHLuzLJH.elf

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6524)

Logged in records file read: /var/log/wtmp

Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: RjkHLuzLJH.elf, type: SAMPLE
Source: Yara match	File source: 6270.1.00007fd700017000.00007fd70003d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6274.1.00007fd700017000.00007fd70003d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RjkHLuzLJH.elf PID: 6270, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RjkHLuzLJH.elf PID: 6274, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: RjkHLuzLJH.elf, type: SAMPLE
Source: Yara match	File source: 6270.1.00007fd700017000.00007fd70003d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6274.1.00007fd700017000.00007fd70003d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RjkHLuzLJH.elf PID: 6270, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RjkHLuzLJH.elf PID: 6274, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
RjkHLuzLJH.elf	58%	ReversingLabs	Linux.Trojan.Mirai
RjkHLuzLJH.elf	41%	Virustotal		Browse
RjkHLuzLJH.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
daisy.ubuntu.com	0%	Virustotal		Browse
raw.kovey-net.ru	4%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://www.rsyslog.com	0%	Avira URL Cloud	safe
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	0%	Avira URL Cloud	safe
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	0%	Virustotal		Browse
https://www.rsyslog.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false	0%, Virustotal, Browse	unknown
raw.kovey-net.ru	45.131.111.98	true	true	4%, Virustotal, Browse	unknown
raw.kovey-net.ru. [malformed]	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.41.dr, syslog.29.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.213.35.25	unknown	United States	41231	CANONICAL-ASGB	false
45.131.111.98	raw.kovey-net.ru	Germany	398373	SERVERDESTROYERSUS	true
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
162.213.35.25	Aqua.x86.elf	Get hash	malicious	Unknown	Browse
	Ns3FqpAS8f.elf	Get hash	malicious	Unknown	Browse
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse
	Aqua.x86.elf	Get hash	malicious	Mirai	Browse
	yR5kMJRT0m.elf	Get hash	malicious	Mirai	Browse
	nLCP3IcKZ7.elf	Get hash	malicious	Mirai	Browse
	JbjpNOzTbN.elf	Get hash	malicious	Mirai	Browse
	Sp7m2mXp8K.elf	Get hash	malicious	Mirai	Browse
	Aqua.x86-20240502-1008.elf	Get hash	malicious	Unknown	Browse
	9CkHkdlOc5.elf	Get hash	malicious	Mirai	Browse
45.131.111.98	JqhZT37T3F.elf	Get hash	malicious	Mirai	Browse
	nDod2fOLjq.elf	Get hash	malicious	Mirai	Browse
	78O7BJ6Qg2.elf	Get hash	malicious	Mirai	Browse
	ZEHFQjCShK.elf	Get hash	malicious	Mirai	Browse
	haEQUvvpSG.elf	Get hash	malicious	Mirai	Browse
	7vpOTHbHoi.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	ow3g8oByWQ.elf	Get hash	malicious	Mirai, Okiru	Browse
	VsCvpuEOwx.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	k7pT1W7Hr3.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
	Ir9ftOWi9N.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	JqhZT37T3F.elf	Get hash	malicious	Mirai	Browse
	nDod2fOLjq.elf	Get hash	malicious	Mirai	Browse
	78O7BJ6Qg2.elf	Get hash	malicious	Mirai	Browse
	ZEHFQjCShK.elf	Get hash	malicious	Mirai	Browse
	haEQUvvpSG.elf	Get hash	malicious	Mirai	Browse
	9T95OqftPI.elf	Get hash	malicious	Unknown	Browse
	yM7oPd5Yxq.elf	Get hash	malicious	Unknown	Browse
	HLmuJO331U.elf	Get hash	malicious	Unknown	Browse
	7qOP4QJI3C.elf	Get hash	malicious	Unknown	Browse
	lCNMdusFkn.elf	Get hash	malicious	Unknown	Browse
109.202.202.202	JqhZT37T3F.elf	Get hash	malicious	Mirai	Browse
	oRABHevHfo.elf	Get hash	malicious	Mirai, Okiru	Browse
	5XUL3oguJq.elf	Get hash	malicious	Mirai, Okiru	Browse
	Zmc1ZshjiD.elf	Get hash	malicious	Mirai, Okiru	Browse
	SecuriteInfo.com.Trojan.Linux.GenericKD.15531.25915.5506.elf	Get hash	malicious	Unknown	Browse
	u8YztLuPIa.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	kMkAY11NhJ.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	x-3.2-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	p-p.c-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	u4Wbkh1F5v.elf	Get hash	malicious	Unknown	Browse
91.189.91.43	JqhZT37T3F.elf	Get hash	malicious	Mirai	Browse
	oRABHevHfo.elf	Get hash	malicious	Mirai, Okiru	Browse
	Zmc1ZshjiD.elf	Get hash	malicious	Mirai, Okiru	Browse
	SecuriteInfo.com.Trojan.Linux.GenericKD.15531.25915.5506.elf	Get hash	malicious	Unknown	Browse
	u8YztLuPIa.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	kMkAY11NhJ.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	p-p.c-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	u4Wbkh1F5v.elf	Get hash	malicious	Unknown	Browse
	xGt89YgAK2.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	JqhZT37T3F.elf	Get hash	malicious	Mirai	Browse
	oRABHevHfo.elf	Get hash	malicious	Mirai, Okiru	Browse
	5XUL3oguJq.elf	Get hash	malicious	Mirai, Okiru	Browse
	Zmc1ZshjiD.elf	Get hash	malicious	Mirai, Okiru	Browse
	SecuriteInfo.com.Trojan.Linux.GenericKD.15531.25915.5506.elf	Get hash	malicious	Unknown	Browse
	u8YztLuPIa.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	kMkAY11NhJ.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	x-3.2-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	p-p.c-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	u4Wbkh1F5v.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.kovey-net.ru	nDod2fOLjq.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
	7vpOTHbHoi.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	45.131.111.98
	k7pT1W7Hr3.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	45.131.111.98
daisy.ubuntu.com	JqhZT37T3F.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	83LUXZfTut.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	7G2fajlBHt.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.24
	iQYGdqlshc.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	R2OJcqnxXX.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.24
	GaSc8GMXov.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.24
	MyXrdY6BhI.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	m-p.s-l.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	a-r.m-6.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	JqhZT37T3F.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	nDod2fOLjq.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	78O7BJ6Qg2.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	ZEHFQjCShK.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	haEQUvvpSG.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	9T95OqftPI.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	yM7oPd5Yxq.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	HLmuJO331U.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	7qOP4QJI3C.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	lCNMdusFkn.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
CANONICAL-ASGB	JqhZT37T3F.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	oRABHevHfo.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	5XUL3oguJq.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	Zmc1ZshjiD.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	SecuriteInfo.com.Trojan.Linux.GenericKD.15531.25915.5506.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	u8YztLuPIa.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	kMkAY11NhJ.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	x-3.2-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	a-r.m-6.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.125.190.26
	m-i.p-s.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.125.190.26
CANONICAL-ASGB	JqhZT37T3F.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	oRABHevHfo.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	5XUL3oguJq.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	Zmc1ZshjiD.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	SecuriteInfo.com.Trojan.Linux.GenericKD.15531.25915.5506.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	u8YztLuPIa.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	kMkAY11NhJ.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	x-3.2-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	a-r.m-6.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.125.190.26
	m-i.p-s.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.125.190.26
SERVERDESTROYERSUS	JqhZT37T3F.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
	nDod2fOLjq.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
	78O7BJ6Qg2.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
	ZEHFQjCShK.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
	haEQUvvpSG.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
	7vpOTHbHoi.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	45.131.111.98
	ow3g8oByWQ.elf	Get hash	malicious	Mirai, Okiru	Browse	45.131.111.98
	VsCvpuEOwx.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	45.131.111.98
	k7pT1W7Hr3.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	45.131.111.98
	Ir9ftOWi9N.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
INIT7CH	JqhZT37T3F.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	oRABHevHfo.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	5XUL3oguJq.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	Zmc1ZshjiD.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	SecuriteInfo.com.Trojan.Linux.GenericKD.15531.25915.5506.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	u8YztLuPIa.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	kMkAY11NhJ.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	x-3.2-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	p-p.c-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	u4Wbkh1F5v.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
CANONICAL-ASGB	JqhZT37T3F.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	oRABHevHfo.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	5XUL3oguJq.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	Zmc1ZshjiD.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	SecuriteInfo.com.Trojan.Linux.GenericKD.15531.25915.5506.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	u8YztLuPIa.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	kMkAY11NhJ.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	x-3.2-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	a-r.m-6.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.125.190.26
	m-i.p-s.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.125.190.26

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/6556/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:ldv:Hv
MD5:	174D621A381C80A960BF8918609806C4
SHA1:	BA017170474C03B3992A4C916DB52D595C554D7D
SHA-256:	0DD5581D72DC6A2DACD9261AFD96733779D750A6C40D0E629EADCE704E854218
SHA-512:	39C68EFA8C60D39DEDA986FE764E04E9AABD62B5B8086D0175178839C934AEDC0561065A11C55466790AA7FE7D335D0F0F407FD1BADA369752704E75FAED89BF
Malicious:	false
Reputation:	low
Preview:	6518.

/run/systemd/seats/.#seat0F6YCi1

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0lryFJZ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0rS7Gd1

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/users/.#1275WFnd0

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.30310779156777
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6RJg3QrJ4Mhz02thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBuJg3QrJJthQHtPYqi
MD5:	7B01767909224A9FB0A2B3DA13299CAC
SHA1:	3209899BADA7819674E9B5F978935B3CC1B06E69
SHA-256:	9EF61D2E8F9EB4AB3A08A514884D36497C167239E93D7F09A3A0D08537DF3878
SHA-512:	A4CF37B05A96B48AD979775A60CFBB792BF3011FB55459E6269E892883F1AF5B3A010DB80E3B2FE849FA4330E3BF25647038036C90FD2B87E22C1A98D2CB309E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12705.REALTIME=1718528466795253.MONOTONIC=467881018.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127B1Bo8Z

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.3369558741880425
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJg3QDTTvCEQ5ZUVUb/g206qodt1:SbFuFyL3BVgdL87iesnAiRJg3QrJ4MS5
MD5:	085108EE92DBE2F5E1AB442A27171E4E
SHA1:	5763765E58604D022038381B1CFCA71712B024AA
SHA-256:	ECAC97488838CE8B3FC8E8E783F12A336E5A07A9A99FFEA60DA6309D287C8818
SHA-512:	CBFBEFD67954C934070A706B490DFEB9A76FD5948267F8554CF2401A8C17EE59574B501AD88693F41B4251F6A61D3050302FB59715CEF4AD14052B8E6C819329
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1718528466795253.MONOTONIC=467881018.LAST_SESSION_TIMESTAMP=467959102.

/run/systemd/users/.#127Gf8He2

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.4807300041259
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6BJg3QrJ4MSgt6DhP/:qgFq30dABibBSJg3QrJ+gIDhP/
MD5:	F21ECC4B040B25C12050FCE85DDD4F67
SHA1:	7B96EC11D9938BE83605CF6BA85737C86FFA1476
SHA-256:	66671E859E676F2B4C825E81AA0439B13AEC910B10A74C271520A302D11343C6
SHA-512:	C07D6345BA6C72CDC9188B9E779207E15A9385A00DCEB5CF9151D86ABD022D77361C110E329685D4419087102E20B9338B18462AC6EF1B6A59A1EE26101A72E8
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12767.REALTIME=1718528466795253.MONOTONIC=467881018.LAST_SESSION_TIMESTAMP=467959102.

/run/systemd/users/.#127gSIdNZ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.4807300041259
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6BJg3QrJ4MSgt6DhP/:qgFq30dABibBSJg3QrJ+gIDhP/
MD5:	F21ECC4B040B25C12050FCE85DDD4F67
SHA1:	7B96EC11D9938BE83605CF6BA85737C86FFA1476
SHA-256:	66671E859E676F2B4C825E81AA0439B13AEC910B10A74C271520A302D11343C6
SHA-512:	C07D6345BA6C72CDC9188B9E779207E15A9385A00DCEB5CF9151D86ABD022D77361C110E329685D4419087102E20B9338B18462AC6EF1B6A59A1EE26101A72E8
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12767.REALTIME=1718528466795253.MONOTONIC=467881018.LAST_SESSION_TIMESTAMP=467959102.

/run/systemd/users/.#127pJ1Qk1

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.30310779156777
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6RJg3QrJ4Mhz02thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBuJg3QrJJthQHtPYqi
MD5:	7B01767909224A9FB0A2B3DA13299CAC
SHA1:	3209899BADA7819674E9B5F978935B3CC1B06E69
SHA-256:	9EF61D2E8F9EB4AB3A08A514884D36497C167239E93D7F09A3A0D08537DF3878
SHA-512:	A4CF37B05A96B48AD979775A60CFBB792BF3011FB55459E6269E892883F1AF5B3A010DB80E3B2FE849FA4330E3BF25647038036C90FD2B87E22C1A98D2CB309E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12705.REALTIME=1718528466795253.MONOTONIC=467881018.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127uHHqR0

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:se:se
MD5:	6200AB0491AC3BCAD6F94A5000EA3322
SHA1:	41BF6D083FA99DF2F66D605DE966B38F073919B8
SHA-256:	97ED4D779AF72312183BFA6B4B67A87B39097FC02489F230E90501842C1DD6E5
SHA-512:	4400FE4AEC0901EBF463CA26F19F5B8B2DC7C3F03451EFD35E6F83695A2B3D5E2D1FD9F229C4EA5C51A9D712CCA4F864DC7FB5E2C41CB226A9F310305F608392
Malicious:	false
Preview:	6589.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:gCsXlXEWtl/clpvt:gf+ylcpv
MD5:	63562B19883278900FE7A4418AB94DE9
SHA1:	2CE3B1A23B33D8A5D360AC39EB63A3736F2FE53F
SHA-256:	4ADB464555EFF1510CE47F3C11312378A0FBB9FD30D9F6447B3894C1592E5ADA
SHA-512:	3DF3A72A531B3DF22BFB60CF4E2F0B56BA30ED3F6F06DE48EBC082935AA1B30E74893D1647ED3330189811DC4F6AFDB9FAD00BB6F390555DFDE4F8E3DE3A38CD
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN.....................................................................................................................................................................................................................................................................................................nf.,......................................

/tmp/qemu-open.MV1Rpl (deleted)

Download File

Process:	/tmp/RjkHLuzLJH.elf
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	4.415061012203069
Encrypted:	false
SSDEEP:	3:Tg/ObyvtI8HJN:TgGbyv3JN
MD5:	37F687B24756B8D33F9112F77FEAF544
SHA1:	4CBA44B921EE3F4505E026A2B36AA4E62D9E3086
SHA-256:	BFE091E3CA62AF1D4F7A773648F4E97F3E002C91FCC9A2EFEA734AA14A9700DB
SHA-512:	282B07A87C61150B00FE1462398FF465D0EB77163B2FD0932DB436AFA988D92566B8FF8D874B53CF815CA411F937DA2AD77D796275A12B767992CF07876D14C2
Malicious:	false
Preview:	/tmp/RjkHLuzLJH.elf.nwlrbbmqbh

/var/lib/AccountsService/users/gdm.HY68O2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1537
Entropy (8bit):	4.892855860453657
Encrypted:	false
SSDEEP:	24:CZetZ4+jYR5eAvmlA2+VwH/0pYrMJrKYwrCQU:svmafVwHGYrSrK3rCn
MD5:	F1A5C9BF90EAABBD57F7BC4677B6F57B
SHA1:	AEEB37731E92480353D8D45F2225936E2462DF98
SHA-256:	638C74FB6718F9F4DA89FD239BED9B6A3D217FC751F5F09B49D77F4DA6909644
SHA-512:	EC447283F1DD94B0EE680F5EC42573EE39F075E31BA97AAF41506E32873FC560D8C59BAF4C635D9D2A671B743F9B4E217C9D86433F11C3020397657B03CD3234
Malicious:	false
Preview:	Jun 16 04:00:46 galassia systemd-logind[6425]: Failed to add user by file name 1000, ignoring: Invalid argument.Jun 16 04:00:46 galassia systemd-logind[6425]: Failed to add user by file name 127, ignoring: Invalid argument.Jun 16 04:00:46 galassia systemd-logind[6425]: User enumeration failed: Invalid argument.Jun 16 04:00:46 galassia systemd-logind[6425]: User of session 2 not known..Jun 16 04:00:46 galassia systemd-logind[6425]: User of session c1 not known..Jun 16 04:00:46 galassia systemd-logind[6425]: Session enumeration failed: No such file or directory.Jun 16 04:00:46 galassia systemd-logind[6425]: Watching system buttons on /dev/input/event0 (Power Button).Jun 16 04:00:47 galassia systemd-logind[6425]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Jun 16 04:00:47 galassia systemd-logind[6425]: New seat seat0..Jun 16 04:01:06 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Jun 16 04:

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	6790
Entropy (8bit):	4.7087724646437525
Encrypted:	false
SSDEEP:	48:z9pcV9e79+B9JX971X9SK9YeS9Q6MaqfkoyiJpdyi81i9SNkDv092iS0dLBQGeEx:zXcSEL3XRSvySPMo
MD5:	65AFC7721DA515A14982AA3C999DB6E7
SHA1:	9928DBCC9EFCBC7EFA69992C3195D477A8BC25B1
SHA-256:	4D7AE09A7D1616394A263BF87C7E6648E497D3AB5FF22129870BB6293C60B711
SHA-512:	8A88EF2A079B45EA3503C5176C51106E15F247A03C0C267F9B696C042A42B9DC6D3049D91E415CC360DD2A4E8E8BB130768D6E724FA79DEEA258D9694C7C34D4
Malicious:	false
Preview:	Jun 16 04:00:42 galassia kernel: [ 441.972996] blocking signal 9: 6274 -> 2048.Jun 16 04:00:42 galassia kernel: [ 443.041852] New task spawned: old: (tgid 6397, tid 6397), new (tgid: 6399, tid: 6399).Jun 16 04:00:42 galassia kernel: [ 443.138781] New task spawned: old: (tgid 6399, tid 6399), new (tgid: 6400, tid: 6400).Jun 16 04:00:42 galassia kernel: [ 443.484672] New task spawned: old: (tgid 6397, tid 6397), new (tgid: 6401, tid: 6401).Jun 16 04:00:42 galassia kernel: [ 443.566695] New task spawned: old: (tgid 6401, tid 6401), new (tgid: 6402, tid: 6402).Jun 16 04:00:42 galassia kernel: [ 443.584889] New task spawned: old: (tgid 6396, tid 6396), new (tgid: 6396, tid: 6403).Jun 16 04:00:42 galassia kernel: [ 443.586711] New task spawned: old: (tgid 6396, tid 6396), new (tgid: 6396, tid: 6404).Jun 16 04:00:42 galassia kernel: [ 443.590420] New task spawned: old: (tgid 6396, tid 6403), new (tgid: 6396, tid: 6405).Jun 16 04:00:43 galassia kernel: [ 443.852784] New task spawned:

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (317)
Category:	dropped
Size (bytes):	31875
Entropy (8bit):	5.037316138831566
Encrypted:	false
SSDEEP:	768:e8AEWjlb/t+3z35JCosC+7HxHg8K7oUOKzP1LVRnwuqc4iu0DZVvR3LFqsweuE4y:/TkIFRn3
MD5:	46517EB5364F5BBE39C9D715DD2C2C59
SHA1:	93D6386EDF1209A546B7DECE50296DD038E45930
SHA-256:	EBCBCAB30CD2B7DD4DF1DB5D67D6043AEBB6668F689198AE9238A7BA959FAEF7
SHA-512:	8F32AAC395E48DE6351B72E42146F120346D77C5844FC6DB846A146E444318CF70D2BADE2316A69055B40B2B714B49287D58194D6CA05F134353C3AF2CD1569F
Malicious:	false
Preview:	Jun 16 04:00:41 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Jun 16 04:00:41 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Jun 16 04:00:41 galassia systemd[1]: dbus.service: Main process exited, code=killed, status=9/KILL.Jun 16 04:00:41 galassia systemd[1]: dbus.service: Failed with result 'signal'..Jun 16 04:00:41 galassia systemd[1]: whoopsie.service: Main process exited, code=killed, status=9/KILL.Jun 16 04:00:41 galassia systemd[1]: whoopsie.service: Failed with result 'signal'..Jun 16 04:00:41 galassia systemd[1]: getty@tty2.service: Succeeded..Jun 16 04:00:41 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 2..Jun 16 04:00:41 galassia systemd[1]: getty@tty2.service: Scheduled restart job, restart counter is at 1..Jun 16 04:00:41 galassia systemd[1]: Stopped Getty on tty2..Jun 16 04:00:41 galassia systemd[1]: Started Getty on tty2..Jun 16 04:00:41 galassia systemd[1]: Stopped System Lo

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:gCsXlXEWtl/clpvt:gf+ylcpv
MD5:	63562B19883278900FE7A4418AB94DE9
SHA1:	2CE3B1A23B33D8A5D360AC39EB63A3736F2FE53F
SHA-256:	4ADB464555EFF1510CE47F3C11312378A0FBB9FD30D9F6447B3894C1592E5ADA
SHA-512:	3DF3A72A531B3DF22BFB60CF4E2F0B56BA30ED3F6F06DE48EBC082935AA1B30E74893D1647ED3330189811DC4F6AFDB9FAD00BB6F390555DFDE4F8E3DE3A38CD
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN.....................................................................................................................................................................................................................................................................................................nf.,......................................

Source: RjkHLuzLJH.elf	ReversingLabs: Detection: 57%
Source: RjkHLuzLJH.elf	Virustotal: Detection: 40%			Perma Link

Source: global traffic	TCP traffic: 192.168.2.23:53516 -> 45.131.111.98:1312
Source: global traffic	TCP traffic: 192.168.2.23:50026 -> 89.190.156.145:7733

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	5.71808310178643
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	RjkHLuzLJH.elf
File size:	171'296 bytes
MD5:	cf16ec2a41e6cef7ad7ea57deef73006
SHA1:	4474e428b759b143da9abaff8edc58c68d8e32df
SHA256:	b505f68abadced947bf0e934b518cad13569bc46e9ae37b5918585acb5dc45af
SHA512:	c2dfc7f0ca57bd98130314563b72a6d0b4baffbe8900723bf8a81bdab033df57bd931246c2ae012f8605492bf6307aeae8018e2b546c8c156d507553d75809d6
SSDEEP:	3072:yKTogAYlK95drZ1ZaG4xTLQuGrxN2Uij:TTogAd9HVnaG4x/QVr72Uij
TLSH:	13F31941F8815F23C6D622BBFB5E428D372657A9D3EE72079D212F20378685B0E77642
File Content Preview:	.ELF...a..........(.........4...........4. ...(......................R...R.............. R.. R.. R..0I..............Q.td..................................-...L."...V...........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	170896
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x21990	0x0	0x6	AX	16
.fini	PROGBITS	0x29a40	0x21a40	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x29a54	0x21a54	0x37c8	0x0	0x2	A	4
.ctors	PROGBITS	0x35220	0x25220	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x3522c	0x2522c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x35240	0x25240	0x4910	0x0	0x3	WA	32
.bss	NOBITS	0x39b50	0x29b50	0x46d8	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x29b50	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x2521c	0x2521c	6.1151	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x25220	0x35220	0x35220	0x4930	0x9008	0.4239	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jun 16, 2024 11:00:40.687416077 CEST	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Jun 16, 2024 11:02:00.708333969 CEST	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jun 16, 2024 11:00:34.465224028 CEST	8.8.8.8	192.168.2.23	0x1360	No error (0)	raw.kovey-net.ru	45.131.111.98	A (IP address)	IN (0x0001)	false
Jun 16, 2024 11:00:41.174601078 CEST	8.8.8.8	192.168.2.23	0xc295	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Jun 16, 2024 11:00:41.174601078 CEST	8.8.8.8	192.168.2.23	0xc295	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-06-16 09:00:53 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2024-06-16 09:00:53 UTC	25	IN	HTTP/1.1 100 Continue
2024-06-16 09:00:53 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2024-06-16 09:00:53 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2024-06-16 09:00:53 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2024-06-16 09:00:53 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2024-06-16 09:00:53 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2024-06-16 09:00:53 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2024-06-16 09:00:53 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2024-06-16 09:00:53 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2024-06-16 09:00:53 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2024-06-16 09:00:53 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2024-06-16 09:00:54 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Sun, 16 Jun 2024 09:00:54 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 970 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	09:00:33
Start date (UTC):	16/06/2024
Path:	/tmp/RjkHLuzLJH.elf
Arguments:	/tmp/RjkHLuzLJH.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	09:00:35
Start date (UTC):	16/06/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	09:00:36
Start date (UTC):	16/06/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	09:00:37
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	09:00:39
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	09:00:40
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	09:00:47
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	09:00:41
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	09:00:42
Start date (UTC):	16/06/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	09:00:43
Start date (UTC):	16/06/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	09:00:44
Start date (UTC):	16/06/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report RjkHLuzLJH.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6556/oom_score_adj

/run/gdm3.pid

/run/systemd/seats/.#seat0F6YCi1

/run/systemd/seats/.#seat0lryFJZ

/run/systemd/seats/.#seat0rS7Gd1

/run/systemd/users/.#1275WFnd0

/run/systemd/users/.#127B1Bo8Z

/run/systemd/users/.#127Gf8He2

/run/systemd/users/.#127gSIdNZ

/run/systemd/users/.#127pJ1Qk1

/run/systemd/users/.#127uHHqR0

/run/user/1000/pulse/pid

/run/utmp

/tmp/qemu-open.MV1Rpl (deleted)

/var/lib/AccountsService/users/gdm.HY68O2

/var/lib/ubuntu-drivers-common/last_gfx_boot

/var/log/auth.log

/var/log/gpu-manager.log

/var/log/kern.log

/var/log/syslog

/var/log/wtmp

Static File Info

General

Linux Analysis Report
RjkHLuzLJH.elf

Start time (UTC):	09:00:45
Start date (UTC):	16/06/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	09:00:46
Start date (UTC):	16/06/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	09:00:48
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	09:00:52
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	09:01:02
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	09:01:03
Start date (UTC):	16/06/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	09:01:04
Start date (UTC):	16/06/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	09:01:07
Start date (UTC):	16/06/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	09:01:08
Start date (UTC):	16/06/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	09:02:07
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75