Edit tour

Linux Analysis Report
byte.arm7.elf

Overview

General Information

Sample name:	byte.arm7.elf
Analysis ID:	1551145
MD5:	b3f80cf126fef93601c6710fc02855b4
SHA1:	e36c00033f3c977f7bd8a1dd740885c27ba9581f
SHA256:	794fa0280e56a929306cc43b10b1c9f191265868a8fbc3a1ed3f5a905fb65ceb
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai, Okiru

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Yara detected Okiru

Contains symbols with names commonly found in malware

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Found strings indicative of a multi-platform dropper

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads the 'hosts' file potentially containing internal network hosts

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1551145
Start date and time:	2024-11-07 14:43:40 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	byte.arm7.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/1044@1/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
VT rate limit hit for: byte.arm7.elf

Runtime Messages

Command:	/tmp/byte.arm7.elf
PID:	5440
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

byte.arm7.elf (PID: 5440, Parent: 5366, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/byte.arm7.elf

byte.arm7.elf New Fork (PID: 5442, Parent: 5440)

byte.arm7.elf New Fork (PID: 5443, Parent: 5440)

byte.arm7.elf New Fork (PID: 5446, Parent: 5440)

byte.arm7.elf New Fork (PID: 5448, Parent: 5446)

byte.arm7.elf New Fork (PID: 5449, Parent: 5446)

byte.arm7.elf New Fork (PID: 5451, Parent: 5446)

byte.arm7.elf New Fork (PID: 5453, Parent: 5446)

systemd New Fork (PID: 5463, Parent: 1)

journalctl (PID: 5463, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 5489, Parent: 1)

dbus-daemon (PID: 5489, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5496, Parent: 1)

rsyslogd (PID: 5496, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5497, Parent: 2935)

pulseaudio (PID: 5497, Parent: 2935, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

gvfsd-fuse New Fork (PID: 5498, Parent: 3122)

fusermount (PID: 5498, Parent: 3122, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 5504, Parent: 1)

systemd-journald (PID: 5504, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5505, Parent: 1)

dbus-daemon (PID: 5505, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5506, Parent: 1)

systemd-journald (PID: 5506, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5507, Parent: 1)

rsyslogd (PID: 5507, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5513, Parent: 1)

systemd-logind (PID: 5513, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5570, Parent: 1)

dbus-daemon (PID: 5570, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gdm3 New Fork (PID: 5571, Parent: 1400)

Default (PID: 5571, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5572, Parent: 1400)

Default (PID: 5572, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5573, Parent: 1)

rsyslogd (PID: 5573, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

gdm3 New Fork (PID: 5574, Parent: 1400)

Default (PID: 5574, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5575, Parent: 1)

systemd-journald (PID: 5575, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5579, Parent: 1)

systemd-logind (PID: 5579, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5636, Parent: 1)

dbus-daemon (PID: 5636, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5637, Parent: 1)

rsyslogd (PID: 5637, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5640, Parent: 1)

gpu-manager (PID: 5640, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5644, Parent: 5640)

sh (PID: 5644, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5645, Parent: 5644)

grep (PID: 5645, Parent: 5644, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5646, Parent: 5640)

sh (PID: 5646, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5647, Parent: 5646)

grep (PID: 5647, Parent: 5646, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5648, Parent: 5640)

sh (PID: 5648, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5649, Parent: 5648)

grep (PID: 5649, Parent: 5648, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5650, Parent: 5640)

sh (PID: 5650, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5651, Parent: 5650)

grep (PID: 5651, Parent: 5650, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5652, Parent: 5640)

sh (PID: 5652, Parent: 5640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5653, Parent: 5652)

grep (PID: 5653, Parent: 5652, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

systemd New Fork (PID: 5654, Parent: 1)

generate-config (PID: 5654, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5656, Parent: 5654)

pkill (PID: 5656, Parent: 5654, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5657, Parent: 1)

rsyslogd (PID: 5657, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5658, Parent: 1)

systemd-journald (PID: 5658, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5661, Parent: 1)

systemd-logind (PID: 5661, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5718, Parent: 1)

dbus-daemon (PID: 5718, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5719, Parent: 1)

gpu-manager (PID: 5719, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5720, Parent: 5719)

sh (PID: 5720, Parent: 5719, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5721, Parent: 5720)

grep (PID: 5721, Parent: 5720, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5722, Parent: 5719)

sh (PID: 5722, Parent: 5719, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5723, Parent: 5722)

grep (PID: 5723, Parent: 5722, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5726, Parent: 5719)

sh (PID: 5726, Parent: 5719, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5727, Parent: 5726)

grep (PID: 5727, Parent: 5726, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5728, Parent: 5719)

sh (PID: 5728, Parent: 5719, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5729, Parent: 5728)

grep (PID: 5729, Parent: 5728, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5730, Parent: 1)

dbus-daemon (PID: 5730, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5731, Parent: 1)

generate-config (PID: 5731, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5732, Parent: 5731)

pkill (PID: 5732, Parent: 5731, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5733, Parent: 1)

systemd-journald (PID: 5733, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5734, Parent: 1)

dbus-daemon (PID: 5734, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5737, Parent: 1)

systemd-logind (PID: 5737, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5794, Parent: 1)

gpu-manager (PID: 5794, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5795, Parent: 5794)

sh (PID: 5795, Parent: 5794, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5796, Parent: 5795)

grep (PID: 5796, Parent: 5795, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5797, Parent: 5794)

sh (PID: 5797, Parent: 5794, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5798, Parent: 5797)

grep (PID: 5798, Parent: 5797, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5799, Parent: 5794)

sh (PID: 5799, Parent: 5794, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5800, Parent: 5799)

grep (PID: 5800, Parent: 5799, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5801, Parent: 5794)

sh (PID: 5801, Parent: 5794, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5802, Parent: 5801)

grep (PID: 5802, Parent: 5801, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5803, Parent: 1)

generate-config (PID: 5803, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5804, Parent: 5803)

pkill (PID: 5804, Parent: 5803, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5805, Parent: 1)

systemd-journald (PID: 5805, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5808, Parent: 1)

systemd-logind (PID: 5808, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5865, Parent: 1)

dbus-daemon (PID: 5865, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5866, Parent: 1)

gpu-manager (PID: 5866, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5867, Parent: 5866)

sh (PID: 5867, Parent: 5866, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5868, Parent: 5867)

grep (PID: 5868, Parent: 5867, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5869, Parent: 5866)

sh (PID: 5869, Parent: 5866, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5872, Parent: 5869)

grep (PID: 5872, Parent: 5869, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5873, Parent: 5866)

sh (PID: 5873, Parent: 5866, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5874, Parent: 5873)

grep (PID: 5874, Parent: 5873, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5875, Parent: 5866)

sh (PID: 5875, Parent: 5866, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5876, Parent: 5875)

grep (PID: 5876, Parent: 5875, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5878, Parent: 1)

generate-config (PID: 5878, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5879, Parent: 5878)

pkill (PID: 5879, Parent: 5878, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5880, Parent: 1)

systemd-journald (PID: 5880, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5883, Parent: 1)

systemd-logind (PID: 5883, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5940, Parent: 1)

dbus-daemon (PID: 5940, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5941, Parent: 1)

gpu-manager (PID: 5941, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5942, Parent: 5941)

sh (PID: 5942, Parent: 5941, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5943, Parent: 5942)

grep (PID: 5943, Parent: 5942, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5944, Parent: 5941)

sh (PID: 5944, Parent: 5941, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5945, Parent: 5944)

grep (PID: 5945, Parent: 5944, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5946, Parent: 5941)

sh (PID: 5946, Parent: 5941, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5947, Parent: 5946)

grep (PID: 5947, Parent: 5946, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5948, Parent: 5941)

sh (PID: 5948, Parent: 5941, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5949, Parent: 5948)

grep (PID: 5949, Parent: 5948, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5950, Parent: 5941)

sh (PID: 5950, Parent: 5941, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5951, Parent: 5950)

grep (PID: 5951, Parent: 5950, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

systemd New Fork (PID: 5952, Parent: 1)

dbus-daemon (PID: 5952, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5953, Parent: 1)

generate-config (PID: 5953, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5954, Parent: 5953)

pkill (PID: 5954, Parent: 5953, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5955, Parent: 1)

systemd-journald (PID: 5955, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5958, Parent: 1)

systemd-logind (PID: 5958, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6019, Parent: 1)

systemd-logind (PID: 6019, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6076, Parent: 1)

gpu-manager (PID: 6076, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6077, Parent: 6076)

sh (PID: 6077, Parent: 6076, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6078, Parent: 6077)

grep (PID: 6078, Parent: 6077, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6080, Parent: 6076)

sh (PID: 6080, Parent: 6076, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6081, Parent: 6080)

grep (PID: 6081, Parent: 6080, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6082, Parent: 6076)

sh (PID: 6082, Parent: 6076, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6083, Parent: 6082)

grep (PID: 6083, Parent: 6082, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6084, Parent: 6076)

sh (PID: 6084, Parent: 6076, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6085, Parent: 6084)

grep (PID: 6085, Parent: 6084, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6079, Parent: 1)

dbus-daemon (PID: 6079, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6086, Parent: 1)

generate-config (PID: 6086, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6088, Parent: 6086)

pkill (PID: 6088, Parent: 6086, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6087, Parent: 1)

dbus-daemon (PID: 6087, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6089, Parent: 1)

systemd-journald (PID: 6089, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6090, Parent: 1)

dbus-daemon (PID: 6090, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6093, Parent: 1)

systemd-logind (PID: 6093, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6150, Parent: 1)

gpu-manager (PID: 6150, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6151, Parent: 6150)

sh (PID: 6151, Parent: 6150, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6152, Parent: 6151)

grep (PID: 6152, Parent: 6151, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

systemd New Fork (PID: 6153, Parent: 1)

dbus-daemon (PID: 6153, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6154, Parent: 1)

generate-config (PID: 6154, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6155, Parent: 6154)

pkill (PID: 6155, Parent: 6154, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6156, Parent: 1)

dbus-daemon (PID: 6156, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6157, Parent: 1)

systemd-journald (PID: 6157, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6160, Parent: 1)

systemd-logind (PID: 6160, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6219, Parent: 1)

systemd-logind (PID: 6219, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6221, Parent: 1)

systemd-journald (PID: 6221, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6279, Parent: 1)

systemd-journald (PID: 6279, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6282, Parent: 1)

systemd-logind (PID: 6282, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6341, Parent: 1)

systemd-logind (PID: 6341, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6343, Parent: 1)

systemd-journald (PID: 6343, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6401, Parent: 1)

systemd-journald (PID: 6401, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6427, Parent: 1)

generate-config (PID: 6427, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

systemd New Fork (PID: 6429, Parent: 1)

gpu-manager (PID: 6429, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

systemd New Fork (PID: 6430, Parent: 1)

generate-config (PID: 6430, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

systemd New Fork (PID: 6431, Parent: 1)

gpu-manager (PID: 6431, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

systemd New Fork (PID: 6432, Parent: 1)

plymouth (PID: 6432, Parent: 1, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: /bin/plymouth quit

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
byte.arm7.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
byte.arm7.elf	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
byte.arm7.elf	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
byte.arm7.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
byte.arm7.elf	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x1c8b0:$x1: POST /cdn-cgi/ 0x1e078:$s1: LCOGQGPTGP
byte.arm7.elf	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x1c8b0:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5453.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5453.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5453.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5453.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x1c8b0:$x1: POST /cdn-cgi/ 0x1e078:$s1: LCOGQGPTGP
5453.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x1c8b0:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
5440.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5440.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5440.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5440.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x1c8b0:$x1: POST /cdn-cgi/ 0x1e078:$s1: LCOGQGPTGP
5440.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x1c8b0:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
5442.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5442.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5442.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5442.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x1c8b0:$x1: POST /cdn-cgi/ 0x1e078:$s1: LCOGQGPTGP
5442.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x1c8b0:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
5451.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5451.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5451.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5451.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x1c8b0:$x1: POST /cdn-cgi/ 0x1e078:$s1: LCOGQGPTGP
5451.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x1c8b0:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
5443.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5443.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5443.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5443.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x1c8b0:$x1: POST /cdn-cgi/ 0x1e078:$s1: LCOGQGPTGP
5443.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x1c8b0:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
5446.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5446.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5446.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5446.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x1c8b0:$x1: POST /cdn-cgi/ 0x1e078:$s1: LCOGQGPTGP
5446.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x1c8b0:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
Process Memory Space: byte.arm7.elf PID: 5440	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.arm7.elf PID: 5440	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: byte.arm7.elf PID: 5442	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.arm7.elf PID: 5442	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: byte.arm7.elf PID: 5443	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.arm7.elf PID: 5443	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: byte.arm7.elf PID: 5446	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.arm7.elf PID: 5446	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: byte.arm7.elf PID: 5451	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.arm7.elf PID: 5451	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: byte.arm7.elf PID: 5453	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.arm7.elf PID: 5453	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Click to see the 37 entries

String: ;httpurl=POST'=byte/proc/%d/net/tcp %*d: %*x:%x/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraJoshohajime902i13BzSxLxBxeYHOHO-LUGO7HOHO-U79OLJuYfouyf87NiGGeR69xdSO190Ij1XLOLKIKEEEDDEekjheory98escansh4MDMAfdevalvexscanspcMELTEDNINJAREALZflexsonskidsscanx86MISAKI-U79OLfoAxi102kxeswodjwodjwojMmKiy7f87lfreecookiex86sysgpufrgegesysupdater0DnAzepdNiGGeRD0nks69frgreu0x766f6964NiGGeRd0nks1337gafturasgbsigboa120i3UI49OaF3geaevaiolmao123123aOfurain0n4H34DggTrexewwasads1293194hjXDOthLaLosnggtwget-log1337SoraLOADERSAIAKINAggtq1378bfp919GRB1Q2SAIAKUSOggtr14FaSEXSLAVE1337ggtt1902a3u912u3u4haetrghbr19ju3dSORAojkf120hehahejeje922U2JDJA901F91SlaVLav12helpmedaddthhhhh2wgg9qphbqSlav3Th3seD3viceshzSmYZjYMQ5GbfSoRAxD123LOLiaGv5aA3SoRAxD420LOLinsomni640277SoraBeReppin1337ipcamCache66tlGg9QjUYfouyf876ke3TOKYO3lyEeaXul2dULCVxh93OfjHZ2zTY2gD6MZvKc7KU6rmMkiy6f87lA023UU4U24UIUTheWeekndmioribitchesA5p9TheWeekndsmnblkjpoiAbAdTokyosnebAkiruU8inTznetstatsAlexW9RCAKM20TnewnetwordAyo215WordnloadsBAdAsVWordmanenotyakuzaaBelchWordnetsobpBigN0gg0r420X0102I34fofhasfhiafhoiX19I239124UIUoismXSHJEHHEIIHWOolsVNwo12DeportedDeportedXkTer0GbA1onry0v03FortniteDownLOLZY0urM0mGaypussyfartlmaojkGrAcEnIgGeRaNnYvdGkqndCOqGeoRBe6BEGuiltyCrownZEuS69s4beBsEQhdHOHO-KSNDOZEuz69sat1234aj93hJ23scanHAalie293z0k2LscanJoshoARMHellInSideayyyGangShitscanJoshoARM5HighFryb1glscanJoshoARM6IWhPyucDbJboatnetzscanJoshoARM7IuYgujeIqnbtbatrtahzexsexscanJoshoM68KJJDUHEWBBBIBscanJoshoMIPSJSDGIEVIVAVIGcKbVkzGOPascanJoshoMPSLccADscanJoshoPPCKAZEN-OIU97chickenxingsscanJoshoSH4yakuskzm8KAZEN-PO78HcleanerscanJoshoSPCKAZEN-U79OLdbeefscanJoshoX86yakuz4c24KETASHI32ddrwelperscanarm5zPnr6HpQj2Kaishi-Iz90Ydeexecscanarm6zdrtfxcgyKatrina32doCP3fVjscanarm7zxcfhuioKsif91je39scanm68kKuasadvrhelperl33t_feetl33tl33tfeetscanmipsKuasaBinsMateeQnOhRk85rscanmpslLOLHHHOHOHBUIeXK20CL12ZnyamezyQBotBladeSPOOKYhikariwasherep4029x91xx32uhj4gbejhwizardzhra.outboatnetdbgcondiheroshimaskid.dbglzrdPownedSecurity69.aresfxlyazsxhyUNSTABLEunstable_is_the_story_of_the_universemoobotjnsd9sdoilayourmomgaeissdfjiougsiojOasisSEGRJIJHFVNHSNHEIHFOSapep999KOWAI-BAdAsVKOWAI-SADjHKipU7Ylairdropmalwareyour_verry_fucking_gayBig-Bro-Brightsefaexecshirololieagle.For-Gai-Mezy0x6axNLcloqkisvspookymythSwergjmioGKILLEJW(IU(JIWERGFJGJWJRGHetrhwewrtheIuFdKssCxzjSDFJIjioOnrYoXd666ewrtkjokethajbdf89wu823AAaasrdgsWsGA4@F6FGhostWuzHere666BOGOMIPSbeastmodedvrHelperbestmodesfc6aJfIuYDemon.xeno-is-godICY-P-0ODIJgSHUIHIfhwrgLhu87VhvQPzlunadakuexecbinTacoBellGodYololigangExecutionor

Source: /usr/bin/pkill (PID: 5732)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5804)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5879)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6088)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 5496)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5507)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5637)	Reads hosts file: /etc/hosts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 5506)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5575)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5658)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5733)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5805)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5880)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5955)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6089)	Socket: unknown address family	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 113.134.232.99
Source: unknown	TCP traffic detected without corresponding DNS query: 92.131.233.99
Source: unknown	TCP traffic detected without corresponding DNS query: 103.164.240.38
Source: unknown	TCP traffic detected without corresponding DNS query: 147.14.61.97
Source: unknown	TCP traffic detected without corresponding DNS query: 149.235.114.107
Source: unknown	TCP traffic detected without corresponding DNS query: 180.113.170.160
Source: unknown	TCP traffic detected without corresponding DNS query: 5.178.95.74
Source: unknown	TCP traffic detected without corresponding DNS query: 97.31.31.106
Source: unknown	TCP traffic detected without corresponding DNS query: 78.228.9.31
Source: unknown	TCP traffic detected without corresponding DNS query: 188.123.155.25
Source: unknown	TCP traffic detected without corresponding DNS query: 100.249.17.230
Source: unknown	TCP traffic detected without corresponding DNS query: 45.57.82.195
Source: unknown	TCP traffic detected without corresponding DNS query: 170.7.236.78
Source: unknown	TCP traffic detected without corresponding DNS query: 74.72.100.170
Source: unknown	TCP traffic detected without corresponding DNS query: 53.128.98.71
Source: unknown	TCP traffic detected without corresponding DNS query: 91.109.28.91
Source: unknown	TCP traffic detected without corresponding DNS query: 63.73.103.108
Source: unknown	TCP traffic detected without corresponding DNS query: 160.176.13.149
Source: unknown	TCP traffic detected without corresponding DNS query: 16.237.171.37
Source: unknown	TCP traffic detected without corresponding DNS query: 60.7.55.6
Source: unknown	TCP traffic detected without corresponding DNS query: 170.22.195.38
Source: unknown	TCP traffic detected without corresponding DNS query: 208.208.180.145
Source: unknown	TCP traffic detected without corresponding DNS query: 101.174.249.112
Source: unknown	TCP traffic detected without corresponding DNS query: 181.228.235.168
Source: unknown	TCP traffic detected without corresponding DNS query: 24.15.146.173
Source: unknown	TCP traffic detected without corresponding DNS query: 193.165.180.210
Source: unknown	TCP traffic detected without corresponding DNS query: 218.203.35.206
Source: unknown	TCP traffic detected without corresponding DNS query: 207.15.19.245
Source: unknown	TCP traffic detected without corresponding DNS query: 123.133.116.30
Source: unknown	TCP traffic detected without corresponding DNS query: 100.25.87.111
Source: unknown	TCP traffic detected without corresponding DNS query: 189.243.251.71
Source: unknown	TCP traffic detected without corresponding DNS query: 93.41.45.3
Source: unknown	TCP traffic detected without corresponding DNS query: 119.4.169.181
Source: unknown	TCP traffic detected without corresponding DNS query: 105.95.89.174
Source: unknown	TCP traffic detected without corresponding DNS query: 207.97.44.63
Source: unknown	TCP traffic detected without corresponding DNS query: 145.124.157.113
Source: unknown	TCP traffic detected without corresponding DNS query: 143.4.218.188
Source: unknown	TCP traffic detected without corresponding DNS query: 136.84.181.48
Source: unknown	TCP traffic detected without corresponding DNS query: 195.39.108.185
Source: unknown	TCP traffic detected without corresponding DNS query: 187.98.63.208
Source: unknown	TCP traffic detected without corresponding DNS query: 181.87.146.140
Source: unknown	TCP traffic detected without corresponding DNS query: 106.217.196.230
Source: unknown	TCP traffic detected without corresponding DNS query: 77.15.233.179
Source: unknown	TCP traffic detected without corresponding DNS query: 44.234.233.232
Source: unknown	TCP traffic detected without corresponding DNS query: 179.211.234.215
Source: unknown	TCP traffic detected without corresponding DNS query: 167.200.69.57
Source: unknown	TCP traffic detected without corresponding DNS query: 138.224.213.85
Source: unknown	TCP traffic detected without corresponding DNS query: 88.204.201.163
Source: unknown	TCP traffic detected without corresponding DNS query: 71.52.44.48
Source: unknown	TCP traffic detected without corresponding DNS query: 97.79.119.238

Source: byte.arm7.elf, type: SAMPLE	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: byte.arm7.elf, type: SAMPLE	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5453.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5453.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5440.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5440.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5442.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5442.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5451.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5451.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5443.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5443.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5446.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5446.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_app.c
Source: ELF static info symbol of initial sample	Name: attack_app_http
Source: ELF static info symbol of initial sample	Name: attack_app_httpcfb
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_get_opt_str
Source: ELF static info symbol of initial sample	Name: attack_gre.c
Source: ELF static info symbol of initial sample	Name: attack_gre_eth
Source: ELF static info symbol of initial sample	Name: attack_gre_ip

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: busyboxxx
Source: Initial sample	String containing 'busybox' found: busyboxx
Source: Initial sample	String containing 'busybox' found: ;httpurl=POST'=byte/proc/%d/net/tcp %d: %x:%x/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraJoshohajime902i13BzSxLxBxeYHOHO-LUGO7HOHO-U79OLJuYfouyf87NiGGeR69xdSO190Ij1XLOLKIKEEEDDEekjheory98escansh4MDMAfdevalvexscanspcMELTEDNINJAREALZflexsonskidsscanx86MISAKI-U79OLfoAxi102kxeswodjwodjwojMmKiy7f87lfreecookiex86sysgpufrgegesysupdater0DnAzepdNiGGeRD0nks69frgreu0x766f6964NiGGeRd0nks1337gafturasgbsigboa120i3UI49OaF3geaevaiolmao123123aOfurain0n4H34DggTrexewwasads1293194hjXDOthLaLosnggtwget-log1337SoraLOADERSAIAKINAg

Source: byte.arm7.elf, type: SAMPLE	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: byte.arm7.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5453.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5453.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5440.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5440.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5442.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5442.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5451.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5451.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5443.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5443.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5446.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5446.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research

Source: /usr/bin/dbus-daemon (PID: 5489)	File: /proc/5489/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5498)	File: /proc/5498/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5505)	File: /proc/5505/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5570)	File: /proc/5570/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5636)	File: /proc/5636/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5718)	File: /proc/5718/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5730)	File: /proc/5730/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5734)	File: /proc/5734/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5865)	File: /proc/5865/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5940)	File: /proc/5940/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6079)	File: /proc/6079/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6087)	File: /proc/6087/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6090)	File: /proc/6090/mounts	Jump to behavior

Source: /lib/systemd/systemd-logind (PID: 5579)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5579)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5579)	File: /run/systemd/seats/.#seat034nEl2	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5661)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5661)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5661)	File: /run/systemd/seats/.#seat0jVv7Oh	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5737)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5737)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5737)	File: /run/systemd/seats/.#seat0bSxfS1	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5808)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5808)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5808)	File: /run/systemd/seats/.#seat0hqGvXk	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5883)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5883)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5883)	File: /run/systemd/seats/.#seat0ngo424	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6019)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6019)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6019)	File: /run/systemd/seats/.#seat0ibQbdk	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6093)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6093)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6093)	File: /run/systemd/seats/.#seat0TvqwAT	Jump to behavior

Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent to PID below 1000: pid: 490, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent to PID below 1000: pid: 660, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent to PID below 1000: pid: 726, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent to PID below 1000: pid: 727, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent to PID below 1000: pid: 765, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent to PID below 1000: pid: 767, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent to PID below 1000: pid: 778, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent to PID below 1000: pid: 780, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent to PID below 1000: pid: 783, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent to PID below 1000: pid: 790, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent to PID below 1000: pid: 792, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent to PID below 1000: pid: 795, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent to PID below 1000: pid: 800, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent to PID below 1000: pid: 660, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent to PID below 1000: pid: 726, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent to PID below 1000: pid: 765, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent to PID below 1000: pid: 767, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent to PID below 1000: pid: 778, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent to PID below 1000: pid: 800, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent to PID below 1000: pid: 5, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent to PID below 1000: pid: 7, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent to PID below 1000: pid: 8, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior

Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 765, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 792, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 1410, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 1411, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 1432, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 1475, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 1480, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 1482, result: no such process	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 1565, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 1805, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 2926, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 2935, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 2936, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 3122, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 3780, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 5283, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 5425, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 5426, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent: pid: 765, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent: pid: 767, result: successful	Jump to behavior

Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 765, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 792, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 1410, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 1411, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 1432, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 1475, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 1480, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 1482, result: no such process	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 1565, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 1805, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 2926, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 2935, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 2936, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 3122, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 3780, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 5283, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 5425, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	SIGKILL sent: pid: 5426, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent: pid: 765, result: successful	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	SIGKILL sent: pid: 767, result: successful	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5644)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5646)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5648)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5650)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5652)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5720)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5722)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5726)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5728)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5795)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5797)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5799)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5801)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5867)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5869)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5873)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5875)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5942)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5944)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5946)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5948)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5950)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6077)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6080)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6082)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6084)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6151)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior

Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/5283/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/3780/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/3122/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/1482/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/490/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/1480/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/790/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/792/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/795/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/1411/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/1410/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/1432/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/1475/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/778/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/936/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/2926/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/3132/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/780/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/660/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/1/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/783/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/1400/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/1565/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/765/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/2970/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/3069/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/767/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/800/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/5446/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/5425/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/726/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/1805/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/5426/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/727/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/2936/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5442)	File opened: /proc/2935/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/5388/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/239/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/241/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/5948/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/1/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/5949/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/800/net/tcp	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/5940/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/5941/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/byte.arm7.elf (PID: 5449)	File opened: /proc/21/cmdline	Jump to behavior

Source: /bin/sh (PID: 5645)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5647)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5649)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5651)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5653)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5721)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5723)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5727)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5729)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5796)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5798)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5800)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5802)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5868)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5872)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5874)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5876)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5943)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5945)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5947)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5949)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5951)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6078)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6081)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6083)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6085)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6152)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 5656)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5732)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5804)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5879)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5954)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6088)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6155)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 5506)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5575)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5658)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5733)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5805)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5880)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5955)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6089)	Reads from proc file: /proc/meminfo	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 5507)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5637)	Log file created: /var/log/kern.log			Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 5640)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5719)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5794)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5866)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5941)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6076)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6150)	Truncated file: /var/log/gpu-manager.log	Jump to behavior

Source: /tmp/byte.arm7.elf (PID: 5440)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5496)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5506)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5507)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5575)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5637)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5658)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5733)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5805)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5880)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5955)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6089)	Queries kernel information via 'uname':	Jump to behavior

Source: syslog.37.dr	Binary or memory string: Nov 7 07:44:26 galassia kernel: [ 109.015562] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel parport_pc ppdev lp drm parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse mptspi scsi_transport_spi ahci mptscsih libahci mptbase vmxnet3
Source: byte.arm7.elf, 5440.1.00007ffed04b5000.00007ffed04d6000.rw-.sdmp, byte.arm7.elf, 5442.1.00007ffed04b5000.00007ffed04d6000.rw-.sdmp, byte.arm7.elf, 5443.1.00007ffed04b5000.00007ffed04d6000.rw-.sdmp, byte.arm7.elf, 5446.1.00007ffed04b5000.00007ffed04d6000.rw-.sdmp, byte.arm7.elf, 5451.1.00007ffed04b5000.00007ffed04d6000.rw-.sdmp, byte.arm7.elf, 5453.1.00007ffed04b5000.00007ffed04d6000.rw-.sdmp	Binary or memory string: 4x86_64/usr/bin/qemu-arm/tmp/byte.arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/byte.arm7.elf
Source: byte.arm7.elf, 5440.1.000056357e63e000.000056357e78f000.rw-.sdmp, byte.arm7.elf, 5442.1.000056357e63e000.000056357e76c000.rw-.sdmp, byte.arm7.elf, 5443.1.000056357e63e000.000056357e76c000.rw-.sdmp, byte.arm7.elf, 5446.1.000056357e63e000.000056357e76c000.rw-.sdmp, byte.arm7.elf, 5451.1.000056357e63e000.000056357e76c000.rw-.sdmp, byte.arm7.elf, 5453.1.000056357e63e000.000056357e76c000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: byte.arm7.elf, 5440.1.00007ffed04b5000.00007ffed04d6000.rw-.sdmp, byte.arm7.elf, 5442.1.00007ffed04b5000.00007ffed04d6000.rw-.sdmp, byte.arm7.elf, 5443.1.00007ffed04b5000.00007ffed04d6000.rw-.sdmp, byte.arm7.elf, 5446.1.00007ffed04b5000.00007ffed04d6000.rw-.sdmp, byte.arm7.elf, 5451.1.00007ffed04b5000.00007ffed04d6000.rw-.sdmp, byte.arm7.elf, 5453.1.00007ffed04b5000.00007ffed04d6000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: syslog.37.dr	Binary or memory string: Nov 7 07:44:26 galassia kernel: [ 109.012968] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020
Source: byte.arm7.elf, 5440.1.000056357e63e000.000056357e78f000.rw-.sdmp, byte.arm7.elf, 5442.1.000056357e63e000.000056357e76c000.rw-.sdmp, byte.arm7.elf, 5443.1.000056357e63e000.000056357e76c000.rw-.sdmp, byte.arm7.elf, 5446.1.000056357e63e000.000056357e76c000.rw-.sdmp, byte.arm7.elf, 5451.1.000056357e63e000.000056357e76c000.rw-.sdmp, byte.arm7.elf, 5453.1.000056357e63e000.000056357e76c000.rw-.sdmp	Binary or memory string: Se~5VPUe~5VPRe~5V!/etc/qemu-binfmt/arm

Source: Yara match	File source: byte.arm7.elf, type: SAMPLE
Source: Yara match	File source: 5453.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5440.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5442.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5451.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5443.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5446.1.00007fd2a0017000.00007fd2a0037000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: byte.arm7.elf PID: 5440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.arm7.elf PID: 5442, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.arm7.elf PID: 5443, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.arm7.elf PID: 5446, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.arm7.elf PID: 5451, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.arm7.elf PID: 5453, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	11 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report byte.arm7.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/run/systemd/seats/.#seat034nEl2

/run/systemd/seats/.#seat0TvqwAT

/run/systemd/seats/.#seat0bSxfS1

/run/systemd/seats/.#seat0hqGvXk

/run/systemd/seats/.#seat0ibQbdk

/run/systemd/seats/.#seat0jVv7Oh

/run/systemd/seats/.#seat0ngo424

/tmp/qemu-open.01BZnf (deleted)

/tmp/qemu-open.02Kpye (deleted)

/tmp/qemu-open.02VYQe (deleted)

/tmp/qemu-open.02jTze (deleted)

/tmp/qemu-open.04Ntcc (deleted)

/tmp/qemu-open.06QAYb (deleted)

/tmp/qemu-open.0FlaQf (deleted)

/tmp/qemu-open.0Hv7Nf (deleted)

/tmp/qemu-open.0KYkog (deleted)

/tmp/qemu-open.0Q507e (deleted)

/tmp/qemu-open.0Tolfd (deleted)

/tmp/qemu-open.0WmWYf (deleted)

/tmp/qemu-open.0WnOKe (deleted)

/tmp/qemu-open.0a5KGd (deleted)

/tmp/qemu-open.0dO9Gd (deleted)

/tmp/qemu-open.0fzNAf (deleted)

/tmp/qemu-open.0pNPWc (deleted)

/tmp/qemu-open.0s89kc (deleted)

/tmp/qemu-open.0tMDfg (deleted)

/tmp/qemu-open.0tiIQf (deleted)

/tmp/qemu-open.111eic (deleted)

/tmp/qemu-open.1437gf (deleted)

Linux Analysis Report
byte.arm7.elf

Source	Detection	Scanner	Label	Link
byte.arm7.elf	55%	ReversingLabs	Linux.Backdoor.Mirai
byte.arm7.elf	100%	Avira	LINUX/Mirai.bonb

IP	Domain	Country	ASN	ASN Name	Malicious
46.17.41.1	unknown	Russian Federation	51659	ASBAXETRU	false
196.213.37.254	unknown	South Africa	3741	ISZA	false
91.109.28.91	unknown	Germany	28753	LEASEWEB-DE-FRA-10DE	false
101.21.40.87	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
141.50.23.61	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
23.25.226.128	unknown	United States	7922	COMCAST-7922US	false
4.153.106.124	unknown	United States	3356	LEVEL3US	false
74.231.248.86	unknown	United States	6389	BELLSOUTH-NET-BLKUS	false
193.165.180.210	unknown	Czech Republic	30764	PODA-ASCZ	false
158.123.86.227	unknown	United States	14325	OSHEANUS	false
66.113.109.25	unknown	United States	30170	OPTICFUSIONUS	false
147.14.61.97	unknown	Sweden	41076	POSTDK-ASDK	false
161.184.40.161	unknown	Canada	852	ASN852CA	false
187.98.63.208	unknown	Brazil	26615	TIMSABR	false
75.37.252.69	unknown	United States	7018	ATT-INTERNET4US	false
100.249.17.230	unknown	United States	21928	T-MOBILE-AS21928US	false
180.95.72.235	unknown	Australia	45768	CENET-AS-AU-APLocalnon-transitASfortheAU	false
223.27.55.31	unknown	Taiwan; Republic of China (ROC)	38843	PUMO-NETPUMONETWORKDIGITALTECHNOLOGYCOLTDTW	false
190.156.99.191	unknown	Colombia	10620	TelmexColombiaSACO	false
17.176.10.116	unknown	United States	714	APPLE-ENGINEERINGUS	false
80.79.115.92	unknown	Estonia	34702	WAVECOM-ASEE	false
155.18.169.7	unknown	United States	37532	ZAMRENZM	false
147.153.115.109	unknown	United States	14041	AS14041US	false
133.255.175.90	unknown	Japan	2497	IIJInternetInitiativeJapanIncJP	false
99.82.229.183	unknown	United States	7018	ATT-INTERNET4US	false
69.36.136.227	unknown	United States	13989	SIEA-13989US	false
129.18.135.217	unknown	Nigeria	36923	SWIFTNG-ASNNG	false
54.112.121.173	unknown	United States	16509	AMAZON-02US	false
255.124.12.149	unknown	Reserved	unknown	unknown	false
39.93.35.184	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
60.73.134.179	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
171.29.181.168	unknown	United Kingdom	34457	AMB-GENERALIDE	false
154.166.174.197	unknown	Ghana	30986	SCANCOMGH	false
180.13.111.115	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
17.229.93.25	unknown	United States	714	APPLE-ENGINEERINGUS	false
216.79.3.150	unknown	United States	6389	BELLSOUTH-NET-BLKUS	false
126.101.238.160	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
197.205.194.7	unknown	Algeria	36947	ALGTEL-ASDZ	false
169.16.61.124	unknown	United States	37611	AfrihostZA	false
24.93.230.215	unknown	United States	10796	TWC-10796-MIDWESTUS	false
188.123.155.25	unknown	Georgia	35805	SILKNET-ASGE	false
37.215.148.15	unknown	Belarus	6697	BELPAK-ASBELPAKBY	false
255.211.29.102	unknown	Reserved	unknown	unknown	false
88.204.201.163	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
12.108.53.61	unknown	United States	7018	ATT-INTERNET4US	false
45.57.82.195	unknown	United States	2906	AS-SSIUS	false
8.116.187.45	unknown	United States	3356	LEVEL3US	false
175.205.98.238	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
105.148.43.169	unknown	Morocco	6713	IAM-ASMA	false
106.203.155.56	unknown	India	45609	BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService	false
208.103.87.144	unknown	United States	18649	ST-DALUS	false
180.43.164.183	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
203.169.176.97	unknown	Hong Kong	9293	HKNET-VIPNETNTTComAsiaLimitedHK	false
218.211.0.148	unknown	Taiwan; Republic of China (ROC)	9919	NCIC-TWNewCenturyInfoCommTechCoLtdTW	false
197.158.10.206	unknown	Mozambique	30619	TDM-ASMZ	false
139.25.197.11	unknown	Germany	9905	LINKNET-ID-APLinknetASNID	false
36.213.34.134	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
101.16.227.77	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
96.123.211.190	unknown	United States	7922	COMCAST-7922US	false
83.14.70.214	unknown	Poland	5617	TPNETPL	false
191.64.173.174	unknown	Colombia	26611	COMCELSACO	false
63.73.103.108	unknown	United States	701	UUNETUS	false
148.249.33.169	unknown	Mexico	8151	UninetSAdeCVMX	false
18.169.187.32	unknown	United States	3	MIT-GATEWAYSUS	false
204.92.78.54	unknown	United States	701	UUNETUS	false
44.13.114.50	unknown	United States	7377	UCSDUS	false
178.189.55.119	unknown	Austria	8447	TELEKOM-ATA1TelekomAustriaAGAT	false
167.132.215.173	unknown	United States	10405	UPRR-ASN-01US	false
103.148.224.102	unknown	unknown	139995	IDNIC-WIDEHOSTMEDIA-AS-IDPTAkashiaThubaJayaID	false
78.228.9.31	unknown	France	12322	PROXADFR	false
73.30.19.244	unknown	United States	7922	COMCAST-7922US	false
170.101.130.249	unknown	Saudi Arabia	25019	SAUDINETSTC-ASSA	false
98.80.54.17	unknown	United States	11351	TWC-11351-NORTHEASTUS	false
115.252.58.5	unknown	India	18101	RELIANCE-COMMUNICATIONS-INRelianceCommunicationsLtdDAKC	false
149.235.114.107	unknown	United Kingdom	203160	OPENTEXT-AS-EUFR	false
205.165.185.79	unknown	United States	3354	THENET-AS-3354US	false
65.118.45.67	unknown	United States	1742	HARVARD-UNIVUS	false
99.48.31.74	unknown	United States	7018	ATT-INTERNET4US	false
71.91.188.242	unknown	United States	20115	CHARTER-20115US	false
208.104.139.90	unknown	United States	14615	ROCK-HILL-TELEPHONEUS	false
166.17.37.70	unknown	United States	206	CSC-IGN-AMERUS	false
125.61.10.197	unknown	Korea Republic of	23575	SKB-GOV-KRSKBroadbandCoLtdKR	false
2.253.169.226	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
105.95.89.174	unknown	Egypt	36992	ETISALAT-MISREG	false
36.166.239.167	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
174.165.3.32	unknown	United States	7922	COMCAST-7922US	false
209.249.87.96	unknown	United States	6461	ZAYO-6461US	false
46.224.252.125	unknown	Iran (ISLAMIC Republic Of)	56402	DADEHGOSTAR-ASAS12880-DataCommunicationCompanyofIran	false
184.243.88.213	unknown	United States	10507	SPCSUS	false
136.59.244.50	unknown	United States	16591	GOOGLE-FIBERUS	false
188.153.92.127	unknown	Italy	30722	VODAFONE-IT-ASNIT	false
206.153.76.1	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
119.4.169.181	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
104.68.57.33	unknown	United States	18004	WIRELESSNET-IDPTWIRELESSINDONESIAWINID	false
4.240.204.253	unknown	United States	3356	LEVEL3US	false
113.92.33.73	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
207.15.19.245	unknown	United States	1239	SPRINTLINKUS	false
101.147.194.149	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
92.131.233.99	unknown	France	3215	FranceTelecom-OrangeFR	false
5.162.204.232	unknown	Oman	50010	NAWRAS-ASSultanateofOmanOM	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
byte-main-cnc.n-e.kr	byte.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.16.94
	byte.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.16.94
	byte.m68k.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.16.94
	byte.spc.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.16.94
	byte.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.16.94
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.16.94
	byte.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.16.94
	byte.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.16.94
	byte.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.16.94

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ISZA	bin.arm7.elf	Get hash	malicious	Mirai	Browse	196.213.254.243
	arm4.elf	Get hash	malicious	Mirai	Browse	196.34.50.1
	spc.elf	Get hash	malicious	Mirai	Browse	196.211.163.173
	x86.elf	Get hash	malicious	Mirai	Browse	196.209.75.8
	nuklear.arm.elf	Get hash	malicious	Mirai, Moobot	Browse	168.142.131.41
	sora.mpsl.elf	Get hash	malicious	Mirai	Browse	196.215.73.130
	nullnet_load.ppc.elf	Get hash	malicious	Mirai	Browse	197.96.225.147
	nullnet_load.mips.elf	Get hash	malicious	Mirai	Browse	156.9.55.109
	nullnet_load.sh4.elf	Get hash	malicious	Mirai	Browse	197.96.225.138
	nullnet_load.arm7.elf	Get hash	malicious	Mirai	Browse	197.96.124.98
LEASEWEB-DE-FRA-10DE	Movavi Slideshow Maker 4.exe	Get hash	malicious	Unknown	Browse	84.16.252.107
	Movavi Slideshow Maker 4.exe	Get hash	malicious	Unknown	Browse	84.16.252.107
	https://m-apkpure.playvoir.com/ru/maiorders-merchant/maiorders.merchantapp	Get hash	malicious	Unknown	Browse	178.162.215.162
	na.elf	Get hash	malicious	Unknown	Browse	84.16.239.119
	transferencia.vbs	Get hash	malicious	Unknown	Browse	91.109.20.161
	Justificante_01102024.vbs	Get hash	malicious	GuLoader	Browse	91.109.20.161
	http://steam.csworkshoparts.com/filedetails/sharedfile/ak47-DeadRose/	Get hash	malicious	HTMLPhisher	Browse	5.61.42.53
	Https://25sep26ww.z13.web.core.windows.net/#	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	217.20.112.104
	https://telegram-message-8n5.pages.dev/	Get hash	malicious	Unknown	Browse	217.20.112.104
	http://two.eagermint.com	Get hash	malicious	Unknown	Browse	217.20.112.104
ASBAXETRU	nabarm.elf	Get hash	malicious	Unknown	Browse	45.147.200.38
	mysq1.exe	Get hash	malicious	Unknown	Browse	46.17.43.250
	aisuru.mips.elf	Get hash	malicious	Unknown	Browse	194.147.35.35
	8mmZ7Bkoj1.exe	Get hash	malicious	FormBook	Browse	176.32.38.141
	na.elf	Get hash	malicious	Unknown	Browse	46.29.161.108
	INV & BANK DETAILS LETTER.pdf.exe	Get hash	malicious	FormBook	Browse	176.32.38.141
	VZRdl605xh.elf	Get hash	malicious	Gafgyt, Mirai	Browse	176.32.39.130
	KtEQ20VGM9.elf	Get hash	malicious	Gafgyt, Mirai	Browse	176.32.39.130
	1qKutBuGUV.elf	Get hash	malicious	Gafgyt, Mirai	Browse	176.32.39.130
	5aNi3U9NPU.elf	Get hash	malicious	Gafgyt, Mirai	Browse	176.32.39.130

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.448047321524811
Encrypted:	false
SSDEEP:	3:F31HlMOdlDKOdlr:F3cY+Y
MD5:	8EF72D1599BD2DEDA0B1F2B31AAFD261
SHA1:	FFA7B7BBE3B12C554819058EA984F9491BC79D0F
SHA-256:	CEADFA6AB9C6573385983B0D37A3B45371BD3020A6AEAB28DC37B397CA6ECCF6
SHA-512:	12143F6ACCBBBDE94037BBD354A23F0DCC7568C85EB621D2C9E454F6920ED3E00090F75A7BE19A58F30D095CF87F2B885B8554A2AF9871C9BDF037C9012EA580
Malicious:	false
Preview:	LPKSHHRH.................l.x.O...R...1.................................l.x.O...R...1........................................................................................................................................................

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	3128
Entropy (8bit):	4.762953832978137
Encrypted:	false
SSDEEP:	48:X4JcwQqY9MIBwQTYZY0meTXK9pHuK9EsK5xn8YBwjnwt8OM/q8Gpc24Q8w4mS4zO:a69T90nqz
MD5:	1F8DCC569D4E6DAED172AF0C458F7260
SHA1:	DDE2B367C31D530FC2A9D047D3A12004E6E95E0D
SHA-256:	0DF33DDB40BAF919374F40851ABA28D659521925B49AE779A9F41CFA60F63452
SHA-512:	B7075CDFFBD767341A38F38167CD9595D708ACA3D6C4943F0C7B4576D938FD2EBEA19BA1347F35B8F3F2A0CF066BB471D1F62B2E063DD98F80B0EAB1E2EADA2D
Malicious:	false
Preview:	Nov 7 07:44:29 galassia kernel: [ 111.890108] blocking signal 9: 5449 -> 1.Nov 7 07:44:29 galassia kernel: [ 111.923803] blocking signal 9: 5449 -> 660.Nov 7 07:44:29 galassia kernel: [ 111.936191] blocking signal 9: 5449 -> 726.Nov 7 07:44:29 galassia kernel: [ 111.951236] blocking signal 9: 5449 -> 765.Nov 7 07:44:29 galassia kernel: [ 111.965721] blocking signal 9: 5449 -> 767.Nov 7 07:44:29 galassia kernel: [ 111.981498] blocking signal 9: 5449 -> 778.Nov 7 07:44:29 galassia kernel: [ 112.004455] blocking signal 9: 5449 -> 936.Nov 7 07:44:29 galassia kernel: [ 112.025425] blocking signal 9: 5449 -> 1400.Nov 7 07:44:29 galassia kernel: [ 112.044981] blocking signal 9: 5449 -> 1410.Nov 7 07:44:29 galassia kernel: [ 112.064401] blocking signal 9: 5449 -> 1411.Nov 7 07:44:29 galassia kernel: [ 112.080639] blocking signal 9: 5449 -> 1805.Nov 7 07:44:29 galassia kernel: [ 112.105546] blocking signal 9: 5449 -> 2935.Nov 7 07:44:29 galassia kernel: [ 112.125958] b

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.058943490704188
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	byte.arm7.elf
File size:	196'299 bytes
MD5:	b3f80cf126fef93601c6710fc02855b4
SHA1:	e36c00033f3c977f7bd8a1dd740885c27ba9581f
SHA256:	794fa0280e56a929306cc43b10b1c9f191265868a8fbc3a1ed3f5a905fb65ceb
SHA512:	e3f050f2bed368cd0c98e3cfefcdf77bc3975959cd74ed507e835c7b2dffc72a2ea6ffae0af95d5bbfaa3314f545125437ac8ccfd697facbbbeba1d73d60baeb
SSDEEP:	3072:y/IpT+ueUoLmpMguHcU+VUHalw7WbuH03sfC+goLWlmuVLarwr+i6/ftr5m6VkGe:y/IpT+LUoLmpMguHcU+VUHalw7WbuH0p
TLSH:	DD145D86EA409A13C0D7177AEAAF414933329754D3E773068D28AFF43F86B5E0E67605
File Content Preview:	.ELF..............(.........4...lv......4. ...(........p.....y...y..................................(...(................................>..........................................Q.td..................................-...L..................@-.,@...0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	161388
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x1c7ac	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x2489c	0x1c89c	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x248b0	0x1c8b0	0x3048	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x278f8	0x1f8f8	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x27910	0x1f910	0x118	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x28000	0x20000	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x28004	0x20004	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x28004	0x20004	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x28008	0x20008	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2800c	0x2000c	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x28010	0x20010	0xa8	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x280b8	0x200b8	0xb60	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x28c18	0x20c18	0x32d8	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x20c18	0xc1c	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x21838	0x160	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x21998	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x21bab	0x210b	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x23cb6	0x6f6	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x243ac	0xf28	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x252d4	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x2558c	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x25e56	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x26fe5	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x2753d	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x27553	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x27af4	0x5790	0x10	0x0		28	811	4
.strtab	STRTAB	0x0	0x2d284	0x2c47	0x0	0x0		0	0	1