Edit tour

Linux Analysis Report
Aqua.arm5.elf

Overview

General Information

Sample name:	Aqua.arm5.elf
Analysis ID:	1569921
MD5:	2da1798fbb916db08633e3e21c7dd051
SHA1:	f92a83277889f4228cba05e58e3a9976f0e5f534
SHA256:	6196cb20d16b99920b874df4abd3e0a6b0becbd3355651fd2d38448933824267
Tags:	elfMiraiuser-lontze7
Infos:

Detection

Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1569921
Start date and time:	2024-12-06 11:41:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Aqua.arm5.elf
Detection:	MAL
Classification:	mal92.spre.troj.evad.linELF@0/29@120/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Aqua.arm5.elf

Runtime Messages

Command:	/tmp/Aqua.arm5.elf
PID:	6250
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6224, Parent: 4331)

rm (PID: 6224, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.f8NtUib4dg /tmp/tmp.QwVtZeApeT /tmp/tmp.ExO63KUjCm

dash New Fork (PID: 6225, Parent: 4331)

rm (PID: 6225, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.f8NtUib4dg /tmp/tmp.QwVtZeApeT /tmp/tmp.ExO63KUjCm

Aqua.arm5.elf (PID: 6250, Parent: 6153, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/Aqua.arm5.elf

Aqua.arm5.elf New Fork (PID: 6252, Parent: 6250)

Aqua.arm5.elf New Fork (PID: 6254, Parent: 6252)

gnome-session-binary New Fork (PID: 6256, Parent: 1477)

sh (PID: 6256, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6256, Parent: 1477, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 6261, Parent: 1)

systemd-hostnamed (PID: 6261, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

gdm3 New Fork (PID: 6392, Parent: 1320)

Default (PID: 6392, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6393, Parent: 1320)

Default (PID: 6393, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6406, Parent: 1320)

Default (PID: 6406, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6409, Parent: 1)

dbus-daemon (PID: 6409, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6410, Parent: 1860)

pulseaudio (PID: 6410, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6411, Parent: 1)

rsyslogd (PID: 6411, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6420, Parent: 1)

rtkit-daemon (PID: 6420, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6423, Parent: 1)

systemd-logind (PID: 6423, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6485, Parent: 1)

polkitd (PID: 6485, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

gvfsd-fuse New Fork (PID: 6486, Parent: 2038)

fusermount (PID: 6486, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6493, Parent: 1)

gpu-manager (PID: 6493, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6496, Parent: 6493)

sh (PID: 6496, Parent: 6493, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6499, Parent: 6496)

grep (PID: 6499, Parent: 6496, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6501, Parent: 6493)

sh (PID: 6501, Parent: 6493, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6502, Parent: 6501)

grep (PID: 6502, Parent: 6501, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6507, Parent: 6493)

sh (PID: 6507, Parent: 6493, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6508, Parent: 6507)

grep (PID: 6508, Parent: 6507, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6509, Parent: 6493)

sh (PID: 6509, Parent: 6493, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6510, Parent: 6509)

grep (PID: 6510, Parent: 6509, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6511, Parent: 6493)

sh (PID: 6511, Parent: 6493, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6512, Parent: 6511)

grep (PID: 6512, Parent: 6511, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6515, Parent: 6493)

sh (PID: 6515, Parent: 6493, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6517, Parent: 6515)

grep (PID: 6517, Parent: 6515, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6519, Parent: 6493)

sh (PID: 6519, Parent: 6493, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6520, Parent: 6519)

grep (PID: 6520, Parent: 6519, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6521, Parent: 6493)

sh (PID: 6521, Parent: 6493, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6522, Parent: 6521)

grep (PID: 6522, Parent: 6521, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6495, Parent: 1)

dbus-daemon (PID: 6495, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6500, Parent: 1)

rsyslogd (PID: 6500, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6513, Parent: 1)

agetty (PID: 6513, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6524, Parent: 1)

generate-config (PID: 6524, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6525, Parent: 6524)

pkill (PID: 6525, Parent: 6524, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6528, Parent: 1)

gdm-wait-for-drm (PID: 6528, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6533, Parent: 1)

dbus-daemon (PID: 6533, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6534, Parent: 1)

rsyslogd (PID: 6534, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6535, Parent: 1)

agetty (PID: 6535, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6543, Parent: 1)

systemd-logind (PID: 6543, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6605, Parent: 1)

gdm3 (PID: 6605, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6608, Parent: 6605)

plymouth (PID: 6608, Parent: 6605, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6622, Parent: 6605)

gdm-session-worker (PID: 6622, Parent: 6605, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6626, Parent: 6622)

gdm-wayland-session (PID: 6626, Parent: 6622, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6628, Parent: 6626)

dbus-daemon (PID: 6628, Parent: 6626, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6630, Parent: 6628)

dbus-daemon New Fork (PID: 6631, Parent: 6630)

false (PID: 6631, Parent: 6630, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6632, Parent: 6626)

dbus-run-session (PID: 6632, Parent: 6626, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6633, Parent: 6632)

dbus-daemon (PID: 6633, Parent: 6632, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6636, Parent: 6605)

Default (PID: 6636, Parent: 6605, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6637, Parent: 6605)

Default (PID: 6637, Parent: 6605, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6609, Parent: 1)

accounts-daemon (PID: 6609, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6613, Parent: 6609)

language-validate (PID: 6613, Parent: 6609, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6614, Parent: 6613)

language-options (PID: 6614, Parent: 6613, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6615, Parent: 6614)

sh (PID: 6615, Parent: 6614, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6616, Parent: 6615)

locale (PID: 6616, Parent: 6615, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6617, Parent: 6615)

grep (PID: 6617, Parent: 6615, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6618, Parent: 1)

polkitd (PID: 6618, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6667, Parent: 1860)

dbus-daemon (PID: 6667, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6673, Parent: 1860)

pulseaudio (PID: 6673, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6674, Parent: 1)

rtkit-daemon (PID: 6674, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Aqua.arm5.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Aqua.arm5.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x20d74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20d88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20d9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20db0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20dc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20dd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20dec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20ea0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20eb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20ec8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20edc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20ef0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20f04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6254.1.00007fd614017000.00007fd61403b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6254.1.00007fd614017000.00007fd61403b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x20d74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20d88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20d9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20db0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20dc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20dd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20dec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20ea0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20eb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20ec8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20edc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20ef0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20f04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6250.1.00007fd614017000.00007fd61403b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6250.1.00007fd614017000.00007fd61403b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x20d74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20d88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20d9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20db0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20dc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20dd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20dec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20e8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20ea0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20eb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20ec8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20edc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20ef0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20f04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Aqua.arm5.elf PID: 6250	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Aqua.arm5.elf PID: 6250	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x213:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x227:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x23b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x263:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x277:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x28b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x29f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x303:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x317:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x32b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x33f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Aqua.arm5.elf PID: 6254	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Aqua.arm5.elf PID: 6254	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1c0c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c0db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c0ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c103:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c117:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c12b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c13f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c153:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c167:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c17b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c18f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c1a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c1b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c1cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c1df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c1f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c207:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c21b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c22f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c243:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c257:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 3 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Aqua.arm5.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: Aqua.arm5.elf

ReversingLabs: Detection: 39%

Source: /usr/bin/pkill (PID: 6525)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6673)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: Aqua.arm5.elf

String: EOF/proc//proc/%s/cmdlinewgetcurlftpechokillbashrebootshutdownhaltpoweroff[locker] killed process: %s ;; pid: %d

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: server.eye-network.ru. [malformed]

Source: global traffic

TCP traffic: 192.168.2.23:50016 -> 89.190.156.145:7733

Source: global traffic

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6411)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6500)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6534)	Reads hosts file: /etc/hosts	Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6605)	Socket: unknown address family			Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6628)	Socket: unknown address family			Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: server.eye-network.ru
Source: global traffic	DNS traffic detected: DNS query: server.eye-network.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.35.dr, syslog.57.dr, syslog.101.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33606
Source: unknown	Network traffic detected: HTTP traffic on port 33606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53116
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53116 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: Aqua.arm5.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6254.1.00007fd614017000.00007fd61403b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6250.1.00007fd614017000.00007fd61403b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Aqua.arm5.elf PID: 6250, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Aqua.arm5.elf PID: 6254, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 6256, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 6214, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 6215, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 6407, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 6409, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 6410, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 6411, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 6494, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 6495, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 6500, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 6513, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 6256, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 6214, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 6215, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 6407, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 6409, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 6410, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 6411, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 6494, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 6495, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 6500, result: successful	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	SIGKILL sent: pid: 6513, result: successful	Jump to behavior

Source: Aqua.arm5.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6254.1.00007fd614017000.00007fd61403b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6250.1.00007fd614017000.00007fd61403b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Aqua.arm5.elf PID: 6250, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Aqua.arm5.elf PID: 6254, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal92.spre.troj.evad.linELF@0/29@120/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6409)	File: /proc/6409/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6486)	File: /proc/6486/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6495)	File: /proc/6495/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6533)	File: /proc/6533/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6628)	File: /proc/6628/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6633)	File: /proc/6633/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6667)	File: /proc/6667/mounts	Jump to behavior

Source: /usr/libexec/gsd-rfkill (PID: 6256)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 6256)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6261)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6423)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6423)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6423)	File: /run/systemd/seats/.#seat0j6uDiT	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6485)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6543)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6543)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6543)	File: /run/systemd/seats/.#seat05Ai2cY	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6543)	File: /run/systemd/users/.#127rbfDbX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6543)	File: /run/systemd/users/.#127RoIWiX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6543)	File: /run/systemd/seats/.#seat0O8VX6V	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6543)	File: /run/systemd/users/.#127puFNyY	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6543)	File: /run/systemd/users/.#127yjOUzY	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6543)	File: /run/systemd/users/.#127Km3Y2U	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6626)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6609)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6609)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6618)	Directory: /root/.cache	Jump to behavior

Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6230/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6230/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6230/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6230/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6232/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6232/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6232/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6232/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6231/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6231/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6231/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6231/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6234/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6234/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6234/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6234/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6233/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6233/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6233/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6233/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6236/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6236/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6236/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6236/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6235/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6235/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6235/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/6235/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/Aqua.arm5.elf (PID: 6254)	File opened: /proc/116/stat	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6496)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6501)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6507)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6509)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6511)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6515)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6519)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6521)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6615)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Source: /bin/sh (PID: 6499)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6502)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6508)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6510)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6512)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6517)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6520)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6522)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6617)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6525)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /usr/bin/dash (PID: 6224)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.f8NtUib4dg /tmp/tmp.QwVtZeApeT /tmp/tmp.ExO63KUjCm			Jump to behavior
Source: /usr/bin/dash (PID: 6225)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.f8NtUib4dg /tmp/tmp.QwVtZeApeT /tmp/tmp.ExO63KUjCm			Jump to behavior

Source: /sbin/agetty (PID: 6513)	Reads version info: /etc/issue			Jump to behavior
Source: /sbin/agetty (PID: 6535)	Reads version info: /etc/issue			Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6605)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6605)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6609)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6609)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6411)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 6493)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6500)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6500)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6534)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6534)	Log file created: /var/log/auth.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/Aqua.arm5.elf (PID: 6252)

File: /tmp/Aqua.arm5.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6493)

Truncated file: /var/log/gpu-manager.log

Jump to behavior

Source: /usr/bin/pkill (PID: 6525)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6673)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /tmp/Aqua.arm5.elf (PID: 6250)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6261)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6411)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6493)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6500)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6513)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6534)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6535)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6622)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6673)	Queries kernel information via 'uname':	Jump to behavior

Source: Aqua.arm5.elf, 6250.1.00007ffcc5db7000.00007ffcc5dd8000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.x2zjOM
Source: Aqua.arm5.elf, 6250.1.00007ffcc5db7000.00007ffcc5dd8000.rw-.sdmp, Aqua.arm5.elf, 6254.1.00007ffcc5db7000.00007ffcc5dd8000.rw-.sdmp	Binary or memory string: 4x86_64/usr/bin/qemu-arm/tmp/Aqua.arm5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Aqua.arm5.elf
Source: Aqua.arm5.elf, 6250.1.000055b06a22b000.000055b06a359000.rw-.sdmp, Aqua.arm5.elf, 6254.1.000055b06a22b000.000055b06a359000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: Aqua.arm5.elf, 6250.1.000055b06a22b000.000055b06a359000.rw-.sdmp, Aqua.arm5.elf, 6254.1.000055b06a22b000.000055b06a359000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: Aqua.arm5.elf, 6250.1.00007ffcc5db7000.00007ffcc5dd8000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.x2zjOM:
Source: Aqua.arm5.elf, 6250.1.00007ffcc5db7000.00007ffcc5dd8000.rw-.sdmp, Aqua.arm5.elf, 6254.1.00007ffcc5db7000.00007ffcc5dd8000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: syslog.35.dr	Binary or memory string: Dec 6 04:42:06 galassia kernel: [ 418.737116] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: syslog.35.dr	Binary or memory string: Dec 6 04:42:06 galassia kernel: [ 418.737151] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: Aqua.arm5.elf, 6254.1.00007ffcc5db7000.00007ffcc5dd8000.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6609)

Logged in records file read: /var/log/wtmp

Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: Aqua.arm5.elf, type: SAMPLE
Source: Yara match	File source: 6254.1.00007fd614017000.00007fd61403b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6250.1.00007fd614017000.00007fd61403b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Aqua.arm5.elf PID: 6250, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Aqua.arm5.elf PID: 6254, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: Aqua.arm5.elf, type: SAMPLE
Source: Yara match	File source: 6254.1.00007fd614017000.00007fd61403b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6250.1.00007fd614017000.00007fd61403b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Aqua.arm5.elf PID: 6250, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Aqua.arm5.elf PID: 6254, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 File Deletion	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Aqua.arm5.elf	39%	ReversingLabs	Linux.Backdoor.Mirai
Aqua.arm5.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
daisy.ubuntu.com	162.213.35.24	true	false	high
server.eye-network.ru	unknown	unknown	true	unknown
server.eye-network.ru. [malformed]	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.35.dr, syslog.57.dr, syslog.101.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
54.171.230.55	unknown	United States	16509	AMAZON-02US	false
162.213.35.25	unknown	United States	41231	CANONICAL-ASGB	false
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54.171.230.55	x86.elf	Get hash	malicious	Unknown	Browse
	arm6.elf	Get hash	malicious	Unknown	Browse
	spc.elf	Get hash	malicious	Unknown	Browse
	mpsl.elf	Get hash	malicious	Unknown	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse
	co.elf	Get hash	malicious	Gafgyt, Mirai	Browse
162.213.35.25	Aqua.m68k.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	iwir64.elf	Get hash	malicious	Mirai	Browse
	vsbeps.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse
	jwwofba5.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	Aqua.mips.elf	Get hash	malicious	Mirai	Browse
	Aqua.i686.elf	Get hash	malicious	Mirai	Browse
	Aqua.x86.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	Aqua.ppc.elf	Get hash	malicious	Mirai	Browse
	Aqua.mpsl.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm4.elf	Get hash	malicious	Mirai	Browse
	Aqua.m68k.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	Aqua.ppc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	Aqua.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	Aqua.m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	main_x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	debug.dbg.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.24
	arm6.nn-20241205-0609.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	bin.sh.elf	Get hash	malicious	Mirai	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	Aqua.mips.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.i686.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.x86.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.ppc.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.mpsl.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.arm4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.m68k.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	dwhdbg.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
AMAZON-02US	main_spc.elf	Get hash	malicious	Mirai	Browse	54.104.48.220
	na.elf	Get hash	malicious	Unknown	Browse	52.216.45.205
	https://hr-recruitment-application.com/red-bull/id-00981	Get hash	malicious	Unknown	Browse	52.38.173.188
	jW3NEKvxH1.exe	Get hash	malicious	Remcos, DBatLoader	Browse	185.166.143.50
	yG53aU3gGm.exe	Get hash	malicious	Unknown	Browse	185.166.143.50
	yG53aU3gGm.exe	Get hash	malicious	Unknown	Browse	185.166.143.50
	QUOTATON-37839993.exe	Get hash	malicious	FormBook	Browse	13.228.81.39
	http://www.javatpoint.com.cach3.com/	Get hash	malicious	Unknown	Browse	52.76.92.93
	f3aef511705f37f9792c6032b936ca61.exe	Get hash	malicious	Njrat	Browse	18.157.68.73
	https://skillbridge.ca/onlinePaymentverify.html	Get hash	malicious	Unknown	Browse	108.158.75.100
CANONICAL-ASGB	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Aqua.ppc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Aqua.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	i.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_arm6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	tftp.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	memfd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	tftp.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	x86.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/6631/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:8:8
MD5:	45256D5CBEBF40978D314F5A58A6693D
SHA1:	4C0E12A6041195301883BBB22556E9B6D399FE25
SHA-256:	515F8717F7A3C0EAA7066C2A989325B90FA8489422EC2FA2E2944330CD7BEED0
SHA-512:	A7018B1003A6E8C23D32F0BAD2028E9163A6CA60821C9D037D2BA7856D3803BE257215EBA98F1241112437B6A0785182FFFA3C4DA04BA6EDF295646E6D9D21E8
Malicious:	false
Reputation:	low
Preview:	6605.

/run/systemd/seats/.#seat05Ai2cY

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0O8VX6V

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0j6uDiT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/users/.#127Km3Y2U

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.456730506170413
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0IxffQ0JgqNu5t6EB6:qgFq30dABibBICgGKIw6
MD5:	03311A130F0022A8DA9DB354212862BD
SHA1:	41AD013EBE0131E909872CFA9B922911C4A67438
SHA-256:	80B280DBF2BB444B8DAAB784990B56FBF698218CDA7090067D4E8E74D6E90D5D
SHA-512:	DB1705623A436B25A24E78DA973AA07130611B71E08E66D760C637C3B157FEB196DBB4D87E22AEC1BF925DC2FE92D94496E021FF00E99C84007F63F783599CF6
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13006.REALTIME=1733481746231544.MONOTONIC=438351866.LAST_SESSION_TIMESTAMP=438430355.

/run/systemd/users/.#127RoIWiX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.3020208891335265
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6GJgqNZ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB7gGIthQHtPYq9M
MD5:	90F5B13CC5C69DF98CB22FD43ECDC627
SHA1:	5F7D021B4845041061BC54EDA4E3DCBD8A64FFA7
SHA-256:	8346F796E6E51517B4BE640148420CB394DCE208C0C81526D7E9AC2C4058CFF0
SHA-512:	9365919DAA0AB2796D026B65D3E83D8886AB01891D509B8C21E288474431636F38D1BCC0DAEEE5BEC14220CDEF275A6DE7ED69D9354C6D99BA7A010CFF8A1399
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12944.REALTIME=1733481746231544.MONOTONIC=438351866.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127puFNyY

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.3020208891335265
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6GJgqNZ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB7gGIthQHtPYq9M
MD5:	90F5B13CC5C69DF98CB22FD43ECDC627
SHA1:	5F7D021B4845041061BC54EDA4E3DCBD8A64FFA7
SHA-256:	8346F796E6E51517B4BE640148420CB394DCE208C0C81526D7E9AC2C4058CFF0
SHA-512:	9365919DAA0AB2796D026B65D3E83D8886AB01891D509B8C21E288474431636F38D1BCC0DAEEE5BEC14220CDEF275A6DE7ED69D9354C6D99BA7A010CFF8A1399
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12944.REALTIME=1733481746231544.MONOTONIC=438351866.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127rbfDbX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127yjOUzY

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.287920995017701
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgG7LRHTx4R5206qodvWB6:SbFuFyL3BVgdL87iesnAiRJgqNu5t6EY
MD5:	50CE9959B2A33E17BAF83BCA2267708D
SHA1:	3658727C884078D834102F3C3BC40BFB4AC2EA1F
SHA-256:	D72D063DCA0CB70A6E63F54A01D72B497672E57B36A55B8C2451C9FE52075B06
SHA-512:	7DB9295C1A79D01C704919B60EE6DA70C444648494241B225ED60AB41D47EB62E32D19C2F825DCC857E1F9DF9EA897E378B8D0C416985A025CD3F9471EF61DAC
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1733481746231544.MONOTONIC=438351866.LAST_SESSION_TIMESTAMP=438430355.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:9vn:Nn
MD5:	289B54A4D30E2078EB146569B16A47E6
SHA1:	37682CAFF1B08FC2CC12AC1C2BB846E9CFE49D37
SHA-256:	EDCA54B01E931195FD893E0716AE8D7EF548DEB8193BD1079C6C692B0EDE5EC2
SHA-512:	B607685FF96C00E6F8259A4100B3F0A6F724A7A24BB6BA72BF0D1463C87C0C4A61BD681437DE27BDD9D8547C23C3F03752735412E6E65538E9947866C34F943D
Malicious:	false
Preview:	6673.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:/AsXlXEWtl/55mlX:/h+ylSX
MD5:	C845632ECEE10BA106F9549808FF3960
SHA1:	9A2A89D80553CC6CF548254B1DA63C48288E4127
SHA-256:	5E1216F27E42CF92A0D63F647678F52DEAF42AE62238682E4C12ED75EBD17D50
SHA-512:	3480846FEB3C8FCC61FC6A9B2F5DF87DF7F1C772CF3378C424D7899B843AE5ADE4DCBF5AAE0AFAB0CE368DFA7F1DB6FF84250EE0524E93AFC21C7EBF86B65B8E
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN.....................................................................................................................................................................................................................................................................................................Rgv.......................................

/tmp/qemu-open.x2zjOM (deleted)

Download File

Process:	/tmp/Aqua.arm5.elf
File Type:	data
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.1162646156680225
Encrypted:	false
SSDEEP:	3:Tg0wV8HJN:TguJN
MD5:	4544A7679D740EEB693F73BE3B914EA6
SHA1:	D464EFA50C50C678F92B3527D32F733EE193E9FD
SHA-256:	BF8D67FE4A6830DF4F7C4EFDF835D627B7AC41C686A405ECBEBE1D58FE741A08
SHA-512:	828DBECBB143E5502FE6FE8B1CA67AFE4FAB9DFD02B0C9EEDFB648166A3F5CE4B2BC5927852CDC277B1D25B80431CCB2C637536B17D834AA3DA53B7926330024
Malicious:	false
Preview:	/tmp/Aqua.arm5.elf.nwlrbbmqbh

/var/lib/AccountsService/users/gdm.A6QQY2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1537
Entropy (8bit):	4.881860927955781
Encrypted:	false
SSDEEP:	24:VuZeaBuZ4BBwGB4R4p50rAvZrA2+VDklt0pYrpfJrpOKSUgerCQU:Ov2fV3YrjrV0erCn
MD5:	84C789C40EB1A1D436CC361C64A35AC2
SHA1:	49AB5FF8589512526D9451E013B7F1293CD84ACD
SHA-256:	F954B8DB9601F911C94FC06985458ACB30EF98AEC505134D29EFE4D8B0CA6CEE
SHA-512:	1E096EFA85805FE53FDB52D751727A101CA44F7CEDABE9DAB0B8F42DC17F2F3572DDF98BAD2F58A9D365244C4BDC9B2E34AC485235C74E81390BC938362D6C88
Malicious:	false
Preview:	Dec 6 04:42:21 galassia systemd-logind[6543]: Failed to add user by file name 1000, ignoring: Invalid argument.Dec 6 04:42:21 galassia systemd-logind[6543]: Failed to add user by file name 127, ignoring: Invalid argument.Dec 6 04:42:21 galassia systemd-logind[6543]: User enumeration failed: Invalid argument.Dec 6 04:42:21 galassia systemd-logind[6543]: User of session 2 not known..Dec 6 04:42:21 galassia systemd-logind[6543]: User of session c1 not known..Dec 6 04:42:21 galassia systemd-logind[6543]: Session enumeration failed: No such file or directory.Dec 6 04:42:21 galassia systemd-logind[6543]: Watching system buttons on /dev/input/event0 (Power Button).Dec 6 04:42:21 galassia systemd-logind[6543]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Dec 6 04:42:21 galassia systemd-logind[6543]: New seat seat0..Dec 6 04:42:26 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Dec 6 04:

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	4594
Entropy (8bit):	4.643889491030624
Encrypted:	false
SSDEEP:	48:5dlNXXTZynnX3rC9jI5OX7QVGucRQ0wXZJpHceuFIZVXJPSW/4SW66ey+ncJ5sz5:9VOxGUN6R1XVw
MD5:	6B28479CB546A65A54853D7FE5EFB05E
SHA1:	FC24DCDEC7FA7D76EEBB78094B9DA25719146BF1
SHA-256:	9AA9CD08FEF553447D1D1C1DAD0DA500FA86A818F8D511C18108E9C50ADDF263
SHA-512:	D6BE71D9656EBF66D1C8A713235F198F1A237BBB34376ED98E6A79EB47A0563D279E396F937FD9D994C8E17FCAC065EDB316DAD4B1A7C1E636E87C0CA15FC07D
Malicious:	false
Preview:	Dec 6 04:42:19 galassia kernel: [ 430.630011] blocking signal 9: 6254 -> 2048.Dec 6 04:42:19 galassia kernel: [ 431.311948] New task spawned: old: (tgid 6532, tid 6532), new (tgid: 6532, tid: 6536).Dec 6 04:42:19 galassia kernel: [ 431.598161] New task spawned: old: (tgid 6534, tid 6534), new (tgid: 6534, tid: 6537).Dec 6 04:42:19 galassia kernel: [ 431.598967] New task spawned: old: (tgid 6534, tid 6534), new (tgid: 6534, tid: 6538).Dec 6 04:42:20 galassia kernel: [ 431.601595] New task spawned: old: (tgid 6534, tid 6537), new (tgid: 6534, tid: 6539).Dec 6 04:42:20 galassia kernel: [ 432.168274] New task spawned: old: (tgid 6532, tid 6532), new (tgid: 6532, tid: 6540).Dec 6 04:42:23 galassia kernel: [ 432.493616] New task spawned: old: (tgid 6532, tid 6532), new (tgid: 6532, tid: 6600).Dec 6 04:42:23 galassia kernel: [ 435.077793] New task spawned: old: (tgid 6605, tid 6605), new (tgid: 6605, tid: 6606).Dec 6 04:42:23 galassia kernel: [ 435.097741] New task spawned:

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (317)
Category:	dropped
Size (bytes):	26277
Entropy (8bit):	4.973681885808838
Encrypted:	false
SSDEEP:	768:keYfzhQ2KmUVLgEyz1RHLJVXecAC86m4pPzN8i2Qp3DlLRlPeEQ6i8AG3pVTRL/P:kasz
MD5:	0032731C2AF8759703BCDA3C194E0FD0
SHA1:	24F3927E6B209D2974B95090813FFA519E91A6E2
SHA-256:	A1FFF3B2C4A5F5544D77F6CA98A83A5A462F74C0BD710BC61102041DB2A00667
SHA-512:	2260B11A80FF8A11E16268B8F9665210D513C1DAD17CE0B5DEDD5276A7E452F9E60750704B682A74F70CF2DBD31C91E09E6751C9457C42441133089A6F04EEFD
Malicious:	false
Preview:	Dec 6 04:42:19 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Dec 6 04:42:19 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Dec 6 04:42:19 galassia whoopsie[6532]: [04:42:19] Using lock path: /var/lock/whoopsie/lock.Dec 6 04:42:19 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 3..Dec 6 04:42:19 galassia systemd[1]: Stopped System Logging Service..Dec 6 04:42:19 galassia systemd[1]: Starting System Logging Service....Dec 6 04:42:19 galassia systemd[1]: getty@tty2.service: Succeeded..Dec 6 04:42:19 galassia systemd[1]: getty@tty2.service: Scheduled restart job, restart counter is at 1..Dec 6 04:42:19 galassia systemd[1]: Stopped Getty on tty2..Dec 6 04:42:19 galassia systemd[1]: Started Getty on tty2..Dec 6 04:42:19 galassia systemd[1]: Started System Logging Service..Dec 6 04:42:19 galassia rsyslogd: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd.

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:/AsXlXEWtl/55mlX:/h+ylSX
MD5:	C845632ECEE10BA106F9549808FF3960
SHA1:	9A2A89D80553CC6CF548254B1DA63C48288E4127
SHA-256:	5E1216F27E42CF92A0D63F647678F52DEAF42AE62238682E4C12ED75EBD17D50
SHA-512:	3480846FEB3C8FCC61FC6A9B2F5DF87DF7F1C772CF3378C424D7899B843AE5ADE4DCBF5AAE0AFAB0CE368DFA7F1DB6FF84250EE0524E93AFC21C7EBF86B65B8E
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN.....................................................................................................................................................................................................................................................................................................Rgv.......................................

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	5.670673593742775
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Aqua.arm5.elf
File size:	166'656 bytes
MD5:	2da1798fbb916db08633e3e21c7dd051
SHA1:	f92a83277889f4228cba05e58e3a9976f0e5f534
SHA256:	6196cb20d16b99920b874df4abd3e0a6b0becbd3355651fd2d38448933824267
SHA512:	b088ed79dd1088ffb95ba1b722f3fed501f7823c5077a9e55a9e7e92a403693f9d95a0438011bfab92dab191c1d184de94f93b0ecc791ba4f9a367d6f3efcd4c
SSDEEP:	1536:uxEcAAMp6f1SKGuUUL6aCgME1Ha7iwi1KAf7q4VSiETftCn0gtOQQOBFcNKISlz7:u8AMUvu77g1K14FErtC0CrcMtbL
TLSH:	78F31945F8815F23C6D622BBFB5E428D372617A8D3EE72038D256F20379685B0E77642
File Content Preview:	.ELF...a..........(.........4...p.......4. ...(......................=...=...............@...@...@..0I..............Q.td..................................-...L."...............0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	166256
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x20750	0x0	0x6	AX	16
.fini	PROGBITS	0x28800	0x20800	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x28814	0x20814	0x35ac	0x0	0x2	A	4
.ctors	PROGBITS	0x34000	0x24000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x3400c	0x2400c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x34020	0x24020	0x4910	0x0	0x3	WA	32
.bss	NOBITS	0x38930	0x28930	0x46a0	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x28930	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x23dc0	0x23dc0	6.0956	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x24000	0x34000	0x34000	0x4930	0x8fd0	0.4235	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 6, 2024 11:42:11.661571980 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Dec 6, 2024 11:43:31.675520897 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 6, 2024 11:42:03.068691015 CET	192.168.2.23	8.8.8.8	0xc2b0	Standard query (0)	server.eye-network.ru	A (IP address)	IN (0x0001)	false
Dec 6, 2024 11:42:03.194389105 CET	192.168.2.23	8.8.8.8	0xc2b0	Standard query (0)	server.eye-network.ru	A (IP address)	IN (0x0001)	false
Dec 6, 2024 11:42:03.318342924 CET	192.168.2.23	8.8.8.8	0xc2b0	Standard query (0)	server.eye-network.ru	A (IP address)	IN (0x0001)	false
Dec 6, 2024 11:42:03.443561077 CET	192.168.2.23	8.8.8.8	0xc2b0	Standard query (0)	server.eye-network.ru	A (IP address)	IN (0x0001)	false
Dec 6, 2024 11:42:03.567768097 CET	192.168.2.23	8.8.8.8	0xc2b0	Standard query (0)	server.eye-network.ru	A (IP address)	IN (0x0001)	false
Dec 6, 2024 11:42:03.693521976 CET	192.168.2.23	8.8.8.8	0xeeab	Standard query (0)	server.eye-network.ru. [malformed]	256	507	false
Dec 6, 2024 11:42:03.818629026 CET	192.168.2.23	8.8.8.8	0xeeab	Standard query (0)	server.eye-network.ru. [malformed]	256	507	false
Dec 6, 2024 11:42:03.952950001 CET	192.168.2.23	8.8.8.8	0xeeab	Standard query (0)	server.eye-network.ru. [malformed]	256	508	false
Dec 6, 2024 11:42:04.080399036 CET	192.168.2.23	8.8.8.8	0xeeab	Standard query (0)	server.eye-network.ru. [malformed]	256	508	false
Dec 6, 2024 11:42:04.205447912 CET	192.168.2.23	8.8.8.8	0xeeab	Standard query (0)	server.eye-network.ru. [malformed]	256	508	false
Dec 6, 2024 11:42:07.050215960 CET	192.168.2.23	1.1.1.1	0xa05a	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 6, 2024 11:42:07.050260067 CET	192.168.2.23	1.1.1.1	0x5275	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 11:42:08.194616079 CET	192.168.2.23	8.8.8.8	0xd892	Standard query (0)	server.eye-network.ru. [malformed]	256	256	false
Dec 6, 2024 11:42:08.328078985 CET	192.168.2.23	8.8.8.8	0xd892	Standard query (0)	server.eye-network.ru. [malformed]	256	256	false
Dec 6, 2024 11:42:08.459307909 CET	192.168.2.23	8.8.8.8	0xd892	Standard query (0)	server.eye-network.ru. [malformed]	256	256	false
Dec 6, 2024 11:42:08.588399887 CET	192.168.2.23	8.8.8.8	0xd892	Standard query (0)	server.eye-network.ru. [malformed]	256	256	false
Dec 6, 2024 11:42:08.716324091 CET	192.168.2.23	8.8.8.8	0xd892	Standard query (0)	server.eye-network.ru. [malformed]	256	256	false
Dec 6, 2024 11:42:10.376552105 CET	192.168.2.23	1.1.1.1	0x8aa9	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 6, 2024 11:42:10.904088974 CET	192.168.2.23	1.1.1.1	0x4aaa	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 6, 2024 11:42:17.556507111 CET	192.168.2.23	8.8.8.8	0x639	Standard query (0)	server.eye-network.ru. [malformed]	256	265	false
Dec 6, 2024 11:42:17.680643082 CET	192.168.2.23	8.8.8.8	0x639	Standard query (0)	server.eye-network.ru. [malformed]	256	265	false
Dec 6, 2024 11:42:17.806363106 CET	192.168.2.23	8.8.8.8	0x639	Standard query (0)	server.eye-network.ru. [malformed]	256	265	false
Dec 6, 2024 11:42:17.929836988 CET	192.168.2.23	8.8.8.8	0x639	Standard query (0)	server.eye-network.ru. [malformed]	256	266	false
Dec 6, 2024 11:42:18.059540987 CET	192.168.2.23	8.8.8.8	0x639	Standard query (0)	server.eye-network.ru. [malformed]	256	266	false
Dec 6, 2024 11:42:19.814167976 CET	192.168.2.23	8.8.8.8	0xcb6e	Standard query (0)	server.eye-network.ru. [malformed]	256	267	false
Dec 6, 2024 11:42:19.942311049 CET	192.168.2.23	8.8.8.8	0xcb6e	Standard query (0)	server.eye-network.ru. [malformed]	256	267	false
Dec 6, 2024 11:42:20.067495108 CET	192.168.2.23	8.8.8.8	0xcb6e	Standard query (0)	server.eye-network.ru. [malformed]	256	268	false
Dec 6, 2024 11:42:20.193031073 CET	192.168.2.23	8.8.8.8	0xcb6e	Standard query (0)	server.eye-network.ru. [malformed]	256	268	false
Dec 6, 2024 11:42:20.323867083 CET	192.168.2.23	8.8.8.8	0xcb6e	Standard query (0)	server.eye-network.ru. [malformed]	256	268	false
Dec 6, 2024 11:42:21.724165916 CET	192.168.2.23	1.1.1.1	0xe245	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 6, 2024 11:42:31.078999043 CET	192.168.2.23	8.8.8.8	0xa23a	Standard query (0)	server.eye-network.ru. [malformed]	256	279	false
Dec 6, 2024 11:42:31.382220030 CET	192.168.2.23	8.8.8.8	0xa23a	Standard query (0)	server.eye-network.ru. [malformed]	256	279	false
Dec 6, 2024 11:42:31.506453991 CET	192.168.2.23	8.8.8.8	0xa23a	Standard query (0)	server.eye-network.ru. [malformed]	256	279	false
Dec 6, 2024 11:42:31.632014036 CET	192.168.2.23	8.8.8.8	0xa23a	Standard query (0)	server.eye-network.ru. [malformed]	256	279	false
Dec 6, 2024 11:42:31.760915995 CET	192.168.2.23	8.8.8.8	0xa23a	Standard query (0)	server.eye-network.ru. [malformed]	256	279	false
Dec 6, 2024 11:42:36.533364058 CET	192.168.2.23	8.8.8.8	0xc60b	Standard query (0)	server.eye-network.ru. [malformed]	256	284	false
Dec 6, 2024 11:42:36.657557011 CET	192.168.2.23	8.8.8.8	0xc60b	Standard query (0)	server.eye-network.ru. [malformed]	256	284	false
Dec 6, 2024 11:42:36.785393000 CET	192.168.2.23	8.8.8.8	0xc60b	Standard query (0)	server.eye-network.ru. [malformed]	256	284	false
Dec 6, 2024 11:42:36.912185907 CET	192.168.2.23	8.8.8.8	0xc60b	Standard query (0)	server.eye-network.ru. [malformed]	256	284	false
Dec 6, 2024 11:42:37.039158106 CET	192.168.2.23	8.8.8.8	0xc60b	Standard query (0)	server.eye-network.ru. [malformed]	256	285	false
Dec 6, 2024 11:42:44.806884050 CET	192.168.2.23	8.8.8.8	0x8c9e	Standard query (0)	server.eye-network.ru. [malformed]	256	292	false
Dec 6, 2024 11:42:44.935064077 CET	192.168.2.23	8.8.8.8	0x8c9e	Standard query (0)	server.eye-network.ru. [malformed]	256	293	false
Dec 6, 2024 11:42:45.060328007 CET	192.168.2.23	8.8.8.8	0x8c9e	Standard query (0)	server.eye-network.ru. [malformed]	256	293	false
Dec 6, 2024 11:42:45.184665918 CET	192.168.2.23	8.8.8.8	0x8c9e	Standard query (0)	server.eye-network.ru. [malformed]	256	293	false
Dec 6, 2024 11:42:45.313565969 CET	192.168.2.23	8.8.8.8	0x8c9e	Standard query (0)	server.eye-network.ru. [malformed]	256	293	false
Dec 6, 2024 11:42:47.075037956 CET	192.168.2.23	8.8.8.8	0x286c	Standard query (0)	server.eye-network.ru. [malformed]	256	295	false
Dec 6, 2024 11:42:47.199093103 CET	192.168.2.23	8.8.8.8	0x286c	Standard query (0)	server.eye-network.ru. [malformed]	256	295	false
Dec 6, 2024 11:42:47.324177980 CET	192.168.2.23	8.8.8.8	0x286c	Standard query (0)	server.eye-network.ru. [malformed]	256	295	false
Dec 6, 2024 11:42:47.447789907 CET	192.168.2.23	8.8.8.8	0x286c	Standard query (0)	server.eye-network.ru. [malformed]	256	295	false
Dec 6, 2024 11:42:47.572267056 CET	192.168.2.23	8.8.8.8	0x286c	Standard query (0)	server.eye-network.ru. [malformed]	256	295	false
Dec 6, 2024 11:42:55.338377953 CET	192.168.2.23	8.8.8.8	0x2730	Standard query (0)	server.eye-network.ru. [malformed]	256	303	false
Dec 6, 2024 11:42:55.469568968 CET	192.168.2.23	8.8.8.8	0x2730	Standard query (0)	server.eye-network.ru. [malformed]	256	303	false
Dec 6, 2024 11:42:55.601377964 CET	192.168.2.23	8.8.8.8	0x2730	Standard query (0)	server.eye-network.ru. [malformed]	256	303	false
Dec 6, 2024 11:42:55.732244968 CET	192.168.2.23	8.8.8.8	0x2730	Standard query (0)	server.eye-network.ru. [malformed]	256	303	false
Dec 6, 2024 11:42:55.858483076 CET	192.168.2.23	8.8.8.8	0x2730	Standard query (0)	server.eye-network.ru. [malformed]	256	303	false
Dec 6, 2024 11:42:59.861795902 CET	192.168.2.23	8.8.8.8	0xdf55	Standard query (0)	server.eye-network.ru. [malformed]	256	307	false
Dec 6, 2024 11:42:59.985656977 CET	192.168.2.23	8.8.8.8	0xdf55	Standard query (0)	server.eye-network.ru. [malformed]	256	308	false
Dec 6, 2024 11:43:00.110479116 CET	192.168.2.23	8.8.8.8	0xdf55	Standard query (0)	server.eye-network.ru. [malformed]	256	308	false
Dec 6, 2024 11:43:00.234025002 CET	192.168.2.23	8.8.8.8	0xdf55	Standard query (0)	server.eye-network.ru. [malformed]	256	308	false
Dec 6, 2024 11:43:00.357621908 CET	192.168.2.23	8.8.8.8	0xdf55	Standard query (0)	server.eye-network.ru. [malformed]	256	308	false
Dec 6, 2024 11:43:08.129091978 CET	192.168.2.23	8.8.8.8	0x3b0e	Standard query (0)	server.eye-network.ru. [malformed]	256	316	false
Dec 6, 2024 11:43:08.260967970 CET	192.168.2.23	8.8.8.8	0x3b0e	Standard query (0)	server.eye-network.ru. [malformed]	256	316	false
Dec 6, 2024 11:43:08.392297983 CET	192.168.2.23	8.8.8.8	0x3b0e	Standard query (0)	server.eye-network.ru. [malformed]	256	316	false
Dec 6, 2024 11:43:08.521418095 CET	192.168.2.23	8.8.8.8	0x3b0e	Standard query (0)	server.eye-network.ru. [malformed]	256	316	false
Dec 6, 2024 11:43:08.653064013 CET	192.168.2.23	8.8.8.8	0x3b0e	Standard query (0)	server.eye-network.ru. [malformed]	256	323	false
Dec 6, 2024 11:43:16.287096977 CET	192.168.2.23	8.8.8.8	0xc81c	Standard query (0)	server.eye-network.ru. [malformed]	256	324	false
Dec 6, 2024 11:43:16.413857937 CET	192.168.2.23	8.8.8.8	0xc81c	Standard query (0)	server.eye-network.ru. [malformed]	256	324	false
Dec 6, 2024 11:43:16.540352106 CET	192.168.2.23	8.8.8.8	0xc81c	Standard query (0)	server.eye-network.ru. [malformed]	256	324	false
Dec 6, 2024 11:43:16.664799929 CET	192.168.2.23	8.8.8.8	0xc81c	Standard query (0)	server.eye-network.ru. [malformed]	256	324	false
Dec 6, 2024 11:43:16.791244984 CET	192.168.2.23	8.8.8.8	0xc81c	Standard query (0)	server.eye-network.ru. [malformed]	256	324	false
Dec 6, 2024 11:43:26.545772076 CET	192.168.2.23	8.8.8.8	0x92fb	Standard query (0)	server.eye-network.ru. [malformed]	256	334	false
Dec 6, 2024 11:43:26.669753075 CET	192.168.2.23	8.8.8.8	0x92fb	Standard query (0)	server.eye-network.ru. [malformed]	256	334	false
Dec 6, 2024 11:43:26.794538975 CET	192.168.2.23	8.8.8.8	0x92fb	Standard query (0)	server.eye-network.ru. [malformed]	256	334	false
Dec 6, 2024 11:43:26.920977116 CET	192.168.2.23	8.8.8.8	0x92fb	Standard query (0)	server.eye-network.ru. [malformed]	256	335	false
Dec 6, 2024 11:43:27.046037912 CET	192.168.2.23	8.8.8.8	0x92fb	Standard query (0)	server.eye-network.ru. [malformed]	256	335	false
Dec 6, 2024 11:43:35.792119026 CET	192.168.2.23	8.8.8.8	0xd110	Standard query (0)	server.eye-network.ru. [malformed]	256	343	false
Dec 6, 2024 11:43:35.922271967 CET	192.168.2.23	8.8.8.8	0xd110	Standard query (0)	server.eye-network.ru. [malformed]	256	344	false
Dec 6, 2024 11:43:36.048384905 CET	192.168.2.23	8.8.8.8	0xd110	Standard query (0)	server.eye-network.ru. [malformed]	256	344	false
Dec 6, 2024 11:43:36.435736895 CET	192.168.2.23	8.8.8.8	0xd110	Standard query (0)	server.eye-network.ru. [malformed]	256	344	false
Dec 6, 2024 11:43:36.562366009 CET	192.168.2.23	8.8.8.8	0xd110	Standard query (0)	server.eye-network.ru. [malformed]	256	344	false
Dec 6, 2024 11:43:47.317209959 CET	192.168.2.23	8.8.8.8	0x152d	Standard query (0)	server.eye-network.ru. [malformed]	256	355	false
Dec 6, 2024 11:43:47.445158958 CET	192.168.2.23	8.8.8.8	0x152d	Standard query (0)	server.eye-network.ru. [malformed]	256	355	false
Dec 6, 2024 11:43:47.571641922 CET	192.168.2.23	8.8.8.8	0x152d	Standard query (0)	server.eye-network.ru. [malformed]	256	355	false
Dec 6, 2024 11:43:47.695594072 CET	192.168.2.23	8.8.8.8	0x152d	Standard query (0)	server.eye-network.ru. [malformed]	256	355	false
Dec 6, 2024 11:43:47.821096897 CET	192.168.2.23	8.8.8.8	0x152d	Standard query (0)	server.eye-network.ru. [malformed]	256	355	false
Dec 6, 2024 11:43:51.569596052 CET	192.168.2.23	8.8.8.8	0xa6cd	Standard query (0)	server.eye-network.ru. [malformed]	256	359	false
Dec 6, 2024 11:43:51.697551966 CET	192.168.2.23	8.8.8.8	0xa6cd	Standard query (0)	server.eye-network.ru. [malformed]	256	359	false
Dec 6, 2024 11:43:51.821526051 CET	192.168.2.23	8.8.8.8	0xa6cd	Standard query (0)	server.eye-network.ru. [malformed]	256	359	false
Dec 6, 2024 11:43:51.946742058 CET	192.168.2.23	8.8.8.8	0xa6cd	Standard query (0)	server.eye-network.ru. [malformed]	256	360	false
Dec 6, 2024 11:43:52.072871923 CET	192.168.2.23	8.8.8.8	0xa6cd	Standard query (0)	server.eye-network.ru. [malformed]	256	360	false
Dec 6, 2024 11:43:53.825103045 CET	192.168.2.23	8.8.8.8	0x89b	Standard query (0)	server.eye-network.ru. [malformed]	256	361	false
Dec 6, 2024 11:43:53.954715967 CET	192.168.2.23	8.8.8.8	0x89b	Standard query (0)	server.eye-network.ru. [malformed]	256	362	false
Dec 6, 2024 11:43:54.079005957 CET	192.168.2.23	8.8.8.8	0x89b	Standard query (0)	server.eye-network.ru. [malformed]	256	362	false
Dec 6, 2024 11:43:54.203217030 CET	192.168.2.23	8.8.8.8	0x89b	Standard query (0)	server.eye-network.ru. [malformed]	256	362	false
Dec 6, 2024 11:43:54.328021049 CET	192.168.2.23	8.8.8.8	0x89b	Standard query (0)	server.eye-network.ru. [malformed]	256	362	false
Dec 6, 2024 11:43:58.074851990 CET	192.168.2.23	8.8.8.8	0x3ddd	Standard query (0)	server.eye-network.ru. [malformed]	256	366	false
Dec 6, 2024 11:43:58.199079990 CET	192.168.2.23	8.8.8.8	0x3ddd	Standard query (0)	server.eye-network.ru. [malformed]	256	366	false
Dec 6, 2024 11:43:58.325743914 CET	192.168.2.23	8.8.8.8	0x3ddd	Standard query (0)	server.eye-network.ru. [malformed]	256	366	false
Dec 6, 2024 11:43:58.451759100 CET	192.168.2.23	8.8.8.8	0x3ddd	Standard query (0)	server.eye-network.ru. [malformed]	256	366	false
Dec 6, 2024 11:43:58.580925941 CET	192.168.2.23	8.8.8.8	0x3ddd	Standard query (0)	server.eye-network.ru. [malformed]	256	366	false
Dec 6, 2024 11:44:03.328535080 CET	192.168.2.23	8.8.8.8	0xc6b9	Standard query (0)	server.eye-network.ru. [malformed]	256	371	false
Dec 6, 2024 11:44:03.454847097 CET	192.168.2.23	8.8.8.8	0xc6b9	Standard query (0)	server.eye-network.ru. [malformed]	256	371	false
Dec 6, 2024 11:44:03.580219984 CET	192.168.2.23	8.8.8.8	0xc6b9	Standard query (0)	server.eye-network.ru. [malformed]	256	371	false
Dec 6, 2024 11:44:03.705655098 CET	192.168.2.23	8.8.8.8	0xc6b9	Standard query (0)	server.eye-network.ru. [malformed]	256	371	false
Dec 6, 2024 11:44:03.830590963 CET	192.168.2.23	8.8.8.8	0xc6b9	Standard query (0)	server.eye-network.ru. [malformed]	256	371	false
Dec 6, 2024 11:44:12.594402075 CET	192.168.2.23	8.8.8.8	0x9085	Standard query (0)	server.eye-network.ru. [malformed]	256	380	false
Dec 6, 2024 11:44:12.718400955 CET	192.168.2.23	8.8.8.8	0x9085	Standard query (0)	server.eye-network.ru. [malformed]	256	380	false
Dec 6, 2024 11:44:12.843369961 CET	192.168.2.23	8.8.8.8	0x9085	Standard query (0)	server.eye-network.ru. [malformed]	256	380	false
Dec 6, 2024 11:44:12.967240095 CET	192.168.2.23	8.8.8.8	0x9085	Standard query (0)	server.eye-network.ru. [malformed]	256	381	false
Dec 6, 2024 11:44:13.091172934 CET	192.168.2.23	8.8.8.8	0x9085	Standard query (0)	server.eye-network.ru. [malformed]	256	381	false
Dec 6, 2024 11:44:19.853682995 CET	192.168.2.23	8.8.8.8	0x64d3	Standard query (0)	server.eye-network.ru. [malformed]	256	387	false
Dec 6, 2024 11:44:19.978923082 CET	192.168.2.23	8.8.8.8	0x64d3	Standard query (0)	server.eye-network.ru. [malformed]	256	388	false
Dec 6, 2024 11:44:20.103805065 CET	192.168.2.23	8.8.8.8	0x64d3	Standard query (0)	server.eye-network.ru. [malformed]	256	388	false
Dec 6, 2024 11:44:20.227869987 CET	192.168.2.23	8.8.8.8	0x64d3	Standard query (0)	server.eye-network.ru. [malformed]	256	388	false
Dec 6, 2024 11:44:20.352771997 CET	192.168.2.23	8.8.8.8	0x64d3	Standard query (0)	server.eye-network.ru. [malformed]	256	388	false
Dec 6, 2024 11:44:31.119149923 CET	192.168.2.23	8.8.8.8	0x63b	Standard query (0)	server.eye-network.ru. [malformed]	256	399	false
Dec 6, 2024 11:44:31.249419928 CET	192.168.2.23	8.8.8.8	0x63b	Standard query (0)	server.eye-network.ru. [malformed]	256	399	false
Dec 6, 2024 11:44:31.373936892 CET	192.168.2.23	8.8.8.8	0x63b	Standard query (0)	server.eye-network.ru. [malformed]	256	399	false
Dec 6, 2024 11:44:31.500269890 CET	192.168.2.23	8.8.8.8	0x63b	Standard query (0)	server.eye-network.ru. [malformed]	256	399	false
Dec 6, 2024 11:44:31.625190973 CET	192.168.2.23	8.8.8.8	0x63b	Standard query (0)	server.eye-network.ru. [malformed]	256	399	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 6, 2024 11:42:03.192003965 CET	8.8.8.8	192.168.2.23	0xc2b0	Name error (3)	server.eye-network.ru	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2024 11:42:03.317157030 CET	8.8.8.8	192.168.2.23	0xc2b0	Name error (3)	server.eye-network.ru	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2024 11:42:03.442545891 CET	8.8.8.8	192.168.2.23	0xc2b0	Name error (3)	server.eye-network.ru	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2024 11:42:03.566327095 CET	8.8.8.8	192.168.2.23	0xc2b0	Name error (3)	server.eye-network.ru	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2024 11:42:03.690802097 CET	8.8.8.8	192.168.2.23	0xc2b0	Name error (3)	server.eye-network.ru	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2024 11:42:07.279148102 CET	1.1.1.1	192.168.2.23	0x5275	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Dec 6, 2024 11:42:07.279148102 CET	1.1.1.1	192.168.2.23	0x5275	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-12-06 10:42:14 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2024-12-06 10:42:14 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-06 10:42:14 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2024-12-06 10:42:14 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2024-12-06 10:42:14 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2024-12-06 10:42:14 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2024-12-06 10:42:14 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2024-12-06 10:42:14 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2024-12-06 10:42:14 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2024-12-06 10:42:14 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2024-12-06 10:42:14 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2024-12-06 10:42:14 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2024-12-06 10:42:15 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Fri, 06 Dec 2024 10:42:15 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	10:42:01
Start date (UTC):	06/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	10:42:02
Start date (UTC):	06/12/2024
Path:	/tmp/Aqua.arm5.elf
Arguments:	/tmp/Aqua.arm5.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	10:42:03
Start date (UTC):	06/12/2024
Path:	/usr/libexec/gsd-rfkill
Arguments:	/usr/libexec/gsd-rfkill
File size:	51808 bytes
MD5 hash:	88a16a3c0aba1759358c06215ecfb5cc

Start time (UTC):	10:42:05
Start date (UTC):	06/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	10:42:06
Start date (UTC):	06/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	10:42:07
Start date (UTC):	06/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	10:42:08
Start date (UTC):	06/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	10:42:09
Start date (UTC):	06/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	10:42:10
Start date (UTC):	06/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	10:42:14
Start date (UTC):	06/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	10:42:11
Start date (UTC):	06/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	10:42:12
Start date (UTC):	06/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Aqua.arm5.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6631/oom_score_adj

/run/gdm3.pid

/run/systemd/seats/.#seat05Ai2cY

/run/systemd/seats/.#seat0O8VX6V

/run/systemd/seats/.#seat0j6uDiT

/run/systemd/users/.#127Km3Y2U

/run/systemd/users/.#127RoIWiX

/run/systemd/users/.#127puFNyY

/run/systemd/users/.#127rbfDbX

/run/systemd/users/.#127yjOUzY

/run/user/1000/pulse/pid

/run/utmp

/tmp/qemu-open.x2zjOM (deleted)

/var/lib/AccountsService/users/gdm.A6QQY2

/var/lib/ubuntu-drivers-common/last_gfx_boot

/var/log/auth.log

/var/log/gpu-manager.log

/var/log/kern.log

/var/log/syslog

/var/log/wtmp

Static File Info

General

Static ELF Info

Linux Analysis Report
Aqua.arm5.elf

Start time (UTC):	10:42:19
Start date (UTC):	06/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	10:42:23
Start date (UTC):	06/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	10:42:20
Start date (UTC):	06/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	10:42:22
Start date (UTC):	06/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	10:42:24
Start date (UTC):	06/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	10:42:26
Start date (UTC):	06/12/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	10:42:27
Start date (UTC):	06/12/2024
Path:	/usr/bin/dbus-run-session
Arguments:	-
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4

Start time (UTC):	10:43:36
Start date (UTC):	06/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre