Edit tour

Linux Analysis Report
Aqua.arm7.elf

Overview

General Information

Sample name:	Aqua.arm7.elf
Analysis ID:	1571356
MD5:	e543ad9b455dc9aca86d9cada1fd9454
SHA1:	fa4a260b769df0888cedbb3d0d5be7e71e93c72f
SHA256:	68edae6398f12d534bacea84fad2126775e9eb4c13d363ae9bb1fcd27e258bd9
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	88
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sends malformed DNS queries

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system version information

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571356
Start date and time:	2024-12-09 10:18:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Aqua.arm7.elf
Detection:	MAL
Classification:	mal88.troj.evad.linELF@0/19@123/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Aqua.arm7.elf

Runtime Messages

Command:	/tmp/Aqua.arm7.elf
PID:	6220
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

Aqua.arm7.elf (PID: 6220, Parent: 6132, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/Aqua.arm7.elf

Aqua.arm7.elf New Fork (PID: 6222, Parent: 6220)

Aqua.arm7.elf New Fork (PID: 6224, Parent: 6222)

systemd New Fork (PID: 6231, Parent: 1)

dbus-daemon (PID: 6231, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6262, Parent: 1860)

pulseaudio (PID: 6262, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6267, Parent: 1)

rtkit-daemon (PID: 6267, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6270, Parent: 1)

systemd-logind (PID: 6270, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6332, Parent: 1)

polkitd (PID: 6332, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6339, Parent: 1)

agetty (PID: 6339, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 6340, Parent: 1320)

Default (PID: 6340, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6341, Parent: 1320)

Default (PID: 6341, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6342, Parent: 1320)

Default (PID: 6342, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6343, Parent: 1)

gpu-manager (PID: 6343, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6344, Parent: 6343)

sh (PID: 6344, Parent: 6343, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6345, Parent: 6344)

grep (PID: 6345, Parent: 6344, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6346, Parent: 6343)

sh (PID: 6346, Parent: 6343, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6347, Parent: 6346)

grep (PID: 6347, Parent: 6346, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6348, Parent: 6343)

sh (PID: 6348, Parent: 6343, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6349, Parent: 6348)

grep (PID: 6349, Parent: 6348, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6350, Parent: 6343)

sh (PID: 6350, Parent: 6343, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6351, Parent: 6350)

grep (PID: 6351, Parent: 6350, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6352, Parent: 6343)

sh (PID: 6352, Parent: 6343, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6353, Parent: 6352)

grep (PID: 6353, Parent: 6352, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6355, Parent: 6343)

sh (PID: 6355, Parent: 6343, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6356, Parent: 6355)

grep (PID: 6356, Parent: 6355, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6357, Parent: 6343)

sh (PID: 6357, Parent: 6343, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6358, Parent: 6357)

grep (PID: 6358, Parent: 6357, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6359, Parent: 6343)

sh (PID: 6359, Parent: 6343, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6360, Parent: 6359)

grep (PID: 6360, Parent: 6359, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6362, Parent: 1)

generate-config (PID: 6362, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6363, Parent: 6362)

pkill (PID: 6363, Parent: 6362, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6367, Parent: 1)

gdm-wait-for-drm (PID: 6367, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6372, Parent: 1)

gdm3 (PID: 6372, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6377, Parent: 6372)

plymouth (PID: 6377, Parent: 6372, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6394, Parent: 6372)

gdm-session-worker (PID: 6394, Parent: 6372, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6399, Parent: 6394)

gdm-wayland-session (PID: 6399, Parent: 6394, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6401, Parent: 6399)

dbus-daemon (PID: 6401, Parent: 6399, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6403, Parent: 6401)

dbus-daemon New Fork (PID: 6404, Parent: 6403)

false (PID: 6404, Parent: 6403, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6405, Parent: 6399)

dbus-run-session (PID: 6405, Parent: 6399, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6406, Parent: 6405)

dbus-daemon (PID: 6406, Parent: 6405, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6409, Parent: 6372)

Default (PID: 6409, Parent: 6372, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6410, Parent: 6372)

Default (PID: 6410, Parent: 6372, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6378, Parent: 1)

accounts-daemon (PID: 6378, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6389, Parent: 6378)

language-validate (PID: 6389, Parent: 6378, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6390, Parent: 6389)

language-options (PID: 6390, Parent: 6389, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6391, Parent: 6390)

sh (PID: 6391, Parent: 6390, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6392, Parent: 6391)

locale (PID: 6392, Parent: 6391, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6393, Parent: 6391)

grep (PID: 6393, Parent: 6391, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Aqua.arm7.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Aqua.arm7.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1fd78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fda0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fdb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fdc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fddc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fdf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fea4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1feb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fecc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fee0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fef4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ff08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6220.1.00007f83f0017000.00007f83f003a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6220.1.00007f83f0017000.00007f83f003a000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1fd78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fda0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fdb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fdc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fddc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fdf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fea4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1feb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fecc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fee0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fef4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ff08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Aqua.arm7.elf PID: 6220	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Aqua.arm7.elf PID: 6220	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x140a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1410c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14120:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14134:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14148:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1415c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14170:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14184:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14198:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x141ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x141c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x141d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x141e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x141fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14210:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14224:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14238:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Aqua.arm7.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: Aqua.arm7.elf

ReversingLabs: Detection: 39%

Source: /usr/bin/pulseaudio (PID: 6262)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: Aqua.arm7.elf

String: EOF/proc//proc/%s/cmdlinewgetcurlftpechokillbashrebootshutdownhaltpoweroff[locker] killed process: %s ;; pid: %d

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: server.eye-network.ru. [malformed]

Source: global traffic

TCP traffic: 192.168.2.23:50012 -> 89.190.156.145:7733

Source: global traffic

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/gdm3 (PID: 6372)	Socket: unknown address family			Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6401)	Socket: unknown address family			Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: global traffic	DNS traffic detected: DNS query: server.eye-network.ru
Source: global traffic	DNS traffic detected: DNS query: server.eye-network.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53066
Source: unknown	Network traffic detected: HTTP traffic on port 53066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: Aqua.arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6220.1.00007f83f0017000.00007f83f003a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Aqua.arm7.elf PID: 6220, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: /tmp/Aqua.arm7.elf (PID: 6224)

SIGKILL sent: pid: 777, result: successful

Jump to behavior

Source: Aqua.arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6220.1.00007f83f0017000.00007f83f003a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Aqua.arm7.elf PID: 6220, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal88.troj.evad.linELF@0/19@123/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6231)	File: /proc/6231/mounts			Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6401)	File: /proc/6401/mounts			Jump to behavior

Source: /lib/systemd/systemd-logind (PID: 6270)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6270)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6270)	File: /run/systemd/seats/.#seat0Dui1Oh	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6270)	File: /run/systemd/users/.#127OqyEgl	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6270)	File: /run/systemd/users/.#127StHlli	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6270)	File: /run/systemd/seats/.#seat0YnHb4j	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6270)	File: /run/systemd/users/.#127hg2W2i	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6270)	File: /run/systemd/users/.#127Tezrbj	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6270)	File: /run/systemd/users/.#127dPSmak	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6270)	File: /run/systemd/users/.#127sJwRRi	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6332)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6399)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6378)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6378)	Directory: /root/.cache	Jump to behavior

Source: /usr/bin/dbus-daemon (PID: 6231)	File opened: /proc/6262/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6231)	File opened: /proc/6262/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6231)	File opened: /proc/6262/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6231)	File opened: /proc/6372/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6231)	File opened: /proc/6394/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6231)	File opened: /proc/6394/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6231)	File opened: /proc/6231/status	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6231)	File opened: /proc/6231/attr/current	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6231)	File opened: /proc/6267/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6231)	File opened: /proc/6399/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6231)	File opened: /proc/6332/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6231)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6231)	File opened: /proc/6378/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6231)	File opened: /proc/6270/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6231)	File opened: /proc/6260/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6231)	File opened: /proc/6260/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6231)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6231)	File opened: /proc/1389/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6232/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6232/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6231/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6231/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6234/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6234/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6233/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6233/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6236/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6236/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6235/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6235/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/3088/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/230/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/230/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/231/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/231/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/232/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/232/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/233/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/233/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/234/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/234/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/1335/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/1334/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/2302/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/236/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/236/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/237/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/237/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/910/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/910/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6226/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6226/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/2307/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6241/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6241/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6362/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6362/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6240/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6240/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/13/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6243/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6243/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/14/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/14/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6242/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6242/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6363/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6363/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/15/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/15/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6245/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	File opened: /proc/6245/cmdline	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6344)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6346)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6348)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6350)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6352)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6355)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6357)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6359)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6391)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Source: /bin/sh (PID: 6345)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6347)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6349)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6351)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6353)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6356)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6358)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6360)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6393)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6363)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /sbin/agetty (PID: 6339)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6372)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6372)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6378)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6378)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6343)

Log file created: /var/log/gpu-manager.log

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/Aqua.arm7.elf (PID: 6222)

File: /tmp/Aqua.arm7.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6343)

Truncated file: /var/log/gpu-manager.log

Jump to behavior

Source: /usr/bin/pulseaudio (PID: 6262)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pkill (PID: 6363)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /tmp/Aqua.arm7.elf (PID: 6220)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6262)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6339)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6343)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6394)	Queries kernel information via 'uname':	Jump to behavior

Source: Aqua.arm7.elf, 6220.1.0000558d790d2000.0000558d79225000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: Aqua.arm7.elf, 6220.1.00007ffea999a000.00007ffea99bb000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.8vAp8x
Source: Aqua.arm7.elf, 6220.1.0000558d790d2000.0000558d79225000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: Aqua.arm7.elf, 6220.1.00007ffea999a000.00007ffea99bb000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: Aqua.arm7.elf, 6220.1.00007ffea999a000.00007ffea99bb000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/Aqua.arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Aqua.arm7.elf
Source: Aqua.arm7.elf, 6220.1.00007ffea999a000.00007ffea99bb000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.8vAp8x:

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6378)

Logged in records file read: /var/log/wtmp

Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: Aqua.arm7.elf, type: SAMPLE
Source: Yara match	File source: 6220.1.00007f83f0017000.00007f83f003a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Aqua.arm7.elf PID: 6220, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: Aqua.arm7.elf, type: SAMPLE
Source: Yara match	File source: 6220.1.00007f83f0017000.00007f83f003a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Aqua.arm7.elf PID: 6220, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Aqua.arm7.elf	39%	ReversingLabs	Linux.Backdoor.Mirai
Aqua.arm7.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
daisy.ubuntu.com	162.213.35.24	true	false	high
server.eye-network.ru	unknown	unknown	false	high
server.eye-network.ru. [malformed]	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.213.35.25	unknown	United States	41231	CANONICAL-ASGB	false
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.213.35.25	wnbw86.elf	Get hash	malicious	Mirai	Browse
	Aqua.x86_64.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm5.elf	Get hash	malicious	Mirai	Browse
	Aqua.m68k.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	iwir64.elf	Get hash	malicious	Mirai	Browse
	vsbeps.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	wnbw86.elf	Get hash	malicious	Mirai	Browse
	iwir64.elf	Get hash	malicious	Mirai	Browse
	Aqua.sh4.elf	Get hash	malicious	Mirai	Browse
	Aqua.dbg.elf	Get hash	malicious	Mirai	Browse
	Aqua.x86_64.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm5.elf	Get hash	malicious	Mirai	Browse
	Aqua.mips.elf	Get hash	malicious	Mirai	Browse
	Aqua.i686.elf	Get hash	malicious	Mirai	Browse
	Aqua.x86.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	SwiftSec.ppc.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	M68K.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	I686.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	ARMV6L.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	SPARC.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	I586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	ARMV5L.elf	Get hash	malicious	Unknown	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	wnbw86.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	iwir64.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.sh4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.dbg.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.x86_64.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.arm5.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.mips.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.i686.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.x86.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
CANONICAL-ASGB	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	boatnet.arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	SwiftSec.mpsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	jew.arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
INIT7CH	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	SwiftSec.mpsl.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	jew.arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
CANONICAL-ASGB	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	boatnet.arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	SwiftSec.mpsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	jew.arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/6404/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Z/:B
MD5:	4F0DAE187D37D4E077C7E0D983062F0D
SHA1:	015D3E620EEAE94538504BFEECC35263B66B13EB
SHA-256:	BC6E7B8C3B65EA14469D935A7073E59038497CB27C46F858D46706561E74D11C
SHA-512:	EDC14D31E77472BBEE5AE26887E086C4A0F9C2BD7F22A065DA25A596AE3DE40D3003CAD5B6D57E73237895800F5A579B497F8A78F70D6A8B8628D76B3CB9550C
Malicious:	false
Reputation:	low
Preview:	6372.

/run/systemd/seats/.#seat0Dui1Oh

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0YnHb4j

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/users/.#127OqyEgl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127StHlli

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.294985472222192
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6N/QgTgXgKhp2zLQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBE/QCgXgA2jthQHtP0
MD5:	99165C69CB6BE093EAD5B72B39A52427
SHA1:	80652A4814036CA929E378D35F765987E0C0540A
SHA-256:	742DAE093E307E6924F7ECE3E7BFE5244CA98DE8136977B6C91ECBE03411BE55
SHA-512:	9CFD7F29318F4F4B989424F8FA1FBB987A80EF6C3A3068D79C9BBC588CDEE5D35E93B2899885E6C3588C01E222B02BAD22B7456892E9B0F710A2D59A380B493C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12282.REALTIME=1733735949108428.MONOTONIC=428101453.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127Tezrbj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.327131127380303
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgGacR9o/Wmxvpk2x6H206qod2k:SbFuFyL3BVgdL87iesnAiRJgXgKhptgO
MD5:	89B9DFD704C4393693318042BD686221
SHA1:	A9E3F41F4DFC721B8BBCE9016B890A475DF150C5
SHA-256:	C11D2EF38736F2168F6B5F855932EDCF12C069841CAF98C6AB595A71A599C77C
SHA-512:	A155DF8BF485A5F6AB2FDD1202C3A30552C5BFA399714ED92489EFAC1644EF29D2F30FE41E987B93D93A3DFEC188884623EF31A4C5ACCCBA70E203E9403172BA
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1733735949108428.MONOTONIC=428101453.LAST_SESSION_TIMESTAMP=428182736.

/run/systemd/users/.#127dPSmak

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.47045873033463
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6wJgXgKhptgt69:qgFq30dABibBxgXgAtgI9
MD5:	D364839B8712C10D165A7455B2B766EE
SHA1:	798F37498B91938EA3F09B7139822F2A908BA38F
SHA-256:	C06B3FBDD9922D9E9C320F41E0083FDB107691B82036E97CFF8F1E43B5C2DAA5
SHA-512:	075EB0B68C1ADE1F05A97C338934B1EC8206F0276CB4270F0C851194C524D32BAD4ECE56ACD5B16E74F0C12ED3106EE8488F0F303021D998681BBDED1978BFEC
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12344.REALTIME=1733735949108428.MONOTONIC=428101453.LAST_SESSION_TIMESTAMP=428182736.

/run/systemd/users/.#127hg2W2i

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.294985472222192
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6N/QgTgXgKhp2zLQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBE/QCgXgA2jthQHtP0
MD5:	99165C69CB6BE093EAD5B72B39A52427
SHA1:	80652A4814036CA929E378D35F765987E0C0540A
SHA-256:	742DAE093E307E6924F7ECE3E7BFE5244CA98DE8136977B6C91ECBE03411BE55
SHA-512:	9CFD7F29318F4F4B989424F8FA1FBB987A80EF6C3A3068D79C9BBC588CDEE5D35E93B2899885E6C3588C01E222B02BAD22B7456892E9B0F710A2D59A380B493C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12282.REALTIME=1733735949108428.MONOTONIC=428101453.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127sJwRRi

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.47045873033463
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6wJgXgKhptgt69:qgFq30dABibBxgXgAtgI9
MD5:	D364839B8712C10D165A7455B2B766EE
SHA1:	798F37498B91938EA3F09B7139822F2A908BA38F
SHA-256:	C06B3FBDD9922D9E9C320F41E0083FDB107691B82036E97CFF8F1E43B5C2DAA5
SHA-512:	075EB0B68C1ADE1F05A97C338934B1EC8206F0276CB4270F0C851194C524D32BAD4ECE56ACD5B16E74F0C12ED3106EE8488F0F303021D998681BBDED1978BFEC
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12344.REALTIME=1733735949108428.MONOTONIC=428101453.LAST_SESSION_TIMESTAMP=428182736.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.5219280948873621
Encrypted:	false
SSDEEP:	3:nvn:v
MD5:	354A50B3CF001E260F6AE0E68139E8A6
SHA1:	83E04012ED7A3B83B0A5141160BD23CB7F61289C
SHA-256:	48EF0D0E08B79F951050220F8E305790CFE898927FD40E70E613604B24CF2003
SHA-512:	17B726A86ECBBCBAFD313404D76128529B8443221BAD77C3F6EF5FF6C13EE53F0F22070474154A6262F327E4566688499EE5AC311D62377F67D441CA296E1235
Malicious:	false
Preview:	6262.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351417
Encrypted:	false
SSDEEP:	3:4lc1sXlXEWtl/v:QcQ+yl
MD5:	F780205AFDB0A9981280BE4D0E03AC30
SHA1:	D6A816DF922A52541EB80FEDDFD5F46248ECA4C0
SHA-256:	5A8D72AA3D9E90063C57C1F1D15EAF7E7A668B3E3987677CD7C9A3EC5A745D14
SHA-512:	5676BD50D493C112E03F73D5739897FFA924A0360F62F9941721DCF1FAB974450314E61CEF22604AA04AF6C4A36EE44E84D1C3E466A0065E61D1FC218F549EBD
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN.....................................................................................................................................................................................................................................................................................................Vg.......................................

/tmp/qemu-open.8vAp8x (deleted)

Download File

Process:	/tmp/Aqua.arm7.elf
File Type:	data
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.1162646156680225
Encrypted:	false
SSDEEP:	3:Tg2I8HJN:TggJN
MD5:	AE01A55EDFEBB175718FEF844D567F93
SHA1:	F34721848DD919F7771D6707D211F6D02FB979E6
SHA-256:	485A707A99D19B3B0EA0BED39B9B9738D4B232562E9D3943091AEFE59366330F
SHA-512:	A6B3104E52059F23AC0564428D6870F737CEBE1875C78F4BD3DB6EB3FAD46DF832DBA7D8BF467FA6CB4D995035F0AE1B62D158EEF27AED358597A5795596ACAD
Malicious:	false
Preview:	/tmp/Aqua.arm7.elf.nwlrbbmqbh

/var/lib/AccountsService/users/gdm.W2SNY2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351417
Encrypted:	false
SSDEEP:	3:4lc1sXlXEWtl/v:QcQ+yl
MD5:	F780205AFDB0A9981280BE4D0E03AC30
SHA1:	D6A816DF922A52541EB80FEDDFD5F46248ECA4C0
SHA-256:	5A8D72AA3D9E90063C57C1F1D15EAF7E7A668B3E3987677CD7C9A3EC5A745D14
SHA-512:	5676BD50D493C112E03F73D5739897FFA924A0360F62F9941721DCF1FAB974450314E61CEF22604AA04AF6C4A36EE44E84D1C3E466A0065E61D1FC218F549EBD
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN.....................................................................................................................................................................................................................................................................................................Vg.......................................

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.0231259781086415
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Aqua.arm7.elf
File size:	220'007 bytes
MD5:	e543ad9b455dc9aca86d9cada1fd9454
SHA1:	fa4a260b769df0888cedbb3d0d5be7e71e93c72f
SHA256:	68edae6398f12d534bacea84fad2126775e9eb4c13d363ae9bb1fcd27e258bd9
SHA512:	34051c62843aeea37c58199348a58af22f3d669feba0f281b14e9a7e0dbb50c7d193a68c1b05af8107e82ff2e392b0b030f6deaa35b1075496bb42e1232a4ccb
SSDEEP:	6144:Rdq+j3uigacvucaDxoWCZGq8kvVpM+uxGM/RzMIDW:R/j3u2aucadoWCZHP9p2xf/uI6
TLSH:	4C241A46EA418F13C4D627BAFA9F424533339754D3EB73069928AFB43B8675E0E23506
File Content Preview:	.ELF..............(.........4...........4. ...(........p4'..4...4...p...p............................(...(...............(...(...(.......V...............(...(...(..................Q.td..................................-...L..................@-.,@...0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	177164
Section Header Size:	40
Number of Section Headers:	30
Header String Table Index:	27

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x1f714	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x27804	0x1f804	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x27818	0x1f818	0x2f04	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x2a71c	0x2271c	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x2a734	0x22734	0x170	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x328a4	0x228a4	0x4	0x0	0x3	WA	0	0	4
.tdata	PROGBITS	0x328a8	0x228a8	0x4	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0x328ac	0x228ac	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x328ac	0x228ac	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x328b0	0x228b0	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x328b4	0x228b4	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x328b8	0x228b8	0xc0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x32978	0x22978	0x2f0	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x32c68	0x22c68	0x52f0	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x22c68	0xf8e	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x23bf8	0x180	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x23d78	0x23e	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x23fb6	0x2aa7	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x26a5d	0x99a	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x273f7	0x118c	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x28584	0x33c	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x288c0	0xabc	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x2937c	0x182a	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x2aba6	0x730	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x2b2d6	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x2b2ec	0x11e	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x2b8bc	0x6e50	0x10	0x0		29	1033	4
.strtab	STRTAB	0x0	0x3270c	0x3c5c	0x0	0x0		0	0	1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x22734	0x2a734	0x2a734	0x170	0x170	4.7243	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x228a4	0x228a4	6.1418	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x228a4	0x328a4	0x328a4	0x3c4	0x56b4	4.6883	0x6	RW	0x8000	.eh_frame .tdata .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x228a8	0x328a8	0x328a8	0x4	0xc	2.0000	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 10:18:48.158274889 CET	50012	7733	192.168.2.23	89.190.156.145
Dec 9, 2024 10:18:48.277560949 CET	7733	50012	89.190.156.145	192.168.2.23
Dec 9, 2024 10:18:48.277606010 CET	50012	7733	192.168.2.23	89.190.156.145
Dec 9, 2024 10:18:48.301507950 CET	50012	7733	192.168.2.23	89.190.156.145
Dec 9, 2024 10:18:48.420752048 CET	7733	50012	89.190.156.145	192.168.2.23
Dec 9, 2024 10:18:49.669967890 CET	43928	443	192.168.2.23	91.189.91.42
Dec 9, 2024 10:18:50.847820997 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:50.847852945 CET	443	53066	162.213.35.25	192.168.2.23
Dec 9, 2024 10:18:50.847908974 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:53.545886040 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:53.545909882 CET	443	53066	162.213.35.25	192.168.2.23
Dec 9, 2024 10:18:55.020736933 CET	443	53066	162.213.35.25	192.168.2.23
Dec 9, 2024 10:18:55.020854950 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:55.021097898 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:55.021109104 CET	443	53066	162.213.35.25	192.168.2.23
Dec 9, 2024 10:18:55.021353960 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:55.021363974 CET	443	53066	162.213.35.25	192.168.2.23
Dec 9, 2024 10:18:55.021420956 CET	443	53066	162.213.35.25	192.168.2.23
Dec 9, 2024 10:18:55.021456957 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:55.021462917 CET	443	53066	162.213.35.25	192.168.2.23
Dec 9, 2024 10:18:55.021493912 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:55.021923065 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:55.063332081 CET	443	53066	162.213.35.25	192.168.2.23
Dec 9, 2024 10:18:55.301152945 CET	42836	443	192.168.2.23	91.189.91.43
Dec 9, 2024 10:18:55.521514893 CET	443	53066	162.213.35.25	192.168.2.23
Dec 9, 2024 10:18:55.521579027 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:55.521691084 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:55.521691084 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:55.521716118 CET	443	53066	162.213.35.25	192.168.2.23
Dec 9, 2024 10:18:55.521730900 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:55.521730900 CET	443	53066	162.213.35.25	192.168.2.23
Dec 9, 2024 10:18:55.521730900 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:55.521743059 CET	443	53066	162.213.35.25	192.168.2.23
Dec 9, 2024 10:18:55.521756887 CET	443	53066	162.213.35.25	192.168.2.23
Dec 9, 2024 10:18:55.521775007 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:55.521775007 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:55.521785975 CET	443	53066	162.213.35.25	192.168.2.23
Dec 9, 2024 10:18:55.521800995 CET	443	53066	162.213.35.25	192.168.2.23
Dec 9, 2024 10:18:55.521816015 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:55.521816015 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:55.521827936 CET	443	53066	162.213.35.25	192.168.2.23
Dec 9, 2024 10:18:55.521836042 CET	443	53066	162.213.35.25	192.168.2.23
Dec 9, 2024 10:18:55.521847963 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:55.521847963 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:55.521853924 CET	443	53066	162.213.35.25	192.168.2.23
Dec 9, 2024 10:18:55.521861076 CET	443	53066	162.213.35.25	192.168.2.23
Dec 9, 2024 10:18:55.521873951 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:55.521873951 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:55.521887064 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:55.521903992 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:55.522020102 CET	443	53066	162.213.35.25	192.168.2.23
Dec 9, 2024 10:18:55.522109032 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:55.522124052 CET	443	53066	162.213.35.25	192.168.2.23
Dec 9, 2024 10:18:55.522150040 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:55.522150040 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:55.522161007 CET	443	53066	162.213.35.25	192.168.2.23
Dec 9, 2024 10:18:55.522167921 CET	443	53066	162.213.35.25	192.168.2.23
Dec 9, 2024 10:18:55.522171974 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:55.522177935 CET	443	53066	162.213.35.25	192.168.2.23
Dec 9, 2024 10:18:56.503145933 CET	443	53066	162.213.35.25	192.168.2.23
Dec 9, 2024 10:18:56.503223896 CET	443	53066	162.213.35.25	192.168.2.23
Dec 9, 2024 10:18:56.503225088 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:56.503319979 CET	53066	443	192.168.2.23	162.213.35.25
Dec 9, 2024 10:18:56.503335953 CET	443	53066	162.213.35.25	192.168.2.23
Dec 9, 2024 10:18:56.836941957 CET	42516	80	192.168.2.23	109.202.202.202
Dec 9, 2024 10:19:10.183886051 CET	7733	50012	89.190.156.145	192.168.2.23
Dec 9, 2024 10:19:10.186949015 CET	50012	7733	192.168.2.23	89.190.156.145
Dec 9, 2024 10:19:10.402936935 CET	43928	443	192.168.2.23	91.189.91.42
Dec 9, 2024 10:19:22.689172029 CET	42836	443	192.168.2.23	91.189.91.43
Dec 9, 2024 10:19:26.784554005 CET	42516	80	192.168.2.23	109.202.202.202
Dec 9, 2024 10:19:51.357039928 CET	43928	443	192.168.2.23	91.189.91.42

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 9, 2024 10:18:57.528471947 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Dec 9, 2024 10:20:17.553129911 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 9, 2024 10:18:47.698992014 CET	192.168.2.23	8.8.8.8	0x8e87	Standard query (0)	server.eye-network.ru	A (IP address)	IN (0x0001)	false
Dec 9, 2024 10:18:47.834393978 CET	192.168.2.23	8.8.8.8	0x8e87	Standard query (0)	server.eye-network.ru	A (IP address)	IN (0x0001)	false
Dec 9, 2024 10:18:47.968827009 CET	192.168.2.23	8.8.8.8	0x8e87	Standard query (0)	server.eye-network.ru	A (IP address)	IN (0x0001)	false
Dec 9, 2024 10:18:48.268151999 CET	192.168.2.23	8.8.8.8	0x8e87	Standard query (0)	server.eye-network.ru	A (IP address)	IN (0x0001)	false
Dec 9, 2024 10:18:48.404282093 CET	192.168.2.23	8.8.8.8	0x8e87	Standard query (0)	server.eye-network.ru	A (IP address)	IN (0x0001)	false
Dec 9, 2024 10:18:48.655308962 CET	192.168.2.23	8.8.8.8	0xa6ef	Standard query (0)	server.eye-network.ru. [malformed]	256	504	false
Dec 9, 2024 10:18:48.781469107 CET	192.168.2.23	8.8.8.8	0xa6ef	Standard query (0)	server.eye-network.ru. [malformed]	256	504	false
Dec 9, 2024 10:18:48.907922983 CET	192.168.2.23	8.8.8.8	0xa6ef	Standard query (0)	server.eye-network.ru. [malformed]	256	505	false
Dec 9, 2024 10:18:49.033529997 CET	192.168.2.23	8.8.8.8	0xa6ef	Standard query (0)	server.eye-network.ru. [malformed]	256	505	false
Dec 9, 2024 10:18:49.157588959 CET	192.168.2.23	8.8.8.8	0xa6ef	Standard query (0)	server.eye-network.ru. [malformed]	256	505	false
Dec 9, 2024 10:18:50.311346054 CET	192.168.2.23	8.8.8.8	0x4c3f	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 9, 2024 10:18:50.311347008 CET	192.168.2.23	8.8.8.8	0x621f	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 10:18:50.714987993 CET	192.168.2.23	8.8.8.8	0xe9e0	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 9, 2024 10:18:52.917160034 CET	192.168.2.23	8.8.8.8	0x9581	Standard query (0)	server.eye-network.ru. [malformed]	256	509	false
Dec 9, 2024 10:18:53.044219971 CET	192.168.2.23	8.8.8.8	0x9581	Standard query (0)	server.eye-network.ru. [malformed]	256	509	false
Dec 9, 2024 10:18:53.172841072 CET	192.168.2.23	8.8.8.8	0x9581	Standard query (0)	server.eye-network.ru. [malformed]	256	509	false
Dec 9, 2024 10:18:53.299333096 CET	192.168.2.23	8.8.8.8	0x9581	Standard query (0)	server.eye-network.ru. [malformed]	256	509	false
Dec 9, 2024 10:18:53.425735950 CET	192.168.2.23	8.8.8.8	0x9581	Standard query (0)	server.eye-network.ru. [malformed]	256	509	false
Dec 9, 2024 10:19:02.172658920 CET	192.168.2.23	8.8.8.8	0x7cfa	Standard query (0)	server.eye-network.ru. [malformed]	256	262	false
Dec 9, 2024 10:19:02.296183109 CET	192.168.2.23	8.8.8.8	0x7cfa	Standard query (0)	server.eye-network.ru. [malformed]	256	262	false
Dec 9, 2024 10:19:02.419739008 CET	192.168.2.23	8.8.8.8	0x7cfa	Standard query (0)	server.eye-network.ru. [malformed]	256	262	false
Dec 9, 2024 10:19:02.542726994 CET	192.168.2.23	8.8.8.8	0x7cfa	Standard query (0)	server.eye-network.ru. [malformed]	256	262	false
Dec 9, 2024 10:19:02.667620897 CET	192.168.2.23	8.8.8.8	0x7cfa	Standard query (0)	server.eye-network.ru. [malformed]	256	262	false
Dec 9, 2024 10:19:04.408080101 CET	192.168.2.23	8.8.8.8	0xfdb5	Standard query (0)	server.eye-network.ru. [malformed]	256	264	false
Dec 9, 2024 10:19:04.531358004 CET	192.168.2.23	8.8.8.8	0xfdb5	Standard query (0)	server.eye-network.ru. [malformed]	256	264	false
Dec 9, 2024 10:19:04.654553890 CET	192.168.2.23	8.8.8.8	0xfdb5	Standard query (0)	server.eye-network.ru. [malformed]	256	264	false
Dec 9, 2024 10:19:04.779360056 CET	192.168.2.23	8.8.8.8	0xfdb5	Standard query (0)	server.eye-network.ru. [malformed]	256	264	false
Dec 9, 2024 10:19:04.902230978 CET	192.168.2.23	8.8.8.8	0xfdb5	Standard query (0)	server.eye-network.ru. [malformed]	256	265	false
Dec 9, 2024 10:19:15.641522884 CET	192.168.2.23	8.8.8.8	0x1867	Standard query (0)	server.eye-network.ru. [malformed]	256	275	false
Dec 9, 2024 10:19:15.764282942 CET	192.168.2.23	8.8.8.8	0x1867	Standard query (0)	server.eye-network.ru. [malformed]	256	275	false
Dec 9, 2024 10:19:15.887275934 CET	192.168.2.23	8.8.8.8	0x1867	Standard query (0)	server.eye-network.ru. [malformed]	256	276	false
Dec 9, 2024 10:19:16.010744095 CET	192.168.2.23	8.8.8.8	0x1867	Standard query (0)	server.eye-network.ru. [malformed]	256	276	false
Dec 9, 2024 10:19:16.133896112 CET	192.168.2.23	8.8.8.8	0x1867	Standard query (0)	server.eye-network.ru. [malformed]	256	276	false
Dec 9, 2024 10:19:20.874006033 CET	192.168.2.23	8.8.8.8	0x8fb4	Standard query (0)	server.eye-network.ru. [malformed]	256	280	false
Dec 9, 2024 10:19:20.996970892 CET	192.168.2.23	8.8.8.8	0x8fb4	Standard query (0)	server.eye-network.ru. [malformed]	256	281	false
Dec 9, 2024 10:19:21.120121956 CET	192.168.2.23	8.8.8.8	0x8fb4	Standard query (0)	server.eye-network.ru. [malformed]	256	281	false
Dec 9, 2024 10:19:21.243094921 CET	192.168.2.23	8.8.8.8	0x8fb4	Standard query (0)	server.eye-network.ru. [malformed]	256	281	false
Dec 9, 2024 10:19:21.365926981 CET	192.168.2.23	8.8.8.8	0x8fb4	Standard query (0)	server.eye-network.ru. [malformed]	256	281	false
Dec 9, 2024 10:19:29.106041908 CET	192.168.2.23	8.8.8.8	0x8761	Standard query (0)	server.eye-network.ru. [malformed]	256	289	false
Dec 9, 2024 10:19:29.229018927 CET	192.168.2.23	8.8.8.8	0x8761	Standard query (0)	server.eye-network.ru. [malformed]	256	289	false
Dec 9, 2024 10:19:29.352242947 CET	192.168.2.23	8.8.8.8	0x8761	Standard query (0)	server.eye-network.ru. [malformed]	256	289	false
Dec 9, 2024 10:19:29.475136995 CET	192.168.2.23	8.8.8.8	0x8761	Standard query (0)	server.eye-network.ru. [malformed]	256	289	false
Dec 9, 2024 10:19:29.598177910 CET	192.168.2.23	8.8.8.8	0x8761	Standard query (0)	server.eye-network.ru. [malformed]	256	289	false
Dec 9, 2024 10:19:31.337392092 CET	192.168.2.23	8.8.8.8	0xaccc	Standard query (0)	server.eye-network.ru. [malformed]	256	291	false
Dec 9, 2024 10:19:31.460556984 CET	192.168.2.23	8.8.8.8	0xaccc	Standard query (0)	server.eye-network.ru. [malformed]	256	291	false
Dec 9, 2024 10:19:31.583661079 CET	192.168.2.23	8.8.8.8	0xaccc	Standard query (0)	server.eye-network.ru. [malformed]	256	291	false
Dec 9, 2024 10:19:31.707240105 CET	192.168.2.23	8.8.8.8	0xaccc	Standard query (0)	server.eye-network.ru. [malformed]	256	291	false
Dec 9, 2024 10:19:31.830506086 CET	192.168.2.23	8.8.8.8	0xaccc	Standard query (0)	server.eye-network.ru. [malformed]	256	291	false
Dec 9, 2024 10:19:39.570534945 CET	192.168.2.23	8.8.8.8	0x4728	Standard query (0)	server.eye-network.ru. [malformed]	256	299	false
Dec 9, 2024 10:19:39.693660021 CET	192.168.2.23	8.8.8.8	0x4728	Standard query (0)	server.eye-network.ru. [malformed]	256	299	false
Dec 9, 2024 10:19:39.816622972 CET	192.168.2.23	8.8.8.8	0x4728	Standard query (0)	server.eye-network.ru. [malformed]	256	299	false
Dec 9, 2024 10:19:39.940449953 CET	192.168.2.23	8.8.8.8	0x4728	Standard query (0)	server.eye-network.ru. [malformed]	256	300	false
Dec 9, 2024 10:19:40.063333988 CET	192.168.2.23	8.8.8.8	0x4728	Standard query (0)	server.eye-network.ru. [malformed]	256	300	false
Dec 9, 2024 10:19:43.807697058 CET	192.168.2.23	8.8.8.8	0x78aa	Standard query (0)	server.eye-network.ru. [malformed]	256	303	false
Dec 9, 2024 10:19:43.931155920 CET	192.168.2.23	8.8.8.8	0x78aa	Standard query (0)	server.eye-network.ru. [malformed]	256	304	false
Dec 9, 2024 10:19:44.054171085 CET	192.168.2.23	8.8.8.8	0x78aa	Standard query (0)	server.eye-network.ru. [malformed]	256	304	false
Dec 9, 2024 10:19:44.178056002 CET	192.168.2.23	8.8.8.8	0x78aa	Standard query (0)	server.eye-network.ru. [malformed]	256	304	false
Dec 9, 2024 10:19:44.302068949 CET	192.168.2.23	8.8.8.8	0x78aa	Standard query (0)	server.eye-network.ru. [malformed]	256	304	false
Dec 9, 2024 10:19:52.043670893 CET	192.168.2.23	8.8.8.8	0xf40b	Standard query (0)	server.eye-network.ru. [malformed]	256	312	false
Dec 9, 2024 10:19:52.166861057 CET	192.168.2.23	8.8.8.8	0xf40b	Standard query (0)	server.eye-network.ru. [malformed]	256	312	false
Dec 9, 2024 10:19:52.290388107 CET	192.168.2.23	8.8.8.8	0xf40b	Standard query (0)	server.eye-network.ru. [malformed]	256	312	false
Dec 9, 2024 10:19:52.413738012 CET	192.168.2.23	8.8.8.8	0xf40b	Standard query (0)	server.eye-network.ru. [malformed]	256	312	false
Dec 9, 2024 10:19:52.537800074 CET	192.168.2.23	8.8.8.8	0xf40b	Standard query (0)	server.eye-network.ru. [malformed]	256	312	false
Dec 9, 2024 10:19:55.281282902 CET	192.168.2.23	8.8.8.8	0x94ab	Standard query (0)	server.eye-network.ru. [malformed]	256	315	false
Dec 9, 2024 10:19:55.405112028 CET	192.168.2.23	8.8.8.8	0x94ab	Standard query (0)	server.eye-network.ru. [malformed]	256	315	false
Dec 9, 2024 10:19:55.531193972 CET	192.168.2.23	8.8.8.8	0x94ab	Standard query (0)	server.eye-network.ru. [malformed]	256	315	false
Dec 9, 2024 10:19:55.654589891 CET	192.168.2.23	8.8.8.8	0x94ab	Standard query (0)	server.eye-network.ru. [malformed]	256	315	false
Dec 9, 2024 10:19:55.779109955 CET	192.168.2.23	8.8.8.8	0x94ab	Standard query (0)	server.eye-network.ru. [malformed]	256	315	false
Dec 9, 2024 10:20:05.518501043 CET	192.168.2.23	8.8.8.8	0xd2a2	Standard query (0)	server.eye-network.ru. [malformed]	256	325	false
Dec 9, 2024 10:20:05.641647100 CET	192.168.2.23	8.8.8.8	0xd2a2	Standard query (0)	server.eye-network.ru. [malformed]	256	325	false
Dec 9, 2024 10:20:05.764761925 CET	192.168.2.23	8.8.8.8	0xd2a2	Standard query (0)	server.eye-network.ru. [malformed]	256	325	false
Dec 9, 2024 10:20:05.888410091 CET	192.168.2.23	8.8.8.8	0xd2a2	Standard query (0)	server.eye-network.ru. [malformed]	256	326	false
Dec 9, 2024 10:20:06.011398077 CET	192.168.2.23	8.8.8.8	0xd2a2	Standard query (0)	server.eye-network.ru. [malformed]	256	326	false
Dec 9, 2024 10:20:14.755810022 CET	192.168.2.23	8.8.8.8	0xd892	Standard query (0)	server.eye-network.ru. [malformed]	256	334	false
Dec 9, 2024 10:20:14.879597902 CET	192.168.2.23	8.8.8.8	0xd892	Standard query (0)	server.eye-network.ru. [malformed]	256	335	false
Dec 9, 2024 10:20:15.002636909 CET	192.168.2.23	8.8.8.8	0xd892	Standard query (0)	server.eye-network.ru. [malformed]	256	335	false
Dec 9, 2024 10:20:15.125499964 CET	192.168.2.23	8.8.8.8	0xd892	Standard query (0)	server.eye-network.ru. [malformed]	256	335	false
Dec 9, 2024 10:20:15.248178959 CET	192.168.2.23	8.8.8.8	0xd892	Standard query (0)	server.eye-network.ru. [malformed]	256	335	false
Dec 9, 2024 10:20:25.987428904 CET	192.168.2.23	8.8.8.8	0xb4bd	Standard query (0)	server.eye-network.ru. [malformed]	256	346	false
Dec 9, 2024 10:20:26.110311031 CET	192.168.2.23	8.8.8.8	0xb4bd	Standard query (0)	server.eye-network.ru. [malformed]	256	346	false
Dec 9, 2024 10:20:26.233685017 CET	192.168.2.23	8.8.8.8	0xb4bd	Standard query (0)	server.eye-network.ru. [malformed]	256	346	false
Dec 9, 2024 10:20:26.423717976 CET	192.168.2.23	8.8.8.8	0xb4bd	Standard query (0)	server.eye-network.ru. [malformed]	256	346	false
Dec 9, 2024 10:20:26.546624899 CET	192.168.2.23	8.8.8.8	0xb4bd	Standard query (0)	server.eye-network.ru. [malformed]	256	346	false
Dec 9, 2024 10:20:30.286721945 CET	192.168.2.23	8.8.8.8	0x2ce9	Standard query (0)	server.eye-network.ru. [malformed]	256	350	false
Dec 9, 2024 10:20:30.409697056 CET	192.168.2.23	8.8.8.8	0x2ce9	Standard query (0)	server.eye-network.ru. [malformed]	256	350	false
Dec 9, 2024 10:20:30.532887936 CET	192.168.2.23	8.8.8.8	0x2ce9	Standard query (0)	server.eye-network.ru. [malformed]	256	350	false
Dec 9, 2024 10:20:30.655898094 CET	192.168.2.23	8.8.8.8	0x2ce9	Standard query (0)	server.eye-network.ru. [malformed]	256	350	false
Dec 9, 2024 10:20:30.778713942 CET	192.168.2.23	8.8.8.8	0x2ce9	Standard query (0)	server.eye-network.ru. [malformed]	256	350	false
Dec 9, 2024 10:20:32.519902945 CET	192.168.2.23	8.8.8.8	0x544b	Standard query (0)	server.eye-network.ru. [malformed]	256	352	false
Dec 9, 2024 10:20:32.645468950 CET	192.168.2.23	8.8.8.8	0x544b	Standard query (0)	server.eye-network.ru. [malformed]	256	352	false
Dec 9, 2024 10:20:32.768588066 CET	192.168.2.23	8.8.8.8	0x544b	Standard query (0)	server.eye-network.ru. [malformed]	256	352	false
Dec 9, 2024 10:20:32.891768932 CET	192.168.2.23	8.8.8.8	0x544b	Standard query (0)	server.eye-network.ru. [malformed]	256	353	false
Dec 9, 2024 10:20:33.015784025 CET	192.168.2.23	8.8.8.8	0x544b	Standard query (0)	server.eye-network.ru. [malformed]	256	353	false
Dec 9, 2024 10:20:36.766169071 CET	192.168.2.23	8.8.8.8	0x6c91	Standard query (0)	server.eye-network.ru. [malformed]	256	356	false
Dec 9, 2024 10:20:36.889549017 CET	192.168.2.23	8.8.8.8	0x6c91	Standard query (0)	server.eye-network.ru. [malformed]	256	357	false
Dec 9, 2024 10:20:37.012914896 CET	192.168.2.23	8.8.8.8	0x6c91	Standard query (0)	server.eye-network.ru. [malformed]	256	357	false
Dec 9, 2024 10:20:37.136256933 CET	192.168.2.23	8.8.8.8	0x6c91	Standard query (0)	server.eye-network.ru. [malformed]	256	357	false
Dec 9, 2024 10:20:37.316001892 CET	192.168.2.23	8.8.8.8	0x6c91	Standard query (0)	server.eye-network.ru. [malformed]	256	357	false
Dec 9, 2024 10:20:42.060978889 CET	192.168.2.23	8.8.8.8	0x5fc9	Standard query (0)	server.eye-network.ru. [malformed]	256	362	false
Dec 9, 2024 10:20:42.184289932 CET	192.168.2.23	8.8.8.8	0x5fc9	Standard query (0)	server.eye-network.ru. [malformed]	256	362	false
Dec 9, 2024 10:20:42.307445049 CET	192.168.2.23	8.8.8.8	0x5fc9	Standard query (0)	server.eye-network.ru. [malformed]	256	362	false
Dec 9, 2024 10:20:42.430644989 CET	192.168.2.23	8.8.8.8	0x5fc9	Standard query (0)	server.eye-network.ru. [malformed]	256	362	false
Dec 9, 2024 10:20:42.553774118 CET	192.168.2.23	8.8.8.8	0x5fc9	Standard query (0)	server.eye-network.ru. [malformed]	256	362	false
Dec 9, 2024 10:20:51.293178082 CET	192.168.2.23	8.8.8.8	0xd334	Standard query (0)	server.eye-network.ru. [malformed]	256	371	false
Dec 9, 2024 10:20:51.416898966 CET	192.168.2.23	8.8.8.8	0xd334	Standard query (0)	server.eye-network.ru. [malformed]	256	371	false
Dec 9, 2024 10:20:51.540092945 CET	192.168.2.23	8.8.8.8	0xd334	Standard query (0)	server.eye-network.ru. [malformed]	256	371	false
Dec 9, 2024 10:20:51.662760973 CET	192.168.2.23	8.8.8.8	0xd334	Standard query (0)	server.eye-network.ru. [malformed]	256	371	false
Dec 9, 2024 10:20:51.786143064 CET	192.168.2.23	8.8.8.8	0xd334	Standard query (0)	server.eye-network.ru. [malformed]	256	371	false
Dec 9, 2024 10:20:58.527519941 CET	192.168.2.23	8.8.8.8	0x675a	Standard query (0)	server.eye-network.ru. [malformed]	256	378	false
Dec 9, 2024 10:20:58.684784889 CET	192.168.2.23	8.8.8.8	0x675a	Standard query (0)	server.eye-network.ru. [malformed]	256	378	false
Dec 9, 2024 10:20:58.869920969 CET	192.168.2.23	8.8.8.8	0x675a	Standard query (0)	server.eye-network.ru. [malformed]	256	378	false
Dec 9, 2024 10:20:58.993155956 CET	192.168.2.23	8.8.8.8	0x675a	Standard query (0)	server.eye-network.ru. [malformed]	256	379	false
Dec 9, 2024 10:20:59.116790056 CET	192.168.2.23	8.8.8.8	0x675a	Standard query (0)	server.eye-network.ru. [malformed]	256	379	false
Dec 9, 2024 10:21:09.859059095 CET	192.168.2.23	8.8.8.8	0x524a	Standard query (0)	server.eye-network.ru. [malformed]	256	389	false
Dec 9, 2024 10:21:09.982603073 CET	192.168.2.23	8.8.8.8	0x524a	Standard query (0)	server.eye-network.ru. [malformed]	256	390	false
Dec 9, 2024 10:21:10.106009007 CET	192.168.2.23	8.8.8.8	0x524a	Standard query (0)	server.eye-network.ru. [malformed]	256	390	false
Dec 9, 2024 10:21:10.229365110 CET	192.168.2.23	8.8.8.8	0x524a	Standard query (0)	server.eye-network.ru. [malformed]	256	390	false
Dec 9, 2024 10:21:10.353075027 CET	192.168.2.23	8.8.8.8	0x524a	Standard query (0)	server.eye-network.ru. [malformed]	256	390	false
Dec 9, 2024 10:21:14.096159935 CET	192.168.2.23	8.8.8.8	0xf2af	Standard query (0)	server.eye-network.ru. [malformed]	256	394	false
Dec 9, 2024 10:21:14.219575882 CET	192.168.2.23	8.8.8.8	0xf2af	Standard query (0)	server.eye-network.ru. [malformed]	256	394	false
Dec 9, 2024 10:21:14.342696905 CET	192.168.2.23	8.8.8.8	0xf2af	Standard query (0)	server.eye-network.ru. [malformed]	256	394	false
Dec 9, 2024 10:21:14.466270924 CET	192.168.2.23	8.8.8.8	0xf2af	Standard query (0)	server.eye-network.ru. [malformed]	256	394	false
Dec 9, 2024 10:21:14.589662075 CET	192.168.2.23	8.8.8.8	0xf2af	Standard query (0)	server.eye-network.ru. [malformed]	256	394	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 9, 2024 10:18:47.832694054 CET	8.8.8.8	192.168.2.23	0x8e87	Name error (3)	server.eye-network.ru	none	none	A (IP address)	IN (0x0001)	false
Dec 9, 2024 10:18:47.967717886 CET	8.8.8.8	192.168.2.23	0x8e87	Name error (3)	server.eye-network.ru	none	none	A (IP address)	IN (0x0001)	false
Dec 9, 2024 10:18:48.210294962 CET	8.8.8.8	192.168.2.23	0x8e87	Name error (3)	server.eye-network.ru	none	none	A (IP address)	IN (0x0001)	false
Dec 9, 2024 10:18:48.402031898 CET	8.8.8.8	192.168.2.23	0x8e87	Name error (3)	server.eye-network.ru	none	none	A (IP address)	IN (0x0001)	false
Dec 9, 2024 10:18:48.650367975 CET	8.8.8.8	192.168.2.23	0x8e87	Name error (3)	server.eye-network.ru	none	none	A (IP address)	IN (0x0001)	false
Dec 9, 2024 10:18:50.433636904 CET	8.8.8.8	192.168.2.23	0x621f	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Dec 9, 2024 10:18:50.433636904 CET	8.8.8.8	192.168.2.23	0x621f	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-12-09 09:18:55 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2024-12-09 09:18:55 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-09 09:18:55 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2024-12-09 09:18:55 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2024-12-09 09:18:55 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2024-12-09 09:18:55 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2024-12-09 09:18:55 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2024-12-09 09:18:55 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2024-12-09 09:18:55 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2024-12-09 09:18:55 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2024-12-09 09:18:55 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2024-12-09 09:18:55 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2024-12-09 09:18:56 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Mon, 09 Dec 2024 09:18:56 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	09:18:47
Start date (UTC):	09/12/2024
Path:	/tmp/Aqua.arm7.elf
Arguments:	/tmp/Aqua.arm7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	09:18:48
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	09:18:49
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	09:18:50
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	09:18:52
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	09:18:53
Start date (UTC):	09/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	09:18:54
Start date (UTC):	09/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	09:18:55
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	09:18:56
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	09:19:07
Start date (UTC):	09/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	09:19:08
Start date (UTC):	09/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Aqua.arm7.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6404/oom_score_adj

/run/gdm3.pid

/run/systemd/seats/.#seat0Dui1Oh

/run/systemd/seats/.#seat0YnHb4j

/run/systemd/users/.#127OqyEgl

/run/systemd/users/.#127StHlli

/run/systemd/users/.#127Tezrbj

/run/systemd/users/.#127dPSmak

/run/systemd/users/.#127hg2W2i

/run/systemd/users/.#127sJwRRi

/run/user/1000/pulse/pid

/run/utmp

/tmp/qemu-open.8vAp8x (deleted)

/var/lib/AccountsService/users/gdm.W2SNY2

/var/lib/ubuntu-drivers-common/last_gfx_boot

/var/log/gpu-manager.log

/var/log/wtmp

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Linux Analysis Report
Aqua.arm7.elf

Start time (UTC):	09:19:09
Start date (UTC):	09/12/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	09:19:10
Start date (UTC):	09/12/2024
Path:	/usr/bin/dbus-run-session
Arguments:	dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre