Edit tour

Linux Analysis Report
Aqua.arm7.elf

Overview

General Information

Sample name:	Aqua.arm7.elf
Analysis ID:	1581799
MD5:	8c9168d0015512b1f0252e7499416b30
SHA1:	9b1e02298ea414bfefbd97c00b7053ed15c33a66
SHA256:	b41e29e745b69f3e8c11d105e7e050fd9e08ff1e22efd97fd4c239a9095d708b
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	84
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Mirai

Contains symbols with names commonly found in malware

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sends malformed DNS queries

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system version information

Sample and/or dropped files contains symbols with suspicious names

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581799
Start date and time:	2024-12-29 01:07:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Aqua.arm7.elf
Detection:	MAL
Classification:	mal84.troj.evad.linELF@0/19@19/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: raw.intenseapi.com. [malformed]

Runtime Messages

Command:	/tmp/Aqua.arm7.elf
PID:	6228
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

Aqua.arm7.elf (PID: 6228, Parent: 6155, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/Aqua.arm7.elf

Aqua.arm7.elf New Fork (PID: 6230, Parent: 6228)

Aqua.arm7.elf New Fork (PID: 6232, Parent: 6230)

dash New Fork (PID: 6236, Parent: 4331)

rm (PID: 6236, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.bxo5t8Ikc9 /tmp/tmp.9tpPbxkSnb /tmp/tmp.ttBVyNMT7N

dash New Fork (PID: 6237, Parent: 4331)

rm (PID: 6237, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.bxo5t8Ikc9 /tmp/tmp.9tpPbxkSnb /tmp/tmp.ttBVyNMT7N

gdm3 New Fork (PID: 6270, Parent: 1320)

Default (PID: 6270, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6272, Parent: 1)

dbus-daemon (PID: 6272, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6273, Parent: 1860)

pulseaudio (PID: 6273, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

gdm3 New Fork (PID: 6274, Parent: 1320)

Default (PID: 6274, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6275, Parent: 1320)

Default (PID: 6275, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6280, Parent: 1)

rtkit-daemon (PID: 6280, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6283, Parent: 1)

systemd-logind (PID: 6283, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6345, Parent: 1)

polkitd (PID: 6345, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6350, Parent: 1)

gpu-manager (PID: 6350, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6351, Parent: 6350)

sh (PID: 6351, Parent: 6350, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6353, Parent: 6351)

grep (PID: 6353, Parent: 6351, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6355, Parent: 6350)

sh (PID: 6355, Parent: 6350, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6356, Parent: 6355)

grep (PID: 6356, Parent: 6355, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6357, Parent: 6350)

sh (PID: 6357, Parent: 6350, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6358, Parent: 6357)

grep (PID: 6358, Parent: 6357, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6359, Parent: 6350)

sh (PID: 6359, Parent: 6350, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6360, Parent: 6359)

grep (PID: 6360, Parent: 6359, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6363, Parent: 6350)

sh (PID: 6363, Parent: 6350, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6364, Parent: 6363)

grep (PID: 6364, Parent: 6363, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6365, Parent: 6350)

sh (PID: 6365, Parent: 6350, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6366, Parent: 6365)

grep (PID: 6366, Parent: 6365, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6367, Parent: 6350)

sh (PID: 6367, Parent: 6350, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6368, Parent: 6367)

grep (PID: 6368, Parent: 6367, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6370, Parent: 6350)

sh (PID: 6370, Parent: 6350, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6371, Parent: 6370)

grep (PID: 6371, Parent: 6370, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6354, Parent: 1)

agetty (PID: 6354, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6373, Parent: 1)

generate-config (PID: 6373, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6374, Parent: 6373)

pkill (PID: 6374, Parent: 6373, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6376, Parent: 1)

gdm-wait-for-drm (PID: 6376, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6384, Parent: 1)

gdm3 (PID: 6384, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6389, Parent: 6384)

plymouth (PID: 6389, Parent: 6384, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6405, Parent: 6384)

gdm-session-worker (PID: 6405, Parent: 6384, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6409, Parent: 6405)

gdm-wayland-session (PID: 6409, Parent: 6405, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6411, Parent: 6409)

dbus-daemon (PID: 6411, Parent: 6409, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6413, Parent: 6411)

dbus-daemon New Fork (PID: 6414, Parent: 6413)

false (PID: 6414, Parent: 6413, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6415, Parent: 6409)

dbus-run-session (PID: 6415, Parent: 6409, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6416, Parent: 6415)

dbus-daemon (PID: 6416, Parent: 6415, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6417, Parent: 6384)

Default (PID: 6417, Parent: 6384, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6418, Parent: 6384)

Default (PID: 6418, Parent: 6384, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6390, Parent: 1)

accounts-daemon (PID: 6390, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6400, Parent: 6390)

language-validate (PID: 6400, Parent: 6390, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6401, Parent: 6400)

language-options (PID: 6401, Parent: 6400, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6402, Parent: 6401)

sh (PID: 6402, Parent: 6401, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6403, Parent: 6402)

locale (PID: 6403, Parent: 6402, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6404, Parent: 6402)

grep (PID: 6404, Parent: 6402, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Aqua.arm7.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/gdm3 (PID: 6384)	Socket: unknown address family			Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6411)	Socket: unknown address family			Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: raw.intenseapi.com
Source: global traffic	DNS traffic detected: DNS query: raw.intenseapi.com. [malformed]
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33606
Source: unknown	Network traffic detected: HTTP traffic on port 33606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37608 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37608
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_gre.c
Source: ELF static info symbol of initial sample	Name: attack_gre_eth
Source: ELF static info symbol of initial sample	Name: attack_gre_ip
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_parse
Source: ELF static info symbol of initial sample	Name: attack_start
Source: ELF static info symbol of initial sample	Name: attack_std

Source: Aqua.arm7.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: /tmp/Aqua.arm7.elf (PID: 6232)

SIGKILL sent: pid: 777, result: successful

Jump to behavior

Source: classification engine

Classification label: mal84.troj.evad.linELF@0/19@19/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6272)	File: /proc/6272/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6411)	File: /proc/6411/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6416)	File: /proc/6416/mounts	Jump to behavior

Source: /lib/systemd/systemd-logind (PID: 6283)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6283)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6283)	File: /run/systemd/seats/.#seat0KnbNZj	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6283)	File: /run/systemd/users/.#127rF8d7g	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6283)	File: /run/systemd/users/.#127fcjZqk	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6283)	File: /run/systemd/seats/.#seat0AYQa7i	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6283)	File: /run/systemd/users/.#127LWwbuk	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6283)	File: /run/systemd/users/.#127GOd1jh	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6283)	File: /run/systemd/users/.#1272C5CUi	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6283)	File: /run/systemd/users/.#1275myInj	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6345)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6409)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6390)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6390)	Directory: /root/.cache	Jump to behavior

Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/22/stat	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/22/stat	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/22/stat	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/22/stat	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/66/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/66/stat	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/99/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/33/stat	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/33/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/66666/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/222/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/222/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/222/stat	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/222/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/222/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/222/stat	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/333/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/333/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/333/stat	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/333/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/333/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/333/stat	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/777/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/777/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/777/stat	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/888/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/888/stat	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/999/cmdline	Jump to behavior
Source: /tmp/Aqua.arm7.elf (PID: 6232)	File opened: /proc/999/stat	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/6230/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/6230/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/6232/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/6232/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/6354/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/6354/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/3088/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/230/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/230/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/231/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/231/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/232/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/232/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/233/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/233/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/234/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/234/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/1335/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/1334/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/2302/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/236/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/236/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/237/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/237/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/910/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/910/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/2307/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	File opened: /proc/11/cmdline	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6351)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6355)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6357)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6359)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6363)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6365)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6367)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6370)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6402)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Source: /bin/sh (PID: 6353)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6356)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6358)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6360)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6364)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6366)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6368)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6371)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6404)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6374)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /usr/bin/dash (PID: 6236)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.bxo5t8Ikc9 /tmp/tmp.9tpPbxkSnb /tmp/tmp.ttBVyNMT7N			Jump to behavior
Source: /usr/bin/dash (PID: 6237)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.bxo5t8Ikc9 /tmp/tmp.9tpPbxkSnb /tmp/tmp.ttBVyNMT7N			Jump to behavior

Source: /sbin/agetty (PID: 6354)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6384)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6384)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6390)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6390)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6350)

Log file created: /var/log/gpu-manager.log

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/Aqua.arm7.elf (PID: 6230)

File: /tmp/Aqua.arm7.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6350)

Truncated file: /var/log/gpu-manager.log

Jump to behavior

Source: /usr/bin/pulseaudio (PID: 6273)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pkill (PID: 6374)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /tmp/Aqua.arm7.elf (PID: 6228)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6273)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6350)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6354)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6405)	Queries kernel information via 'uname':	Jump to behavior

Source: Aqua.arm7.elf, 6228.1.00007ffcde359000.00007ffcde37a000.rw-.sdmp	Binary or memory string: s,BV/tmp/qemu-open.1T4Tx7:
Source: Aqua.arm7.elf, 6228.1.00007ffcde359000.00007ffcde37a000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.1T4Tx7
Source: Aqua.arm7.elf, 6228.1.000056422ef13000.000056422f064000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: Aqua.arm7.elf, 6228.1.00007ffcde359000.00007ffcde37a000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: Aqua.arm7.elf, 6228.1.00007ffcde359000.00007ffcde37a000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/Aqua.arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Aqua.arm7.elf
Source: Aqua.arm7.elf, 6228.1.000056422ef13000.000056422f064000.rw-.sdmp	Binary or memory string: .BV!/etc/qemu-binfmt/arm

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6390)

Logged in records file read: /var/log/wtmp

Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match

File source: Aqua.arm7.elf, type: SAMPLE

Remote Access Functionality

Yara detected Mirai

Source: Yara match

File source: Aqua.arm7.elf, type: SAMPLE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File and Directory Permissions Modification	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Hidden Files and Directories	NTDS	2 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Indicator Removal	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 File Deletion	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Aqua.arm7.elf	52%	Virustotal		Browse
Aqua.arm7.elf	50%	ReversingLabs	Linux.Backdoor.Mirai
Aqua.arm7.elf	100%	Avira	EXP/ELF.Mirai.W

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
raw.intenseapi.com	193.200.78.37	true	false	high
daisy.ubuntu.com	162.213.35.25	true	false	high
raw.intenseapi.com. [malformed]	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
54.171.230.55	unknown	United States	16509	AMAZON-02US	false
162.213.35.24	unknown	United States	41231	CANONICAL-ASGB	false
193.200.78.37	raw.intenseapi.com	Switzerland	29496	LINK-SERVICE-ASUA	false
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
54.171.230.55	arm6.elf	Get hash	malicious	Gafgyt	Browse
	wlw68k.elf	Get hash	malicious	Mirai	Browse
	nshkarm5.elf	Get hash	malicious	Unknown	Browse
	arm6.elf	Get hash	malicious	Gafgyt	Browse
	yakuza.arm4.elf	Get hash	malicious	Mirai	Browse
	45.200.149.186-boatnet.arm6-2024-12-28T01_23_00.elf	Get hash	malicious	Mirai	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
	byte.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	sh4.nn.elf	Get hash	malicious	Okiru	Browse
162.213.35.24	Aqua.spc.elf	Get hash	malicious	Unknown	Browse
	ngwa5.elf	Get hash	malicious	Mirai	Browse
	fnkea7.elf	Get hash	malicious	Mirai	Browse
	fnkea7.elf	Get hash	malicious	Mirai	Browse
	wkb86.elf	Get hash	malicious	Mirai	Browse
	fnkea7.elf	Get hash	malicious	Mirai	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	llklllklld.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse
193.200.78.37	Aqua.spc.elf	Get hash	malicious	Unknown	Browse
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm4.elf	Get hash	malicious	Unknown	Browse
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse
	Aqua.m68k.elf	Get hash	malicious	Unknown	Browse
	Aqua.m68k.elf	Get hash	malicious	Unknown	Browse
	Aqua.sh4.elf	Get hash	malicious	Unknown	Browse
	Aqua.spc.elf	Get hash	malicious	Unknown	Browse
	Aqua.x86_64.elf	Get hash	malicious	Unknown	Browse
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse
89.190.156.145	Aqua.spc.elf	Get hash	malicious	Unknown	Browse
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse
	Aqua.m68k.elf	Get hash	malicious	Unknown	Browse
	Aqua.sh4.elf	Get hash	malicious	Unknown	Browse
	kqibeps.elf	Get hash	malicious	Mirai	Browse
	ngwa5.elf	Get hash	malicious	Mirai	Browse
	fnkea7.elf	Get hash	malicious	Mirai	Browse
	fnkea7.elf	Get hash	malicious	Mirai	Browse
	kqibeps.elf	Get hash	malicious	Mirai	Browse
	wkb86.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.intenseapi.com	Aqua.spc.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
	Aqua.spc.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
	Aqua.x86_64.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
daisy.ubuntu.com	Aqua.spc.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	45.200.149.186-boatnet.mpsl-2024-12-28T01_23_00.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	45.200.149.186-boatnet.arm7-2024-12-28T01_23_01.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	45.200.149.186-boatnet.x86-2024-12-28T01_22_59.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	109.71.252.43-boatnet.sh4-2024-12-28T20_30_38.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	db0fa4b8db0333367e9bda3ab68b8042.arc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	kqibeps.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	ngwa5.elf	Get hash	malicious	Mirai	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	Aqua.spc.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.m68k.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.sh4.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	kqibeps.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	ngwa5.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	fnkea7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	fnkea7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	kqibeps.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wkb86.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
AMAZON-02US	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer, Xmrig	Browse	13.226.4.166
	https://kn0wbe4.compromisedblog.com/XZHJISTcycW1tZkROWG92Y2ZEc21laS80dzNTR2N0eEsvTDFRWGFNODdGaGtjNGo5VzRyMFRUQmFLM0grcGxUbnBSTVFhMEg2Smd3UkovaXVjaUpIcG1hZG5CQnh5aFlZTXNqNldTdm84cE5CMUtld0dCZzN4ZUFRK2lvL1FWTG92NUJsMnJ3OHFGckdTNFhnMkFUTFZFZTdKRnVJaTRuRGFKdXVyeUdCVytuQzdnMEV1ZExSMnlwWi9RPT0tLTdnZjhxQVZPbUdTdFZXVUEtLXA0bHNCNGxmeTdrdmlkWWRVcmRXRWc9PQ==?cid=2310423310	Get hash	malicious	KnowBe4	Browse	3.160.188.119
	oiA5KmV0f0.exe	Get hash	malicious	Njrat	Browse	18.197.239.5
	db0fa4b8db0333367e9bda3ab68b8042.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	35.75.100.61
	arm6.elf	Get hash	malicious	Gafgyt	Browse	54.171.230.55
	wlw68k.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	nshkarm5.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	https://app.slintel-privacy.com/links/J95tSop4o/SS6JytVVw/qm84IUL58/GFC-9kqk1-	Get hash	malicious	Unknown	Browse	3.109.113.207
	http://prowebideas.com/dsfdgfhgdfsdfdgfhgdrwet/gdfsdfdgfhgfgdfsdfdgfh/gfsdfdgfhgfgdfsdfdgfhgdfsdfdgfh	Get hash	malicious	Unknown	Browse	44.237.4.100
	arm6.elf	Get hash	malicious	Gafgyt	Browse	54.171.230.55
CANONICAL-ASGB	Aqua.spc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm6.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	m68k.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	45.200.149.186-boatnet.arm5-2024-12-28T01_23_00.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.m68k.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	db0fa4b8db0333367e9bda3ab68b8042.mpsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.sh4.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
LINK-SERVICE-ASUA	Aqua.spc.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
	Aqua.arm4.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
	Aqua.m68k.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
	Aqua.m68k.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
	Aqua.sh4.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
	Aqua.spc.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
	Aqua.x86_64.elf	Get hash	malicious	Unknown	Browse	193.200.78.37
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	193.200.78.37

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/6414/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:WJ:WJ
MD5:	60801E8A2E97A22279148BA12A52FCAB
SHA1:	FBFA6ABE050B10EA2E79857674C229338D60B943
SHA-256:	83E54A21ACA9D9FEB0B1CFB67D68C216B707B8FB7A3395E568C574C83E0B4E7C
SHA-512:	2CB5ED285550CBC4EC8E9FB811158DF1D19A9DD9CF3AFF25441625C5DB278475E91741CFA41AC8FA7D91A7BFD4A07EF3F1500AF545C4CFEB44BEAD7B47100D99
Malicious:	false
Reputation:	low
Preview:	6384.

/run/systemd/seats/.#seat0AYQa7i

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0KnbNZj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/users/.#1272C5CUi

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.4884082548308575
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6Nsgk2t6p:qgFq30dABibBEsgLIp
MD5:	A493850FA9BBE308FE1B58D740F9BCCE
SHA1:	8613BABED7B73C4559EABADBAB72132E01A03A69
SHA-256:	0FE3B46682229051CA57EB955000C7373B96C207DB59042A048E8738B9470BDB
SHA-512:	09C5BC9C762E8FF0EFA72289C0FEBC8062C120D622E7F1351879B9B983DCEC311CF1701D9B3FB3E8C1A7418B4514558DABBBB78DC069769CA816FC83E0B84D3B
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12281.REALTIME=1735430891125073.MONOTONIC=436936689.LAST_SESSION_TIMESTAMP=437000171.

/run/systemd/users/.#1275myInj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.4884082548308575
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6Nsgk2t6p:qgFq30dABibBEsgLIp
MD5:	A493850FA9BBE308FE1B58D740F9BCCE
SHA1:	8613BABED7B73C4559EABADBAB72132E01A03A69
SHA-256:	0FE3B46682229051CA57EB955000C7373B96C207DB59042A048E8738B9470BDB
SHA-512:	09C5BC9C762E8FF0EFA72289C0FEBC8062C120D622E7F1351879B9B983DCEC311CF1701D9B3FB3E8C1A7418B4514558DABBBB78DC069769CA816FC83E0B84D3B
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12281.REALTIME=1735430891125073.MONOTONIC=436936689.LAST_SESSION_TIMESTAMP=437000171.

/run/systemd/users/.#127GOd1jh

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.335434825300166
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgAxF3syO206qodmYn:SbFuFyL3BVgdL87iesnAiRJgk2t6p
MD5:	D687488A242E68E0F18E33E20FE9AD36
SHA1:	6E6ABD4CAE798F022DD2EA7D7EE4C77365CE6B52
SHA-256:	AC6926012DE78C4DBD149B374A36F770A4A59B72A2D691FCA1E8880584F1A1C7
SHA-512:	B0E72A44FD6880F80BD741DACEA1A38F4A7CF8D14CB4CDE9C773D1C3DA41740A2CF638EA5C4582046937B59C1CB94336702370910F2A8D3C6C452287C70C3320
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1735430891125073.MONOTONIC=436936689.LAST_SESSION_TIMESTAMP=437000171.

/run/systemd/users/.#127LWwbuk

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.313231029058102
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6Rgkt2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBOgrthQHtPYq9M
MD5:	CDFE0C53F1828194A7B527CB13AD936F
SHA1:	B147167FB6A0B36CCC677100E9D88B6EDB5550EE
SHA-256:	C89E683C4655F502A4D0C40EF797A5A054066EB5ABD9A4DE2BB494498DE5C41D
SHA-512:	8CC9928E8FB3148F9486E7399324C0BE815329EF3839BABF705EFB85576D8318917BFAE6F91F94EE00E7D4EBD98706FE96BD09C023ACFCB005882D4EFD5E6CAA
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12219.REALTIME=1735430891125073.MONOTONIC=436936689.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127fcjZqk

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.313231029058102
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6Rgkt2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBOgrthQHtPYq9M
MD5:	CDFE0C53F1828194A7B527CB13AD936F
SHA1:	B147167FB6A0B36CCC677100E9D88B6EDB5550EE
SHA-256:	C89E683C4655F502A4D0C40EF797A5A054066EB5ABD9A4DE2BB494498DE5C41D
SHA-512:	8CC9928E8FB3148F9486E7399324C0BE815329EF3839BABF705EFB85576D8318917BFAE6F91F94EE00E7D4EBD98706FE96BD09C023ACFCB005882D4EFD5E6CAA
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12219.REALTIME=1735430891125073.MONOTONIC=436936689.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127rF8d7g

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:p:p
MD5:	707AEE9521AAC4DD302B40FDB1158632
SHA1:	2898A663A7409774F934BA566C29DBB5C98C5BAD
SHA-256:	4A48124CB346C70F731431845AD5470560A5B38AAFD54B235865F35FC1B250C1
SHA-512:	C854E4FB980C157C123CB7057E6ED73BE6578429F04FE338F06D66188190E0F90F3E7905EB46C2C32ACCBDDECB14021C100EFD9DC5C368CE2B926DD70214111F
Malicious:	false
Preview:	6273.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6722951801018083
Encrypted:	false
SSDEEP:	3:RlSsXlXEWtl/d/8v:T+ylF
MD5:	487FF37CD389FA07FECD8688327C767E
SHA1:	D35C5DE7012F2ACA4E17479DE303021943A45222
SHA-256:	D16D15FE051D6F1D4158C857FA760AD2905F42CC091EF61A66A97ADB577D1A7C
SHA-512:	2F49EADD7FA0DFCC64BDFF29EA7C1EEE26CBF170BCA71ED43E795B66100844C1E72108984E4971C464E9D242D5213DBF524E3687DF594AC429D10207999E4D08
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN....................................................................................................................................................................................................................................................................................................pg.{......................................

/tmp/qemu-open.1T4Tx7 (deleted)

Download File

Process:	/tmp/Aqua.arm7.elf
File Type:	data
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.1162646156680225
Encrypted:	false
SSDEEP:	3:Tg2I8HJN:TggJN
MD5:	AE01A55EDFEBB175718FEF844D567F93
SHA1:	F34721848DD919F7771D6707D211F6D02FB979E6
SHA-256:	485A707A99D19B3B0EA0BED39B9B9738D4B232562E9D3943091AEFE59366330F
SHA-512:	A6B3104E52059F23AC0564428D6870F737CEBE1875C78F4BD3DB6EB3FAD46DF832DBA7D8BF467FA6CB4D995035F0AE1B62D158EEF27AED358597A5795596ACAD
Malicious:	false
Preview:	/tmp/Aqua.arm7.elf.nwlrbbmqbh

/var/lib/AccountsService/users/gdm.NM6YZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6722951801018083
Encrypted:	false
SSDEEP:	3:RlSsXlXEWtl/d/8v:T+ylF
MD5:	487FF37CD389FA07FECD8688327C767E
SHA1:	D35C5DE7012F2ACA4E17479DE303021943A45222
SHA-256:	D16D15FE051D6F1D4158C857FA760AD2905F42CC091EF61A66A97ADB577D1A7C
SHA-512:	2F49EADD7FA0DFCC64BDFF29EA7C1EEE26CBF170BCA71ED43E795B66100844C1E72108984E4971C464E9D242D5213DBF524E3687DF594AC429D10207999E4D08
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN....................................................................................................................................................................................................................................................................................................pg.{......................................

Source: Aqua.arm7.elf	Virustotal: Detection: 52%			Perma Link
Source: Aqua.arm7.elf	ReversingLabs: Detection: 50%

Source: global traffic	TCP traffic: 192.168.2.23:50018 -> 89.190.156.145:7733
Source: global traffic	TCP traffic: 192.168.2.23:40836 -> 193.200.78.37:33966

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.976552594747157
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Aqua.arm7.elf
File size:	157'306 bytes
MD5:	8c9168d0015512b1f0252e7499416b30
SHA1:	9b1e02298ea414bfefbd97c00b7053ed15c33a66
SHA256:	b41e29e745b69f3e8c11d105e7e050fd9e08ff1e22efd97fd4c239a9095d708b
SHA512:	d44c06e12c261d463db1f100ef573bebd14f93efe51064cd5a4e25d77cc676f76d47d3685d10632606d47bf345c9eb53233698e44ceb104a65ab561cf62608a0
SSDEEP:	3072:30MUdehIVNTkaGGiuM1BB6+5rhW+cqTMa/mCGM/9zODF9z+:30MUMhWdkaGGiuM1D6gWdWMa/mrM/9GK
TLSH:	ADF33B46EA818A13C4D2177AF6DF424533239B64D3DB73069928BFB43F8679E0E63605
File Content Preview:	.ELF..............(.........4...,.......4. ...(........p.n...........................................p...p...............p...p...p......L3...............p...p...p..................Q.td..................................-...L..................@-.,@...0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	122412
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x15818	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1d908	0x15908	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1d918	0x15918	0x15c8	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x1eee0	0x16ee0	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x1eef8	0x16ef8	0x118	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x27010	0x17010	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x27014	0x17014	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x27014	0x17014	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x27018	0x17018	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2701c	0x1701c	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x27020	0x17020	0xa8	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x270c8	0x170c8	0x2cc	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x27394	0x17394	0x2fc8	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x17394	0xc64	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x17ff8	0x160	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x18158	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1836b	0x210b	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1a476	0x6f6	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1ab6c	0xf28	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1ba94	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x1bd4c	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x1c616	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x1d7a5	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x1dcfd	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1dd13	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1e2b4	0x57c0	0x10	0x0		28	811	4
.strtab	STRTAB	0x0	0x23a74	0x2c06	0x0	0x0		0	0	1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x16ef8	0x1eef8	0x1eef8	0x118	0x118	4.4890	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x17010	0x17010	6.0964	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x17010	0x27010	0x27010	0x384	0x334c	4.5690	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x17014	0x27014	0x27014	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 29, 2024 01:07:49.405934095 CET	443	33606	54.171.230.55	192.168.2.23
Dec 29, 2024 01:07:49.406069040 CET	33606	443	192.168.2.23	54.171.230.55
Dec 29, 2024 01:07:49.525542021 CET	443	33606	54.171.230.55	192.168.2.23
Dec 29, 2024 01:07:49.893954039 CET	50018	7733	192.168.2.23	89.190.156.145
Dec 29, 2024 01:07:50.013542891 CET	7733	50018	89.190.156.145	192.168.2.23
Dec 29, 2024 01:07:50.013669968 CET	50018	7733	192.168.2.23	89.190.156.145
Dec 29, 2024 01:07:50.024621010 CET	50018	7733	192.168.2.23	89.190.156.145
Dec 29, 2024 01:07:50.144104004 CET	7733	50018	89.190.156.145	192.168.2.23
Dec 29, 2024 01:07:50.217824936 CET	40836	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 01:07:50.337349892 CET	33966	40836	193.200.78.37	192.168.2.23
Dec 29, 2024 01:07:50.337414980 CET	40836	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 01:07:50.347335100 CET	40836	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 01:07:50.466824055 CET	33966	40836	193.200.78.37	192.168.2.23
Dec 29, 2024 01:07:50.466876030 CET	40836	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 01:07:50.586376905 CET	33966	40836	193.200.78.37	192.168.2.23
Dec 29, 2024 01:07:51.677582979 CET	33966	40836	193.200.78.37	192.168.2.23
Dec 29, 2024 01:07:51.677733898 CET	40836	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 01:07:51.677854061 CET	40836	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 01:07:52.119024038 CET	43928	443	192.168.2.23	91.189.91.42
Dec 29, 2024 01:07:52.961489916 CET	40838	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 01:07:53.081139088 CET	33966	40838	193.200.78.37	192.168.2.23
Dec 29, 2024 01:07:53.081203938 CET	40838	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 01:07:53.083065033 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:53.083174944 CET	443	37608	162.213.35.24	192.168.2.23
Dec 29, 2024 01:07:53.083245993 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:53.086390018 CET	40838	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 01:07:53.205935955 CET	33966	40838	193.200.78.37	192.168.2.23
Dec 29, 2024 01:07:53.205988884 CET	40838	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 01:07:53.325470924 CET	33966	40838	193.200.78.37	192.168.2.23
Dec 29, 2024 01:07:54.370776892 CET	33966	40838	193.200.78.37	192.168.2.23
Dec 29, 2024 01:07:54.370855093 CET	40838	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 01:07:54.370855093 CET	40838	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 01:07:55.643546104 CET	40842	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 01:07:55.763153076 CET	33966	40842	193.200.78.37	192.168.2.23
Dec 29, 2024 01:07:55.763202906 CET	40842	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 01:07:55.767559052 CET	40842	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 01:07:55.887032986 CET	33966	40842	193.200.78.37	192.168.2.23
Dec 29, 2024 01:07:55.887087107 CET	40842	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 01:07:56.007865906 CET	33966	40842	193.200.78.37	192.168.2.23
Dec 29, 2024 01:07:56.250776052 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:56.250803947 CET	443	37608	162.213.35.24	192.168.2.23
Dec 29, 2024 01:07:57.535130978 CET	443	37608	162.213.35.24	192.168.2.23
Dec 29, 2024 01:07:57.535348892 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:57.535445929 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:57.535459995 CET	443	37608	162.213.35.24	192.168.2.23
Dec 29, 2024 01:07:57.536155939 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:57.536155939 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:57.536170959 CET	443	37608	162.213.35.24	192.168.2.23
Dec 29, 2024 01:07:57.536185980 CET	443	37608	162.213.35.24	192.168.2.23
Dec 29, 2024 01:07:57.536230087 CET	443	37608	162.213.35.24	192.168.2.23
Dec 29, 2024 01:07:57.536274910 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:57.536283016 CET	443	37608	162.213.35.24	192.168.2.23
Dec 29, 2024 01:07:57.536331892 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:57.750238895 CET	42836	443	192.168.2.23	91.189.91.43
Dec 29, 2024 01:07:58.097475052 CET	443	37608	162.213.35.24	192.168.2.23
Dec 29, 2024 01:07:58.097616911 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:58.097616911 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:58.097616911 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:58.097687960 CET	443	37608	162.213.35.24	192.168.2.23
Dec 29, 2024 01:07:58.097762108 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:58.097774982 CET	443	37608	162.213.35.24	192.168.2.23
Dec 29, 2024 01:07:58.097801924 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:58.097835064 CET	443	37608	162.213.35.24	192.168.2.23
Dec 29, 2024 01:07:58.097906113 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:58.097906113 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:58.097929001 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:58.097929001 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:58.097944021 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:58.097975969 CET	443	37608	162.213.35.24	192.168.2.23
Dec 29, 2024 01:07:58.098059893 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:58.098236084 CET	443	37608	162.213.35.24	192.168.2.23
Dec 29, 2024 01:07:58.098304033 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:58.098304033 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:58.098347902 CET	443	37608	162.213.35.24	192.168.2.23
Dec 29, 2024 01:07:58.098393917 CET	443	37608	162.213.35.24	192.168.2.23
Dec 29, 2024 01:07:58.098412991 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:58.098428965 CET	443	37608	162.213.35.24	192.168.2.23
Dec 29, 2024 01:07:58.098460913 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:58.098460913 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:58.098474979 CET	443	37608	162.213.35.24	192.168.2.23
Dec 29, 2024 01:07:59.095457077 CET	443	37608	162.213.35.24	192.168.2.23
Dec 29, 2024 01:07:59.095529079 CET	443	37608	162.213.35.24	192.168.2.23
Dec 29, 2024 01:07:59.095557928 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:59.095602989 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:59.095627069 CET	443	37608	162.213.35.24	192.168.2.23
Dec 29, 2024 01:07:59.096743107 CET	37608	443	192.168.2.23	162.213.35.24
Dec 29, 2024 01:07:59.290029049 CET	42516	80	192.168.2.23	109.202.202.202
Dec 29, 2024 01:08:11.912619114 CET	7733	50018	89.190.156.145	192.168.2.23
Dec 29, 2024 01:08:11.916392088 CET	50018	7733	192.168.2.23	89.190.156.145
Dec 29, 2024 01:08:12.084357023 CET	43928	443	192.168.2.23	91.189.91.42
Dec 29, 2024 01:08:24.370620966 CET	42836	443	192.168.2.23	91.189.91.43
Dec 29, 2024 01:08:30.513928890 CET	42516	80	192.168.2.23	109.202.202.202
Dec 29, 2024 01:08:53.038680077 CET	43928	443	192.168.2.23	91.189.91.42
Dec 29, 2024 01:09:05.823481083 CET	40842	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 01:09:05.943259954 CET	33966	40842	193.200.78.37	192.168.2.23
Dec 29, 2024 01:09:06.235346079 CET	33966	40842	193.200.78.37	192.168.2.23
Dec 29, 2024 01:09:06.235460043 CET	40842	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 01:09:16.238853931 CET	40842	33966	192.168.2.23	193.200.78.37
Dec 29, 2024 01:09:16.358607054 CET	33966	40842	193.200.78.37	192.168.2.23
Dec 29, 2024 01:09:16.682981968 CET	33966	40842	193.200.78.37	192.168.2.23
Dec 29, 2024 01:09:16.683058023 CET	40842	33966	192.168.2.23	193.200.78.37

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 29, 2024 01:07:49.215056896 CET	45034	53	192.168.2.23	8.8.8.8
Dec 29, 2024 01:07:49.578291893 CET	53	45034	8.8.8.8	192.168.2.23
Dec 29, 2024 01:07:49.579586983 CET	38157	53	192.168.2.23	8.8.8.8
Dec 29, 2024 01:07:49.701854944 CET	53	38157	8.8.8.8	192.168.2.23
Dec 29, 2024 01:07:49.703428984 CET	40668	53	192.168.2.23	8.8.8.8
Dec 29, 2024 01:07:49.825797081 CET	53	40668	8.8.8.8	192.168.2.23
Dec 29, 2024 01:07:49.827219963 CET	46206	53	192.168.2.23	8.8.8.8
Dec 29, 2024 01:07:49.949445963 CET	53	46206	8.8.8.8	192.168.2.23
Dec 29, 2024 01:07:49.955379963 CET	60177	53	192.168.2.23	8.8.8.8
Dec 29, 2024 01:07:50.077785969 CET	53	60177	8.8.8.8	192.168.2.23
Dec 29, 2024 01:07:50.090725899 CET	59208	53	192.168.2.23	8.8.8.8
Dec 29, 2024 01:07:50.213032961 CET	53	59208	8.8.8.8	192.168.2.23
Dec 29, 2024 01:07:51.693022013 CET	58051	53	192.168.2.23	8.8.8.8
Dec 29, 2024 01:07:51.815337896 CET	53	58051	8.8.8.8	192.168.2.23
Dec 29, 2024 01:07:51.819571018 CET	58321	53	192.168.2.23	8.8.8.8
Dec 29, 2024 01:07:51.941941977 CET	53	58321	8.8.8.8	192.168.2.23
Dec 29, 2024 01:07:51.946345091 CET	49375	53	192.168.2.23	8.8.8.8
Dec 29, 2024 01:07:52.068646908 CET	53	49375	8.8.8.8	192.168.2.23
Dec 29, 2024 01:07:52.073342085 CET	48146	53	192.168.2.23	8.8.8.8
Dec 29, 2024 01:07:52.195714951 CET	53	48146	8.8.8.8	192.168.2.23
Dec 29, 2024 01:07:52.200133085 CET	55871	53	192.168.2.23	8.8.8.8
Dec 29, 2024 01:07:52.295874119 CET	46370	53	192.168.2.23	1.1.1.1
Dec 29, 2024 01:07:52.295914888 CET	33294	53	192.168.2.23	1.1.1.1
Dec 29, 2024 01:07:52.322434902 CET	53	55871	8.8.8.8	192.168.2.23
Dec 29, 2024 01:07:52.326159954 CET	59285	53	192.168.2.23	8.8.8.8
Dec 29, 2024 01:07:52.433358908 CET	53	46370	1.1.1.1	192.168.2.23
Dec 29, 2024 01:07:52.448546886 CET	53	59285	8.8.8.8	192.168.2.23
Dec 29, 2024 01:07:52.451585054 CET	44643	53	192.168.2.23	8.8.8.8
Dec 29, 2024 01:07:52.520998001 CET	53	33294	1.1.1.1	192.168.2.23
Dec 29, 2024 01:07:52.573812962 CET	53	44643	8.8.8.8	192.168.2.23
Dec 29, 2024 01:07:52.579648972 CET	53156	53	192.168.2.23	8.8.8.8
Dec 29, 2024 01:07:52.701790094 CET	53	53156	8.8.8.8	192.168.2.23
Dec 29, 2024 01:07:52.708096981 CET	39480	53	192.168.2.23	8.8.8.8
Dec 29, 2024 01:07:52.830319881 CET	53	39480	8.8.8.8	192.168.2.23
Dec 29, 2024 01:07:52.837032080 CET	43370	53	192.168.2.23	8.8.8.8
Dec 29, 2024 01:07:52.927545071 CET	36248	53	192.168.2.23	1.1.1.1
Dec 29, 2024 01:07:52.959398031 CET	53	43370	8.8.8.8	192.168.2.23
Dec 29, 2024 01:07:53.065351009 CET	53	36248	1.1.1.1	192.168.2.23
Dec 29, 2024 01:07:54.376730919 CET	40413	53	192.168.2.23	8.8.8.8
Dec 29, 2024 01:07:54.499164104 CET	53	40413	8.8.8.8	192.168.2.23
Dec 29, 2024 01:07:54.504101992 CET	59999	53	192.168.2.23	8.8.8.8
Dec 29, 2024 01:07:54.626307011 CET	53	59999	8.8.8.8	192.168.2.23
Dec 29, 2024 01:07:54.633080959 CET	54202	53	192.168.2.23	8.8.8.8
Dec 29, 2024 01:07:54.756174088 CET	53	54202	8.8.8.8	192.168.2.23
Dec 29, 2024 01:07:54.760234118 CET	32779	53	192.168.2.23	8.8.8.8
Dec 29, 2024 01:07:54.882498980 CET	53	32779	8.8.8.8	192.168.2.23
Dec 29, 2024 01:07:54.886176109 CET	55210	53	192.168.2.23	8.8.8.8
Dec 29, 2024 01:07:55.008464098 CET	53	55210	8.8.8.8	192.168.2.23
Dec 29, 2024 01:07:55.013492107 CET	37736	53	192.168.2.23	8.8.8.8
Dec 29, 2024 01:07:55.135921001 CET	53	37736	8.8.8.8	192.168.2.23
Dec 29, 2024 01:07:55.140870094 CET	40345	53	192.168.2.23	8.8.8.8
Dec 29, 2024 01:07:55.263149023 CET	53	40345	8.8.8.8	192.168.2.23
Dec 29, 2024 01:07:55.267874956 CET	34169	53	192.168.2.23	8.8.8.8
Dec 29, 2024 01:07:55.390021086 CET	53	34169	8.8.8.8	192.168.2.23
Dec 29, 2024 01:07:55.392266989 CET	52205	53	192.168.2.23	8.8.8.8
Dec 29, 2024 01:07:55.515281916 CET	53	52205	8.8.8.8	192.168.2.23
Dec 29, 2024 01:07:55.518999100 CET	53127	53	192.168.2.23	8.8.8.8
Dec 29, 2024 01:07:55.641314030 CET	53	53127	8.8.8.8	192.168.2.23

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 29, 2024 01:07:59.839006901 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Dec 29, 2024 01:09:19.850162029 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-12-29 00:07:57 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2024-12-29 00:07:58 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-29 00:07:58 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2024-12-29 00:07:58 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2024-12-29 00:07:58 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2024-12-29 00:07:58 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2024-12-29 00:07:58 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2024-12-29 00:07:58 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2024-12-29 00:07:58 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2024-12-29 00:07:58 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2024-12-29 00:07:58 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2024-12-29 00:07:58 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2024-12-29 00:07:59 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Sun, 29 Dec 2024 00:07:58 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	00:07:48
Start date (UTC):	29/12/2024
Path:	/tmp/Aqua.arm7.elf
Arguments:	/tmp/Aqua.arm7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	00:07:49
Start date (UTC):	29/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	00:07:51
Start date (UTC):	29/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	00:07:52
Start date (UTC):	29/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	00:07:53
Start date (UTC):	29/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	00:07:54
Start date (UTC):	29/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	00:07:55
Start date (UTC):	29/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	00:07:57
Start date (UTC):	29/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	00:07:56
Start date (UTC):	29/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	00:07:58
Start date (UTC):	29/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Aqua.arm7.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6414/oom_score_adj

/run/gdm3.pid

/run/systemd/seats/.#seat0AYQa7i

/run/systemd/seats/.#seat0KnbNZj

/run/systemd/users/.#1272C5CUi

/run/systemd/users/.#1275myInj

/run/systemd/users/.#127GOd1jh

/run/systemd/users/.#127LWwbuk

/run/systemd/users/.#127fcjZqk

/run/systemd/users/.#127rF8d7g

/run/user/1000/pulse/pid

/run/utmp

/tmp/qemu-open.1T4Tx7 (deleted)

/var/lib/AccountsService/users/gdm.NM6YZ2

/var/lib/ubuntu-drivers-common/last_gfx_boot

/var/log/gpu-manager.log

/var/log/wtmp

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Linux Analysis Report
Aqua.arm7.elf

Start time (UTC):	00:08:09
Start date (UTC):	29/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	00:08:10
Start date (UTC):	29/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	00:08:11
Start date (UTC):	29/12/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	00:08:12
Start date (UTC):	29/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre