Edit tour

Linux Analysis Report
Aqua.i686.elf

Overview

General Information

Sample name:	Aqua.i686.elf
Analysis ID:	1582791
MD5:	a44f59525e746cd6323e3adcfbba2bf6
SHA1:	daaa5ffa4492890f89343f02f86b4a54f9620dd5
SHA256:	493d8e62473aa1253db8c265ff5577f65f4e58d8a63759c15154d3b937d02f14
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Found strings indicative of a multi-platform dropper

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582791
Start date and time:	2024-12-31 14:02:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Aqua.i686.elf
Detection:	MAL
Classification:	mal76.spre.troj.evad.linELF@0/27@1051/0

Warnings

Connection to analysis system has been lost, crash info: Unknown

Runtime Messages

Command:	/tmp/Aqua.i686.elf
PID:	6239
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

Aqua.i686.elf (PID: 6239, Parent: 6161, MD5: a44f59525e746cd6323e3adcfbba2bf6) Arguments: /tmp/Aqua.i686.elf

Aqua.i686.elf New Fork (PID: 6240, Parent: 6239)

Aqua.i686.elf New Fork (PID: 6241, Parent: 6240)

gnome-session-binary New Fork (PID: 6242, Parent: 1477)

sh (PID: 6242, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6242, Parent: 1477, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 6247, Parent: 1)

systemd-hostnamed (PID: 6247, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

gdm3 New Fork (PID: 6291, Parent: 1320)

Default (PID: 6291, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6396, Parent: 1320)

Default (PID: 6396, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6404, Parent: 1320)

Default (PID: 6404, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gvfsd-fuse New Fork (PID: 6412, Parent: 2038)

fusermount (PID: 6412, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6413, Parent: 1)

rsyslogd (PID: 6413, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6419, Parent: 1)

dbus-daemon (PID: 6419, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6431, Parent: 1)

systemd-logind (PID: 6431, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6492, Parent: 1)

gpu-manager (PID: 6492, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6493, Parent: 6492)

sh (PID: 6493, Parent: 6492, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6494, Parent: 6493)

grep (PID: 6494, Parent: 6493, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6496, Parent: 6492)

sh (PID: 6496, Parent: 6492, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6497, Parent: 6496)

grep (PID: 6497, Parent: 6496, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6498, Parent: 1)

generate-config (PID: 6498, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6501, Parent: 6498)

pkill (PID: 6501, Parent: 6498, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6500, Parent: 1)

rsyslogd (PID: 6500, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6507, Parent: 1)

dbus-daemon (PID: 6507, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6508, Parent: 1)

journalctl (PID: 6508, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6509, Parent: 1)

systemd-journald (PID: 6509, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6512, Parent: 1)

systemd-logind (PID: 6512, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6523, Parent: 1)

agetty (PID: 6523, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6574, Parent: 1)

dbus-daemon (PID: 6574, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6575, Parent: 1)

rsyslogd (PID: 6575, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6577, Parent: 1)

gpu-manager (PID: 6577, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6581, Parent: 6577)

sh (PID: 6581, Parent: 6577, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6582, Parent: 6581)

grep (PID: 6582, Parent: 6581, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6584, Parent: 6577)

sh (PID: 6584, Parent: 6577, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6585, Parent: 6584)

grep (PID: 6585, Parent: 6584, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6586, Parent: 6577)

sh (PID: 6586, Parent: 6577, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6587, Parent: 6586)

grep (PID: 6587, Parent: 6586, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6589, Parent: 6577)

sh (PID: 6589, Parent: 6577, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6590, Parent: 6589)

grep (PID: 6590, Parent: 6589, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6592, Parent: 6577)

sh (PID: 6592, Parent: 6577, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6593, Parent: 6592)

grep (PID: 6593, Parent: 6592, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6595, Parent: 6577)

sh (PID: 6595, Parent: 6577, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6596, Parent: 6595)

systemd New Fork (PID: 6597, Parent: 1)

generate-config (PID: 6597, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6598, Parent: 6597)

pkill (PID: 6598, Parent: 6597, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6599, Parent: 1)

rsyslogd (PID: 6599, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6607, Parent: 1)

dbus-daemon (PID: 6607, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6608, Parent: 1)

gdm-wait-for-drm (PID: 6608, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6613, Parent: 1)

systemd-logind (PID: 6613, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6653, Parent: 1)

rsyslogd (PID: 6653, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6676, Parent: 1)

systemd-journald (PID: 6676, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6680, Parent: 1)

systemd-logind (PID: 6680, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6739, Parent: 1)

rsyslogd (PID: 6739, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6741, Parent: 1)

rsyslogd (PID: 6741, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6743, Parent: 1)

dbus-daemon (PID: 6743, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6744, Parent: 1)

gpu-manager (PID: 6744, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6750, Parent: 6744)

sh (PID: 6750, Parent: 6744, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6751, Parent: 6750)

grep (PID: 6751, Parent: 6750, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

systemd New Fork (PID: 6754, Parent: 1)

dbus-daemon (PID: 6754, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6755, Parent: 1)

generate-config (PID: 6755, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6756, Parent: 6755)

pkill (PID: 6756, Parent: 6755, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6757, Parent: 1)

rsyslogd (PID: 6757, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6759, Parent: 1)

systemd-journald (PID: 6759, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6761, Parent: 1)

dbus-daemon (PID: 6761, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6764, Parent: 1)

systemd-logind (PID: 6764, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6825, Parent: 1)

dbus-daemon (PID: 6825, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6826, Parent: 1)

rsyslogd (PID: 6826, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6827, Parent: 1)

gpu-manager (PID: 6827, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6828, Parent: 6827)

sh (PID: 6828, Parent: 6827, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6829, Parent: 6828)

grep (PID: 6829, Parent: 6828, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6834, Parent: 6827)

sh (PID: 6834, Parent: 6827, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6835, Parent: 6834)

grep (PID: 6835, Parent: 6834, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6836, Parent: 1)

generate-config (PID: 6836, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6837, Parent: 6836)

pkill (PID: 6837, Parent: 6836, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6838, Parent: 1)

systemd-journald (PID: 6838, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6841, Parent: 1)

systemd-logind (PID: 6841, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6902, Parent: 1)

systemd-logind (PID: 6902, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6961, Parent: 1)

gpu-manager (PID: 6961, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

systemd New Fork (PID: 6962, Parent: 1)

generate-config (PID: 6962, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6963, Parent: 6962)

pkill (PID: 6963, Parent: 6962, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6964, Parent: 1)

systemd-journald (PID: 6964, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6969, Parent: 1)

gpu-manager (PID: 6969, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6971, Parent: 6969)

sh (PID: 6971, Parent: 6969, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6972, Parent: 6971)

grep (PID: 6972, Parent: 6971, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

systemd New Fork (PID: 6970, Parent: 1)

systemd-journald (PID: 6970, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6973, Parent: 1)

generate-config (PID: 6973, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6974, Parent: 6973)

pkill (PID: 6974, Parent: 6973, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6975, Parent: 1)

systemd-journald (PID: 6975, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6976, Parent: 1)

gpu-manager (PID: 6976, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6977, Parent: 6976)

sh (PID: 6977, Parent: 6976, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6978, Parent: 6977)

grep (PID: 6978, Parent: 6977, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6979, Parent: 6976)

sh (PID: 6979, Parent: 6976, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6980, Parent: 6979)

grep (PID: 6980, Parent: 6979, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6981, Parent: 6976)

sh (PID: 6981, Parent: 6976, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6982, Parent: 6981)

grep (PID: 6982, Parent: 6981, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

systemd New Fork (PID: 6983, Parent: 1)

generate-config (PID: 6983, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6984, Parent: 6983)

pkill (PID: 6984, Parent: 6983, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6987, Parent: 1)

gpu-manager (PID: 6987, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6988, Parent: 6987)

sh (PID: 6988, Parent: 6987, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6989, Parent: 6988)

grep (PID: 6989, Parent: 6988, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6990, Parent: 6987)

systemd New Fork (PID: 6991, Parent: 1)

plymouth (PID: 6991, Parent: 1, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: /bin/plymouth quit

systemd New Fork (PID: 6992, Parent: 1860)

dbus-daemon (PID: 6992, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6993, Parent: 1860)

pulseaudio (PID: 6993, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6994, Parent: 1)

dbus-daemon (PID: 6994, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6995, Parent: 1)

rtkit-daemon (PID: 6995, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6998, Parent: 1)

polkitd (PID: 6998, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Aqua.i686.elf	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x4d3f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
Aqua.i686.elf	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x4cf2:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
Aqua.i686.elf	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x74fd:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x759d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
Aqua.i686.elf	Linux_Trojan_Mirai_3a85a418	unknown	unknown	0x47b7:$a: 01 D8 66 C1 C8 08 C1 C8 10 66 C1 C8 08 66 83 7C 24 2C FF 89
Aqua.i686.elf	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x522:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
Aqua.i686.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x7a32:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
Aqua.i686.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x99ea:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6239.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x4d3f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
6239.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x4cf2:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
6239.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0x74fd:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0x759d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
6239.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_3a85a418	unknown	unknown	0x47b7:$a: 01 D8 66 C1 C8 08 C1 C8 10 66 C1 C8 08 66 83 7C 24 2C FF 89
6239.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x522:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
6239.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x7a32:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6239.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x99ea:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
Click to see the 2 entries

String: EOF/proc//proc/%s/cmdlinerwgetcurlftpechokillbashrebootshutdownhaltpoweroff/fdsocket/proc/%s/stat/proc/proc/%d/exe/proc/%d/stat%d %s %c %d/proc/%d/maps/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homedbgmpslmipselmipsarmarm4arm5arm6arm7sh4m68kx86x586x86_64i586i686ppcspc[locker] killed process: %s ;; pid: %d

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: raw.cloudboats.vip. [malformed]

Source: global traffic	TCP traffic: 192.168.2.23:34790 -> 193.111.248.108:33966
Source: global traffic	TCP traffic: 192.168.2.23:50018 -> 89.190.156.145:7733

Source: /usr/sbin/rsyslogd (PID: 6413)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6500)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6575)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6599)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6653)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6739)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6741)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6757)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6826)	Reads hosts file: /etc/hosts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6509)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6676)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6759)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6838)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6964)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6970)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6975)	Socket: unknown address family	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: raw.cloudboats.vip
Source: global traffic	DNS traffic detected: DNS query: raw.cloudboats.vip. [malformed]
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: syslog.31.dr, syslog.51.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 53242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53326 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53326
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53242
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: Aqua.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: Aqua.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: Aqua.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: Aqua.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_3a85a418 Author: unknown
Source: Aqua.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: Aqua.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: Aqua.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6239.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 6239.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 6239.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: 6239.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a85a418 Author: unknown
Source: 6239.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 6239.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6239.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6242, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6223, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6224, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6411, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6412, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6413, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6414, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6419, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6492, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6495, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6495, result: no such process	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6056, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6398, result: no such process	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6431, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6498, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6499, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6500, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6502, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6507, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6574, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6575, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6576, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6577, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6523, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6599, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6600, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6607, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6509, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6608, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6609, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6613, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6653, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6673, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6739, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6740, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6677, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6677, result: no such process	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6741, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6742, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6743, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6744, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6676, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6680, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6752, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6754, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6755, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6757, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6758, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6761, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6760, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6760, result: no such process	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6825, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6826, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6827, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6759, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6764, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6833, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6836, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6961, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6838, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6902, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6962, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6964, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6969, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6973, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6970, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6975, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6976, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6983, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6987, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6242, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6223, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6224, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6411, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6412, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6413, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6414, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6419, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6492, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6495, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6495, result: no such process	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6056, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6398, result: no such process	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6431, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6498, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6499, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6500, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6502, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6507, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6574, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6575, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6576, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6577, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6523, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6599, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6600, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6607, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6509, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6608, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6609, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6613, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6653, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6673, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6739, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6740, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6677, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6677, result: no such process	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6741, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6742, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6743, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6744, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6676, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6680, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6752, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6754, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6755, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6757, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6758, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6761, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6760, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6760, result: no such process	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6825, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6826, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6827, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6759, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6764, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6833, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6836, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6961, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6838, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6902, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6962, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6964, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6969, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6973, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6970, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6975, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6976, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6983, result: successful	Jump to behavior
Source: /tmp/Aqua.i686.elf (PID: 6241)	SIGKILL sent: pid: 6987, result: successful	Jump to behavior

Source: Aqua.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: Aqua.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: Aqua.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: Aqua.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_3a85a418 reference_sample = 86a43b39b157f47ab12e9dc1013b4eec0e1792092d4cef2772a21a9bf4fc518a, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 554aff5770bfe8fdeae94f5f5a0fd7f7786340a95633433d8e686af1c25b8cec, id = 3a85a418-2bd9-445a-86cb-657ca7edf566, last_modified = 2021-09-16
Source: Aqua.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: Aqua.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: Aqua.i686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6239.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 6239.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 6239.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: 6239.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_3a85a418 reference_sample = 86a43b39b157f47ab12e9dc1013b4eec0e1792092d4cef2772a21a9bf4fc518a, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 554aff5770bfe8fdeae94f5f5a0fd7f7786340a95633433d8e686af1c25b8cec, id = 3a85a418-2bd9-445a-86cb-657ca7edf566, last_modified = 2021-09-16
Source: 6239.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 6239.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6239.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26

Source: classification engine

Classification label: mal76.spre.troj.evad.linELF@0/27@1051/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6419)	File: /proc/6419/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6507)	File: /proc/6507/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6574)	File: /proc/6574/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6607)	File: /proc/6607/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6743)	File: /proc/6743/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6754)	File: /proc/6754/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6761)	File: /proc/6761/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6825)	File: /proc/6825/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6992)	File: /proc/6992/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6994)	File: /proc/6994/mounts	Jump to behavior

Source: /usr/libexec/gsd-rfkill (PID: 6242)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 6242)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6247)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6431)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6431)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6431)	File: /run/systemd/seats/.#seat0j172Wr	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6512)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6512)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6512)	File: /run/systemd/seats/.#seat0ydHWND	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6680)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6680)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6764)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6764)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6998)	Directory: /root/.cache	Jump to behavior

Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/6597/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/6597/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/6598/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/6598/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/3088/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/230/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/230/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/231/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/231/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/232/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/232/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/233/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/233/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/234/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/234/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/1335/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/1334/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/2302/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/236/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/236/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/237/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/237/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/910/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/910/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/6241/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/6241/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/6240/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/6240/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/13/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/14/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/14/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/15/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/15/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/16/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/16/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/17/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/17/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/18/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/18/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/120/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/120/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/121/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/121/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/1/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/122/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/122/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/243/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/243/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/123/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/123/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/2/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/2/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/124/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/124/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/3/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/3/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/4/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/4/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/125/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/125/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/126/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/126/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/248/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/248/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/6/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/6/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/127/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/127/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/128/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/128/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/249/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	File opened: /proc/249/cmdline	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6493)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6496)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6581)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6584)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6586)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6589)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6592)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6595)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6750)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6828)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6834)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6971)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6977)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6979)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6981)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6988)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior

Source: /bin/sh (PID: 6494)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6497)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6582)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6585)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6587)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6590)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6593)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6751)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6829)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6835)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6972)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6978)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6980)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6982)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6989)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6501)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6598)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6756)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6837)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6963)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6974)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6984)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6509)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6676)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6759)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6838)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6964)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6970)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6975)	Reads from proc file: /proc/meminfo	Jump to behavior

Source: /sbin/agetty (PID: 6523)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6413)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6413)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6500)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6575)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6599)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6741)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6826)	Log file created: /var/log/kern.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/Aqua.i686.elf (PID: 6240)

File: /tmp/Aqua.i686.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6492)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6577)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6744)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6827)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6969)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6976)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6987)	Truncated file: /var/log/gpu-manager.log	Jump to behavior

Source: /usr/bin/pkill (PID: 6501)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6598)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6974)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6984)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6993)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior

Source: /lib/systemd/systemd-hostnamed (PID: 6247)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6413)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6500)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6509)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6523)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6575)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6599)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6653)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6676)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6739)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6741)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6757)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6759)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6826)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6838)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6964)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6970)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6975)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6993)	Queries kernel information via 'uname':	Jump to behavior

Source: kern.log.31.dr	Binary or memory string: Dec 31 07:02:54 galassia kernel: [ 418.581000] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: kern.log.31.dr	Binary or memory string: Dec 31 07:02:54 galassia kernel: [ 418.580982] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 Disable or Modify Tools	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Hidden Files and Directories	LSASS Memory	11 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Indicator Removal	Security Account Manager	3 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Aqua.i686.elf	27%	Virustotal		Browse
Aqua.i686.elf	32%	ReversingLabs	Linux.Backdoor.Mirai
Aqua.i686.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
daisy.ubuntu.com	162.213.35.24	true	false	high
raw.cloudboats.vip	193.111.248.108	true	false	high
raw.cloudboats.vip. [malformed]	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.31.dr, syslog.51.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.213.35.25	unknown	United States	41231	CANONICAL-ASGB	false
193.111.248.108	raw.cloudboats.vip	Russian Federation	8100	ASN-QUADRANET-GLOBALUS	false
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.213.35.25	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse
	Aqua.sh4.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm5.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm5.elf	Get hash	malicious	Unknown	Browse
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse
	kqibeps.elf	Get hash	malicious	Mirai	Browse
	wlw68k.elf	Get hash	malicious	Mirai	Browse
193.111.248.108	Aqua.sh4.elf	Get hash	malicious	Unknown	Browse
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse
	Aqua.m68k.elf	Get hash	malicious	Unknown	Browse
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse
	Aqua.sh4.elf	Get hash	malicious	Unknown	Browse
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm4.elf	Get hash	malicious	Unknown	Browse
89.190.156.145	Aqua.sh4.elf	Get hash	malicious	Unknown	Browse
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse
	Aqua.m68k.elf	Get hash	malicious	Unknown	Browse
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse
	rjnven64.elf	Get hash	malicious	Mirai	Browse
	fnkea7.elf	Get hash	malicious	Mirai	Browse
	wkb86.elf	Get hash	malicious	Mirai	Browse
	njvwa4.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.cloudboats.vip	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	193.111.248.108
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse	193.111.248.108
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse	193.111.248.108
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse	193.111.248.108
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	193.111.248.108
daisy.ubuntu.com	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	Aqua.sh4.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	Aqua.m68k.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	Aqua.sh4.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.m68k.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	rjnven64.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	fnkea7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wkb86.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	njvwa4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
ASN-QUADRANET-GLOBALUS	Aqua.sh4.elf	Get hash	malicious	Unknown	Browse	193.111.248.108
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	193.111.248.108
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse	193.111.248.108
	Aqua.m68k.elf	Get hash	malicious	Unknown	Browse	193.111.248.108
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse	193.111.248.108
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse	193.111.248.108
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse	193.111.248.108
	Aqua.sh4.elf	Get hash	malicious	Unknown	Browse	193.111.248.108
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	193.111.248.108
	Aqua.arm4.elf	Get hash	malicious	Unknown	Browse	193.111.248.108
INIT7CH	Aqua.arm6.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	boatnet.arc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Aqua.sh4.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Aqua.m68k.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
CANONICAL-ASGB	Aqua.arm6.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	boatnet.arc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Aqua.sh4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Aqua.m68k.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/run/systemd/seats/.#seat0j172Wr

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0ydHWND

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:Jo:C
MD5:	8DCCA07475C8CAE9DBE3C24C4C5062D7
SHA1:	69BADEEC1C8051338783F3728E4649E7085D883C
SHA-256:	723BF7F297A51A18305E8178160701F3C2A32678B2555814A43F7A7FE052E1DB
SHA-512:	A6651297E4E2A7934EAE25DA82DFEECB7653C5A2D030C2EDEAD2A65BDCD80BB06E49A6A8768337314E136658E9CAECBA170FB1277FD33760942D2278CFDD20B5
Malicious:	false
Preview:	6993.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6722951801018083
Encrypted:	false
SSDEEP:	3:zlSsXlXEWtl/2Fot:zlv+yl
MD5:	8C8C3E6929D5F967BA0604B0B845173D
SHA1:	7ED7AD36C984A1391808A60C33085C0F6FF8CD09
SHA-256:	AC35E531ECA29493724FB6A80F6CE71BC0C3FFA8824B8554FEFEFCF8DB4437E8
SHA-512:	006CAAD1A4963D451314641C7F402DF5352C408CF8BFDB5A80CAF238884B6EBC9BA16C38E6079E7AA08D1BD5BE8849AD98363C64FA973A62431509ADCC270CD4
Malicious:	false
Preview:	....{...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................{.....sgs.......................................

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	859
Entropy (8bit):	4.91021615960783
Encrypted:	false
SSDEEP:	12:IFcRZPaV5pMkFcRZPgKMkFcvGkFcD0FcDcFc0MEFckAvmFFckA2+VWFc1:1ZeaRZ4BvGDzcHAvMA2+V3
MD5:	B09782D67C6D2C13856FB248AC70E607
SHA1:	6D677FDAD4B55B6244BD5E5967CFE7FE2C0B02D6
SHA-256:	B82EDA94D230A36A155CD2C6C6361ED85CCC780F02D4500E5BE84533A938F428
SHA-512:	2DDB660CDCB1E3C7922AD67FA04CF9678658F7E3B6EE509466F4806342FAF1EEFFD55286CA8D4CAA8ABB9029A52AC478195A3E3950D6CD6BB6687DA6AD4FD1FE
Malicious:	false
Preview:	Dec 31 07:02:56 galassia systemd-logind[6431]: Failed to add user by file name 1000, ignoring: Invalid argument.Dec 31 07:02:56 galassia systemd-logind[6431]: Failed to add user by file name 127, ignoring: Invalid argument.Dec 31 07:02:56 galassia systemd-logind[6431]: User enumeration failed: Invalid argument.Dec 31 07:02:56 galassia systemd-logind[6431]: User of session 2 not known..Dec 31 07:02:56 galassia systemd-logind[6431]: User of session c1 not known..Dec 31 07:02:56 galassia systemd-logind[6431]: Session enumeration failed: No such file or directory.Dec 31 07:02:56 galassia systemd-logind[6431]: Watching system buttons on /dev/input/event0 (Power Button).Dec 31 07:02:56 galassia systemd-logind[6431]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Dec 31 07:02:56 galassia systemd-logind[6431]: New seat seat0..

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31Hl6w4ITpQw4ITpJ//:F3hdr/
MD5:	ABBD0EDC93A6D8F64A18399932C8C95C
SHA1:	A1D65E527F398CD0F639CDC6EF57618F720167C8
SHA-256:	D636D6FB65FB50EFAF13BF19ADBB157DBC938157597522B289AA6746125CAE16
SHA-512:	44A89D22D8A37C7BADF53473582014DCB2CEEF0D79AC4FEFD0D05BA3A90C5FF42B76ECCAF61632780930FA2FC5D7D783C470B0BB466D4525FD80EE583657321E
Malicious:	false
Preview:	LPKSHHRH...................4sWN..........................................4sWN...............................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5768
Entropy (8bit):	4.674382053755233
Encrypted:	false
SSDEEP:	48:XCwdx8Ir9sEhu+sn0MFZp5ig3omg4ZqrcjJvmpg3VocVROF/59pOB27zVzpeyGAt:v/8aaARH3B2NdvQWZq0CTGEv56U
MD5:	F7380925E2CB8E89D6601F47D14C7742
SHA1:	7F59D3B1089A3D4840BD7EDAE6C834A1FB521F92
SHA-256:	BD66FAD8A93298850662718297F7800D9C4F6A7572C7DACD959A2A0641C97AC9
SHA-512:	343CD001332814F4BA423EB8D4AAAA1AE2BC610DD45E2CAA310FF51AEE20463491668950FE0A2FBE02FC143F1A0CB552502109678F70AEB6D0D86BEFFEBC251E
Malicious:	false
Preview:	Dec 31 07:03:11 galassia kernel: [ 435.954758] blocking signal 9: 6241 -> 658.Dec 31 07:03:11 galassia kernel: [ 435.969664] blocking signal 9: 6241 -> 720.Dec 31 07:03:11 galassia kernel: [ 435.984407] blocking signal 9: 6241 -> 772.Dec 31 07:03:11 galassia kernel: [ 436.002704] blocking signal 9: 6241 -> 936.Dec 31 07:03:11 galassia kernel: [ 436.017469] blocking signal 9: 6241 -> 1335.Dec 31 07:03:11 galassia kernel: [ 436.031938] blocking signal 9: 6241 -> 1335.Dec 31 07:03:11 galassia kernel: [ 436.046709] blocking signal 9: 6241 -> 1335.Dec 31 07:03:11 galassia kernel: [ 436.062700] blocking signal 9: 6241 -> 1335.Dec 31 07:03:11 galassia kernel: [ 436.077642] blocking signal 9: 6241 -> 1335.Dec 31 07:03:11 galassia kernel: [ 436.092672] blocking signal 9: 6241 -> 1335.Dec 31 07:03:11 galassia kernel: [ 436.106715] blocking signal 9: 6241 -> 1335.Dec 31 07:03:11 galassia kernel: [ 436.121421] blocking signal 9: 6241 -> 1335.Dec 31 07:03:11 galassia kernel: [ 436.1364

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	9220
Entropy (8bit):	4.908904270619884
Encrypted:	false
SSDEEP:	96:v/8XPIRWQCaw+UWARv3B2NdvQWZq0CTGEv56dEPcxXJntD5Mu9:H8z+Z+y
MD5:	D7B257D099173E7D89F92D560934C906
SHA1:	B6CA6863A70C62703AF32C7797407254BC1B0F7B
SHA-256:	3726C8AE77BC77A24ADBA396EE5320A6B6DD2C0ADE4DADDC4D524D038C71DC73
SHA-512:	DA60FE2F695CF5E1016C031308655AEAC02536F56079C1CBC4666130C5F549E27B1E023C578F09EB94A06EFAF28CCBCBF91E346464B0317BD82A002D8CE585DD
Malicious:	false
Preview:	Dec 31 07:03:11 galassia kernel: [ 435.848497] systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Dec 31 07:03:11 galassia kernel: [ 435.848573] systemd[1]: rsyslog.service: Failed with result 'signal'..Dec 31 07:03:11 galassia kernel: [ 435.865543] systemd[1]: whoopsie.service: Main process exited, code=killed, status=9/KILL.Dec 31 07:03:11 galassia kernel: [ 435.865610] systemd[1]: whoopsie.service: Failed with result 'signal'..Dec 31 07:03:11 galassia kernel: [ 435.880593] systemd[1]: dbus.service: Main process exited, code=killed, status=9/KILL.Dec 31 07:03:11 galassia kernel: [ 435.880596] systemd[1]: dbus.service: Failed with result 'signal'..Dec 31 07:03:11 galassia kernel: [ 435.882747] systemd[1]: Started D-Bus System Message Bus..Dec 31 07:03:11 galassia kernel: [ 435.954758] blocking signal 9: 6241 -> 658.Dec 31 07:03:11 galassia kernel: [ 435.969664] blocking signal 9: 6241 -> 720.Dec 31 07:03:11 galassia kernel: [ 435.984407] blocking si

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6722951801018083
Encrypted:	false
SSDEEP:	3:zlSsXlXEWtl/2Fot:zlv+yl
MD5:	8C8C3E6929D5F967BA0604B0B845173D
SHA1:	7ED7AD36C984A1391808A60C33085C0F6FF8CD09
SHA-256:	AC35E531ECA29493724FB6A80F6CE71BC0C3FFA8824B8554FEFEFCF8DB4437E8
SHA-512:	006CAAD1A4963D451314641C7F402DF5352C408CF8BFDB5A80CAF238884B6EBC9BA16C38E6079E7AA08D1BD5BE8849AD98363C64FA973A62431509ADCC270CD4
Malicious:	false
Preview:	....{...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................{.....sgs.......................................

Source: Aqua.i686.elf	Virustotal: Detection: 26%			Perma Link
Source: Aqua.i686.elf	ReversingLabs: Detection: 31%

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.3798601396394075
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	Aqua.i686.elf
File size:	67'028 bytes
MD5:	a44f59525e746cd6323e3adcfbba2bf6
SHA1:	daaa5ffa4492890f89343f02f86b4a54f9620dd5
SHA256:	493d8e62473aa1253db8c265ff5577f65f4e58d8a63759c15154d3b937d02f14
SHA512:	65c2473b6a813e61c1918884b2db07988451f9fccfac8d7eb4ff633ec3741433c6d20341ac2dcc6bf11b89174f5f6f34194eec29d8170c4d279877b3b5ff66e3
SSDEEP:	1536:6ls7IFtUITcmQSqwCUBakXxn73WHs/Zd/tesn3Y9RPJQR3xjpx:6lsEFtfTHqwCUBakXViM/Zd/tes3iYx
TLSH:	A6632981F687C4F5D81B08314077F33FCB32E5294171DA6EEF6AEF26DA63541A216289
File Content Preview:	.ELF....................h...4...D.......4. ...(.....................................................x....(..........Q.td............................U..S............h....3...[]...$.............U......= ....t..1...................u........t...$........... .

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048168
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	66628
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0xe561	0x0	0x6	AX	16
.fini	PROGBITS	0x8056611	0xe611	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x8056640	0xe640	0x1a45	0x0	0x2	A	32
.ctors	PROGBITS	0x805908c	0x1008c	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x8059094	0x10094	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x80590c0	0x100c0	0x344	0x0	0x3	WA	32
.bss	NOBITS	0x8059420	0x10404	0x2560	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x10404	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x10085	0x10085	6.4064	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x1008c	0x805908c	0x805908c	0x378	0x28f4	4.1933	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 31, 2024 14:03:01.140049934 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Dec 31, 2024 14:04:21.152184010 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 31, 2024 14:02:52.215708017 CET	8.8.8.8	192.168.2.23	0xd713	No error (0)	raw.cloudboats.vip	193.111.248.108	A (IP address)	IN (0x0001)	false
Dec 31, 2024 14:02:57.228368044 CET	1.1.1.1	192.168.2.23	0xd8c0	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Dec 31, 2024 14:02:57.228368044 CET	1.1.1.1	192.168.2.23	0xd8c0	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false

Start time (UTC):	13:02:51
Start date (UTC):	31/12/2024
Path:	/tmp/Aqua.i686.elf
Arguments:	/tmp/Aqua.i686.elf
File size:	67028 bytes
MD5 hash:	a44f59525e746cd6323e3adcfbba2bf6

Start time (UTC):	13:02:52
Start date (UTC):	31/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	13:02:53
Start date (UTC):	31/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	13:02:54
Start date (UTC):	31/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	13:02:55
Start date (UTC):	31/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	13:02:56
Start date (UTC):	31/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	13:02:57
Start date (UTC):	31/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	13:02:58
Start date (UTC):	31/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	13:02:59
Start date (UTC):	31/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	13:03:04
Start date (UTC):	31/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	13:03:00
Start date (UTC):	31/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	13:03:01
Start date (UTC):	31/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	13:03:02
Start date (UTC):	31/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Aqua.i686.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/run/systemd/seats/.#seat0j172Wr

/run/systemd/seats/.#seat0ydHWND

/run/user/1000/pulse/pid

/run/utmp

/var/log/auth.log

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

/var/log/kern.log

/var/log/syslog

/var/log/wtmp

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: Aqua.i686.elf PID: 6239, Parent PID: 6161

General

Chronological Activities

Analysis Process: Aqua.i686.elf PID: 6240, Parent PID: 6239

General

Linux Analysis Report
Aqua.i686.elf

Start time (UTC):	13:03:03
Start date (UTC):	31/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	13:03:05
Start date (UTC):	31/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	13:03:07
Start date (UTC):	31/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	13:03:08
Start date (UTC):	31/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	13:03:09
Start date (UTC):	31/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	13:03:10
Start date (UTC):	31/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	13:03:11
Start date (UTC):	31/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	13:03:12
Start date (UTC):	31/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	13:03:13
Start date (UTC):	31/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	13:03:14
Start date (UTC):	31/12/2024
Path:	/usr/share/gdm/generate-config
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c