Edit tour

Linux Analysis Report
Fantazy.arm4.elf

Overview

General Information

Sample name:	Fantazy.arm4.elf
Analysis ID:	1584046
MD5:	60fa0a202c149e60c54744c0ba07f6b3
SHA1:	5e3b56939399180954a5732a955936dac50ff2d0
SHA256:	d644b15e365deffc71e2145536c5dc276a697d6f57e0a549c12ef4b532ce6fe3
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584046
Start date and time:	2025-01-04 04:37:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Fantazy.arm4.elf
Detection:	MAL
Classification:	mal68.spre.troj.linELF@0/44@3/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing network information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/Fantazy.arm4.elf
PID:	6241
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	VegaSec-KATANA001
Standard Error:

Process Tree

system is lnxubuntu20

Fantazy.arm4.elf (PID: 6241, Parent: 6164, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/Fantazy.arm4.elf

Fantazy.arm4.elf New Fork (PID: 6243, Parent: 6241)

Fantazy.arm4.elf New Fork (PID: 6245, Parent: 6241)

Fantazy.arm4.elf New Fork (PID: 6247, Parent: 6245)

Fantazy.arm4.elf New Fork (PID: 6249, Parent: 6245)

Fantazy.arm4.elf New Fork (PID: 6251, Parent: 6245)

systemd New Fork (PID: 6258, Parent: 1)

journalctl (PID: 6258, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6277, Parent: 1)

systemd-journald (PID: 6277, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6278, Parent: 1)

journalctl (PID: 6278, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6315, Parent: 1)

dbus-daemon (PID: 6315, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6325, Parent: 1860)

pulseaudio (PID: 6325, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6328, Parent: 1)

rtkit-daemon (PID: 6328, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6331, Parent: 1)

systemd-logind (PID: 6331, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6393, Parent: 1)

polkitd (PID: 6393, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6398, Parent: 1)

agetty (PID: 6398, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 6399, Parent: 1320)

Default (PID: 6399, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6400, Parent: 1320)

Default (PID: 6400, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6401, Parent: 1320)

Default (PID: 6401, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6402, Parent: 1)

gpu-manager (PID: 6402, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6406, Parent: 6402)

sh (PID: 6406, Parent: 6402, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6407, Parent: 6406)

grep (PID: 6407, Parent: 6406, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6408, Parent: 6402)

sh (PID: 6408, Parent: 6402, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6412, Parent: 6408)

grep (PID: 6412, Parent: 6408, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6413, Parent: 6402)

sh (PID: 6413, Parent: 6402, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6414, Parent: 6413)

grep (PID: 6414, Parent: 6413, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6416, Parent: 6402)

sh (PID: 6416, Parent: 6402, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6417, Parent: 6416)

grep (PID: 6417, Parent: 6416, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6418, Parent: 6402)

sh (PID: 6418, Parent: 6402, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6419, Parent: 6418)

grep (PID: 6419, Parent: 6418, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6421, Parent: 6402)

sh (PID: 6421, Parent: 6402, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6422, Parent: 6421)

grep (PID: 6422, Parent: 6421, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6423, Parent: 6402)

sh (PID: 6423, Parent: 6402, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6424, Parent: 6423)

grep (PID: 6424, Parent: 6423, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6425, Parent: 6402)

sh (PID: 6425, Parent: 6402, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6426, Parent: 6425)

grep (PID: 6426, Parent: 6425, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6405, Parent: 1)

rsyslogd (PID: 6405, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6427, Parent: 1)

generate-config (PID: 6427, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6429, Parent: 6427)

pkill (PID: 6429, Parent: 6427, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6430, Parent: 1)

gdm-wait-for-drm (PID: 6430, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6435, Parent: 1)

gdm3 (PID: 6435, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6439, Parent: 6435)

plymouth (PID: 6439, Parent: 6435, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6459, Parent: 6435)

gdm-session-worker (PID: 6459, Parent: 6435, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6463, Parent: 6459)

gdm-wayland-session (PID: 6463, Parent: 6459, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6465, Parent: 6463)

dbus-daemon (PID: 6465, Parent: 6463, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6467, Parent: 6465)

dbus-daemon New Fork (PID: 6468, Parent: 6467)

false (PID: 6468, Parent: 6467, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6469, Parent: 6463)

dbus-run-session (PID: 6469, Parent: 6463, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6470, Parent: 6469)

dbus-daemon (PID: 6470, Parent: 6469, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6471, Parent: 6435)

Default (PID: 6471, Parent: 6435, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6472, Parent: 6435)

Default (PID: 6472, Parent: 6435, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6441, Parent: 1)

accounts-daemon (PID: 6441, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6452, Parent: 6441)

language-validate (PID: 6452, Parent: 6441, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6453, Parent: 6452)

language-options (PID: 6453, Parent: 6452, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6456, Parent: 6453)

sh (PID: 6456, Parent: 6453, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6457, Parent: 6456)

locale (PID: 6457, Parent: 6456, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6458, Parent: 6456)

grep (PID: 6458, Parent: 6456, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

gvfsd-fuse New Fork (PID: 6484, Parent: 2038)

fusermount (PID: 6484, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

cleanup

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6405)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /tmp/Fantazy.arm4.elf (PID: 6241)	Socket: 127.0.0.1:59025	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6435)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6465)	Socket: unknown address family	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.243
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.243
Source: unknown	TCP traffic detected without corresponding DNS query: 101.29.26.151
Source: unknown	TCP traffic detected without corresponding DNS query: 70.29.184.151
Source: unknown	TCP traffic detected without corresponding DNS query: 208.33.4.229
Source: unknown	TCP traffic detected without corresponding DNS query: 106.80.39.148
Source: unknown	TCP traffic detected without corresponding DNS query: 63.137.36.168
Source: unknown	TCP traffic detected without corresponding DNS query: 45.128.224.101
Source: unknown	TCP traffic detected without corresponding DNS query: 178.29.98.149
Source: unknown	TCP traffic detected without corresponding DNS query: 8.64.65.83
Source: unknown	TCP traffic detected without corresponding DNS query: 116.184.161.25
Source: unknown	TCP traffic detected without corresponding DNS query: 209.194.39.50
Source: unknown	TCP traffic detected without corresponding DNS query: 177.181.28.138
Source: unknown	TCP traffic detected without corresponding DNS query: 157.140.7.109
Source: unknown	TCP traffic detected without corresponding DNS query: 189.188.131.23
Source: unknown	TCP traffic detected without corresponding DNS query: 47.247.45.86
Source: unknown	TCP traffic detected without corresponding DNS query: 103.17.43.215
Source: unknown	TCP traffic detected without corresponding DNS query: 148.252.83.193
Source: unknown	TCP traffic detected without corresponding DNS query: 169.128.22.236
Source: unknown	TCP traffic detected without corresponding DNS query: 157.131.226.58
Source: unknown	TCP traffic detected without corresponding DNS query: 64.58.183.96
Source: unknown	TCP traffic detected without corresponding DNS query: 161.158.65.31
Source: unknown	TCP traffic detected without corresponding DNS query: 12.122.2.74
Source: unknown	TCP traffic detected without corresponding DNS query: 188.229.172.76
Source: unknown	TCP traffic detected without corresponding DNS query: 61.206.135.218
Source: unknown	TCP traffic detected without corresponding DNS query: 78.169.167.15
Source: unknown	TCP traffic detected without corresponding DNS query: 167.167.194.195
Source: unknown	TCP traffic detected without corresponding DNS query: 78.25.29.230
Source: unknown	TCP traffic detected without corresponding DNS query: 222.51.40.190
Source: unknown	TCP traffic detected without corresponding DNS query: 221.129.190.102
Source: unknown	TCP traffic detected without corresponding DNS query: 80.189.129.165
Source: unknown	TCP traffic detected without corresponding DNS query: 63.75.45.5
Source: unknown	TCP traffic detected without corresponding DNS query: 89.37.0.203
Source: unknown	TCP traffic detected without corresponding DNS query: 19.68.244.221
Source: unknown	TCP traffic detected without corresponding DNS query: 160.169.72.91
Source: unknown	TCP traffic detected without corresponding DNS query: 145.149.238.161
Source: unknown	TCP traffic detected without corresponding DNS query: 208.203.135.36
Source: unknown	TCP traffic detected without corresponding DNS query: 12.30.79.12
Source: unknown	TCP traffic detected without corresponding DNS query: 159.160.187.198
Source: unknown	TCP traffic detected without corresponding DNS query: 94.203.66.79
Source: unknown	TCP traffic detected without corresponding DNS query: 97.245.193.206
Source: unknown	TCP traffic detected without corresponding DNS query: 80.30.63.143
Source: unknown	TCP traffic detected without corresponding DNS query: 122.88.162.223
Source: unknown	TCP traffic detected without corresponding DNS query: 158.69.126.165
Source: unknown	TCP traffic detected without corresponding DNS query: 113.239.186.56
Source: unknown	TCP traffic detected without corresponding DNS query: 153.223.155.146
Source: unknown	TCP traffic detected without corresponding DNS query: 59.153.248.78
Source: unknown	TCP traffic detected without corresponding DNS query: 193.151.85.55
Source: unknown	TCP traffic detected without corresponding DNS query: 77.193.186.247
Source: unknown	TCP traffic detected without corresponding DNS query: 62.14.181.47

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.47.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38302
Source: unknown	Network traffic detected: HTTP traffic on port 38302 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 6068, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 6227, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 6228, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 6245, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 6249, result: unknown	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 6068, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 6227, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 6228, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 6245, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6249)	SIGKILL sent: pid: 6249, result: unknown	Jump to behavior

Source: classification engine

Classification label: mal68.spre.troj.linELF@0/44@3/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6315)	File: /proc/6315/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6465)	File: /proc/6465/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6484)	File: /proc/6484/mounts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6277)	File: /run/systemd/journal/streams/.#9:75579k0KYUQ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File: /run/systemd/journal/streams/.#9:75582OHyCWP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File: /run/systemd/journal/streams/.#9:76009pRyorO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File: /run/systemd/journal/streams/.#9:76041f4s8qR	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File: /run/systemd/journal/streams/.#9:76060PfzFuP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File: /run/systemd/journal/streams/.#9:76072gtYxcQ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File: /run/systemd/journal/streams/.#9:76082WYzfHP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File: /run/systemd/journal/streams/.#9:77078IDFVtP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File: /run/systemd/journal/streams/.#9:77079Ayu7dQ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File: /run/systemd/journal/streams/.#9:7709920mBPQ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File: /run/systemd/journal/streams/.#9:77214vXGAPN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File: /run/systemd/journal/streams/.#9:775000JkmgP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File: /run/systemd/journal/streams/.#9:77503PWWwbS	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File: /run/systemd/journal/streams/.#9:77671V2LPDP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File: /run/systemd/journal/streams/.#9:77680CVlH0O	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File: /run/systemd/journal/streams/.#9:78155inkhqP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File: /run/systemd/journal/streams/.#9:78225DQalkQ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File: /run/systemd/journal/streams/.#9:78227D0P4BR	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File: /run/systemd/journal/streams/.#9:78263T46iYR	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File: /run/systemd/journal/streams/.#9:782693WP3lQ	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	File: /run/systemd/seats/.#seat0Wfb4AU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	File: /run/systemd/users/.#127mreoUT	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	File: /run/systemd/users/.#1279pKMeV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	File: /run/systemd/seats/.#seat0mZB9SW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	File: /run/systemd/users/.#127z0Ed5U	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	File: /run/systemd/users/.#127w5SOWU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	File: /run/systemd/users/.#127uPA7EU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	File: /run/systemd/users/.#127aBIZSU	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6393)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6463)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6441)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6441)	Directory: /root/.cache	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/6277/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/6277/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/6277/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/6277/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/6277/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/6277/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2078/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2078/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2078/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2078/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2078/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2078/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2078/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2077/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2077/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2077/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2077/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2077/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2077/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2077/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2033/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2033/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2033/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2033/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2033/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2033/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2033/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2074/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2074/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2074/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2074/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2074/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2074/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2074/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/6393/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/6393/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/6393/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/6393/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/6393/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/6393/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/6393/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1532/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1532/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1532/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1532/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1532/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1532/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1532/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1576/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1576/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1576/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1576/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1576/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1576/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1334/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/1334/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2302/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2302/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2302/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2302/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2302/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2302/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2223/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2223/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2223/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2223/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2223/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2223/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2223/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2025/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2025/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2025/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2025/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2025/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2025/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	File opened: /proc/2025/cgroup	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6406)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6408)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6413)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6416)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6418)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6421)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6423)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6425)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6456)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Source: /bin/sh (PID: 6407)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6412)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6414)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6417)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6419)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6422)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6424)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6426)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6458)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6429)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6277)

Reads from proc file: /proc/meminfo

Jump to behavior

Source: /sbin/agetty (PID: 6398)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6435)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6435)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6441)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6441)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6402)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6405)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6405)	Log file created: /var/log/auth.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 6402)

Truncated file: /var/log/gpu-manager.log

Jump to behavior

Source: /usr/bin/pulseaudio (PID: 6325)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pkill (PID: 6429)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /tmp/Fantazy.arm4.elf (PID: 6241)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6277)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6325)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6398)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6402)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6405)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6459)	Queries kernel information via 'uname':	Jump to behavior

Source: Fantazy.arm4.elf, 6241.1.00007ffcf752c000.00007ffcf754d000.rw-.sdmp, Fantazy.arm4.elf, 6243.1.00007ffcf752c000.00007ffcf754d000.rw-.sdmp, Fantazy.arm4.elf, 6245.1.00007ffcf752c000.00007ffcf754d000.rw-.sdmp, Fantazy.arm4.elf, 6247.1.00007ffcf752c000.00007ffcf754d000.rw-.sdmp, Fantazy.arm4.elf, 6249.1.00007ffcf752c000.00007ffcf754d000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/Fantazy.arm4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Fantazy.arm4.elf
Source: Fantazy.arm4.elf, 6249.1.00007ffcf752c000.00007ffcf754d000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.vKZHzJ
Source: Fantazy.arm4.elf, 6249.1.00007ffcf752c000.00007ffcf754d000.rw-.sdmp	Binary or memory string: ZMV/tmp/qemu-open.vKZHzJ
Source: Fantazy.arm4.elf, 6241.1.0000564d5e466000.0000564d5e594000.rw-.sdmp, Fantazy.arm4.elf, 6243.1.0000564d5e466000.0000564d5e594000.rw-.sdmp, Fantazy.arm4.elf, 6245.1.0000564d5e466000.0000564d5e594000.rw-.sdmp, Fantazy.arm4.elf, 6247.1.0000564d5e466000.0000564d5e594000.rw-.sdmp, Fantazy.arm4.elf, 6249.1.0000564d5e466000.0000564d5e594000.rw-.sdmp	Binary or memory string: G^MV!/etc/qemu-binfmt/arm
Source: Fantazy.arm4.elf, 6241.1.0000564d5e466000.0000564d5e594000.rw-.sdmp, Fantazy.arm4.elf, 6243.1.0000564d5e466000.0000564d5e594000.rw-.sdmp, Fantazy.arm4.elf, 6245.1.0000564d5e466000.0000564d5e594000.rw-.sdmp, Fantazy.arm4.elf, 6247.1.0000564d5e466000.0000564d5e594000.rw-.sdmp, Fantazy.arm4.elf, 6249.1.0000564d5e466000.0000564d5e594000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: Fantazy.arm4.elf, 6241.1.00007ffcf752c000.00007ffcf754d000.rw-.sdmp, Fantazy.arm4.elf, 6243.1.00007ffcf752c000.00007ffcf754d000.rw-.sdmp, Fantazy.arm4.elf, 6245.1.00007ffcf752c000.00007ffcf754d000.rw-.sdmp, Fantazy.arm4.elf, 6247.1.00007ffcf752c000.00007ffcf754d000.rw-.sdmp, Fantazy.arm4.elf, 6249.1.00007ffcf752c000.00007ffcf754d000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6441)

Logged in records file read: /var/log/wtmp

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Fantazy.arm4.elf	68%	ReversingLabs	Linux.Trojan.Mirai
Fantazy.arm4.elf	57%	Virustotal		Browse
Fantazy.arm4.elf	100%	Avira	EXP/ELF.Gafgyt.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.47.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
48.140.115.157	unknown	United States	2686	ATGS-MMD-ASUS	false
138.211.230.219	unknown	New Zealand	2379	CENTURYLINK-LEGACY-EMBARQ-WNPKUS	false
18.19.222.88	unknown	United States	3	MIT-GATEWAYSUS	false
83.101.174.113	unknown	Saudi Arabia	29690	ATHEERAtheerJeraisyAutonomousSystemSA	false
218.185.254.141	unknown	India	4809	CHINATELECOM-CORE-WAN-CN2ChinaTelecomNextGenerationCarr	false
130.5.144.16	unknown	United States	6908	DATAHOPDatahop-SixDegreesGB	false
161.164.218.251	unknown	United States	10695	WAL-MARTUS	false
71.207.48.193	unknown	United States	7922	COMCAST-7922US	false
109.241.132.242	unknown	Poland	29314	VECTRANET-ASAlZwyciestwa25381-525GdyniaPolandPL	false
177.197.201.182	unknown	Brazil	26599	TELEFONICABRASILSABR	false
203.123.218.138	unknown	Korea Republic of	17597	SAEROMNET-AS-KRTBROADSaeromNamdongSeohaebroadcastingKR	false
162.186.209.13	unknown	United States	21928	T-MOBILE-AS21928US	false
27.126.28.192	unknown	Korea Republic of	38133	MULTINET-AS-KRCMBKR	false
8.83.214.70	unknown	United States	3356	LEVEL3US	false
174.207.107.42	unknown	United States	22394	CELLCOUS	false
102.160.239.150	unknown	Mauritius	30999	EMTEL-AS-APMU	false
208.203.135.36	unknown	United States	701	UUNETUS	false
148.86.116.81	unknown	United States	31822	CITY-UNIVERSITY-OF-NEW-YORKUS	false
69.187.239.95	unknown	United States	3801	MISNETUS	false
14.50.114.10	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
122.12.89.11	unknown	China	55361	LUCKYTONE-NET-HKLuckyToneCommunicationsLtdHK	false
221.182.110.74	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
67.229.74.151	unknown	United States	35908	VPLSNETUS	false
75.138.68.236	unknown	United States	20115	CHARTER-20115US	false
150.152.181.140	unknown	United States	1498	DNIC-ASBLK-01498-01499US	false
37.77.114.103	unknown	Italy	198471	LINKEM-ASIT	false
115.185.194.208	unknown	India	2510	INFOWEBFUJITSULIMITEDJP	false
181.25.249.206	unknown	Argentina	22927	TelefonicadeArgentinaAR	false
172.178.44.2	unknown	United States	7018	ATT-INTERNET4US	false
13.63.156.245	unknown	United States	16509	AMAZON-02US	false
82.244.218.62	unknown	France	12322	PROXADFR	false
13.199.187.108	unknown	United States	7018	ATT-INTERNET4US	false
155.125.9.112	unknown	United States	11003	PANDGUS	false
106.113.210.186	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
77.59.236.199	unknown	Switzerland	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
69.230.36.212	unknown	United States	7018	ATT-INTERNET4US	false
42.164.28.244	unknown	China	4249	LILLY-ASUS	false
191.139.22.73	unknown	Brazil	26615	TIMSABR	false
53.153.145.21	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
157.7.0.251	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
53.119.231.134	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
9.52.235.121	unknown	United States	3356	LEVEL3US	false
68.218.235.117	unknown	United States	6389	BELLSOUTH-NET-BLKUS	false
120.143.71.104	unknown	Japan	38462	OCE-AS-APOsakiComputerEngineeringCoLtdJP	false
185.74.33.234	unknown	France	199811	WIFXCH	false
217.62.222.188	unknown	Netherlands	33915	TNF-ASNL	false
204.124.191.142	unknown	United States	53718	ECH-ASUS	false
107.25.238.129	unknown	United States	14654	WAYPORTUS	false
57.2.220.58	unknown	Belgium	2686	ATGS-MMD-ASUS	false
223.240.174.211	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
170.95.104.71	unknown	unknown	21852	DISNW1US	false
170.38.157.85	unknown	Malaysia	139776	PETRONAS-BHD-AS-APPetroliamNasionalBerhadMY	false
221.175.109.156	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
188.162.157.221	unknown	Russian Federation	31163	MF-KAVKAZ-ASRU	false
154.176.200.210	unknown	Egypt	8452	TE-ASTE-ASEG	false
14.31.42.208	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
111.193.37.246	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
213.80.4.127	unknown	Sweden	12552	IPO-EUSE	false
84.232.131.30	unknown	Romania	8708	RCS-RDS73-75DrStaicoviciRO	false
71.247.67.118	unknown	United States	701	UUNETUS	false
13.251.112.197	unknown	United States	16509	AMAZON-02US	false
223.136.108.156	unknown	Taiwan; Republic of China (ROC)	17421	EMOME-NETMobileBusinessGroupTW	false
120.49.110.75	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
178.151.111.82	unknown	Ukraine	13188	TRIOLANUA	false
179.79.96.149	unknown	Brazil	26615	TIMSABR	false
83.134.250.69	unknown	Belgium	5432	PROXIMUS-ISP-ASBE	false
65.23.91.89	unknown	United States	27216	AIR-ADVANTAGE-ASNUS	false
206.129.67.18	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
45.198.94.253	unknown	Seychelles	328608	Africa-on-Cloud-ASZA	false
82.150.71.251	unknown	Turkey	31654	BTINTERNATIONAL-ASTR	false
182.70.84.72	unknown	India	24560	AIRTELBROADBAND-AS-APBhartiAirtelLtdTelemediaServices	false
113.45.61.215	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
174.20.34.181	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
121.170.84.76	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
176.53.19.75	unknown	Turkey	197328	INETLTDTR	false
147.57.143.14	unknown	United States	4193	WA-STATE-GOVUS	false
47.50.64.200	unknown	United States	20115	CHARTER-20115US	false
102.202.138.94	unknown	unknown	36926	CKL1-ASNKE	false
166.173.253.239	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
158.75.30.248	unknown	Poland	12423	TORMANTorunRegionalComputerNetworkPL	false
152.193.233.67	unknown	United States	701	UUNETUS	false
147.132.235.25	unknown	Australia	9650	CITEC-AU-APQLDGovernmentBusinessITAU	false
128.27.85.25	unknown	Japan	17511	OPTAGEOPTAGEIncJP	false
78.172.252.194	unknown	Turkey	9121	TTNETTR	false
108.51.64.110	unknown	United States	701	UUNETUS	false
102.70.102.198	unknown	Malawi	37294	TNMMW	false
37.142.254.188	unknown	Israel	12849	HOTNET-ILAMS-IXAdminLANIL	false
43.48.16.95	unknown	Japan	4249	LILLY-ASUS	false
165.55.6.26	unknown	South Africa	37053	RSAWEB-ASZA	false
125.243.86.34	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
145.185.114.247	unknown	Netherlands	59524	KPN-IAASNL	false
70.54.98.229	unknown	Canada	577	BACOMCA	false
86.121.6.100	unknown	Romania	8708	RCS-RDS73-75DrStaicoviciRO	false
40.203.36.147	unknown	United States	4249	LILLY-ASUS	false
75.172.71.213	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
27.221.114.141	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
98.117.13.50	unknown	United States	701	UUNETUS	false
88.47.242.206	unknown	Italy	3269	ASN-IBSNAZIT	false
77.4.170.226	unknown	Germany	6805	TDDE-ASN1DE	false
185.53.84.72	unknown	Finland	50585	DATASAFE-ASFI	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
221.182.110.74	mirai.x86	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	sshd.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	jklarm.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Josho.x86.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	185.232.205.45-boatnet.ppc-2025-01-03T23_59_48.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	185.232.205.45-boatnet.arm6-2025-01-03T23_59_47.elf	Get hash	malicious	Mirai	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MIT-GATEWAYSUS	31.13.224.14-mips-2025-01-03T22_14_18.elf	Get hash	malicious	Mirai	Browse	19.140.245.66
	https://track2.mccarthysearch.com/9155296/c?p=UJEwZLRSuPVlnD1ICTWZusB5H46ZFxhQFeZmgv_N89FzkqdhuHSGoPyB5qZfahmny00oVnRJ_XGR4M89Ovy-j3JZN_nz1Nb-BfHfDXVFwrd4A8njKtxWHgVV9KpuZ3ad6Xn31h13Ok4dSqgAUkhmVH1KUMKOlrKi5AYGmafMXkrBRxU_B4vy7NXVbEVJ970TwM25LbuS_B0xuuC5g8ehQDyYNyEV1WCghuhx_ZKmrGeOOXDf8HkQ-KOwv_tecp8TMdskXzay5lvoS31gB-nWxsjPaZ8f84KWvabQB4eF73ffpyNcTpJues_4IHHPjEKJ9ritMRTaHbFdQGNT_n13X_E7no0nMmaegQjwo4kKGu6oR02iG2c_6ucy3I6d8vsNl324Pjhx3M20dDmfZAju1roW9lGyO1LfgEnp1iSAFpx4kA7frEmKGzJYNX_cZrwVBoH8vvIYauXGnXBrZacRhuZGGbOjW2HHr9KF-0q7xjdgG2hxjWZ2H9zjubJGDnUjHRfiIr_-0bem1pLFqziEmy0450LGuXV23cQ6GD8yuK9tuRwMIF0sbkhVqONC0e6TsXlkUuTRAVWBbLlRPcygJ-CbukwvFtAxobVQ8-PpIuGj97DYFnmbfbJrrZDtH57TpdP4AxtW5k74BKSXvb1B6JX0p7Oyr1kXxLs_OrNPdAdrf8gXR35D9W7WeQ2zhPEqP0Mv5sJx4DlYh6Y4FqgPfCRFcDcL7Cy3HSlJ0XYfv-ae4o-hdX_0rJPqEG_-Bn2yj60YPDYpE8KDIgC_ZMwlNLdK4pAK6vSt4NWDncuV5y7QDqt97ribjd4U3AOvQTKW9r_eMky9-IC9hkSPrg2S0ZBgA9ITW3AQ3v-lq94cAwt1v1RLaFgsy67l_7lni1gYsZaQdOsFJsDpCFYaZsTMcVz2QAnQ_2UidhzlUekPl5xh9LNe9o77rO1FolZslooaXxCf2U2RZmvUA6NCNiGZ8KSsoUYTnqAHenvBJVJwMWd66yD2O60rC3Ic2qOQ1KOF9AB6-iFTvQFxtSTjS2hFwi7N97LeQtVYKhdzZuq2SasgJg0JPnZiFv_FSbgmiodqx9rz_lWIqWQNoQVht-oO2BfFxSF_aedAmm2MuQAL7z8UjBf_deiKwQyfKOyA6ZkAJ14F9xwhNm9F7B4PBgDtocqJQBjw5Cf1jCBSAs3nSYP2_nzofJuQSXd-YD9PIzkkmJw7Nqux7IgJ6p1z2Hsf6i3zShVdZY3g2mmA1xR1FV1LoSYwcRBqZt3pv0UDjuqCEoiqKDuyT0rkhqTRLo29uuM588Lna16PFSgSLoLUhnJ2rx8NLQQc5TqrsGjlN-ulCwTEyA0C9Epz9mxq14yDjw==	Get hash	malicious	Unknown	Browse	18.173.205.38
	3.elf	Get hash	malicious	Unknown	Browse	19.113.179.88
	1.elf	Get hash	malicious	Unknown	Browse	19.61.16.230
	http://www.klim.com	Get hash	malicious	Unknown	Browse	18.66.147.17
	4.elf	Get hash	malicious	Unknown	Browse	18.125.91.243
	2.elf	Get hash	malicious	Unknown	Browse	19.182.48.88
	http://hotelyetipokhara.com	Get hash	malicious	Unknown	Browse	18.173.205.71
	http://boir.org	Get hash	malicious	Unknown	Browse	18.66.102.106
	DEMONS.ppc.elf	Get hash	malicious	Unknown	Browse	19.34.243.250
CENTURYLINK-LEGACY-EMBARQ-WNPKUS	loligang.x86.elf	Get hash	malicious	Mirai	Browse	205.245.131.136
	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	205.245.131.111
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	138.211.199.95
	arm7.nn-20241219-1505.elf	Get hash	malicious	Mirai, Okiru	Browse	204.49.12.217
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	204.117.222.136
	i486.elf	Get hash	malicious	Mirai	Browse	138.211.189.250
	armv4l.elf	Get hash	malicious	Mirai	Browse	204.49.53.120
	b3astmode.ppc.elf	Get hash	malicious	Mirai	Browse	205.245.47.62
	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	76.3.80.144
	sora.ppc.elf	Get hash	malicious	Mirai	Browse	138.211.190.190
ATGS-MMD-ASUS	Josho.x86.elf	Get hash	malicious	Unknown	Browse	34.11.95.252
	31.13.224.14-mips-2025-01-03T22_14_18.elf	Get hash	malicious	Mirai	Browse	48.101.25.53
	31.13.224.14-x86-2025-01-03T22_14_18.elf	Get hash	malicious	Mirai	Browse	50.8.41.40
	armv6l.elf	Get hash	malicious	Mirai	Browse	50.11.168.33
	1.elf	Get hash	malicious	Unknown	Browse	48.235.225.7
	1.elf	Get hash	malicious	Unknown	Browse	34.131.149.89
	armv5l.elf	Get hash	malicious	Mirai	Browse	195.212.120.10
	armv7l.elf	Get hash	malicious	Mirai	Browse	48.21.9.206
	armv4l.elf	Get hash	malicious	Mirai	Browse	57.148.94.56
	3.elf	Get hash	malicious	Unknown	Browse	57.172.163.168

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/6468/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:hn:hn
MD5:	C60E2AB3C7F8E12740CA2DE65544A7F2
SHA1:	FD81A3D8CEFDDC68D50DD6205E3367CB2299CBB5
SHA-256:	687D4D30F8014EEB63BFD2E72A3E0010FF76A8C5DF78E3DDE41A5D5473B5AD55
SHA-512:	506FB9173A5316DBA9F89C8F1F92C629C5B3146E2312A934634EF498E22C7834EE2A25BD2A94E2BF904A6E4577E6234F0D84B5BAE25432BA43DD6AE69AE582CF
Malicious:	false
Reputation:	low
Preview:	6435.

/run/systemd/journal/streams/.#9:75579k0KYUQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.495664220180804
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmriRLB3TWtARJshTjq:SbFuFyLVIg1BG+f+M+R13TRihTji4s
MD5:	F2540D855083383F5502E0E87B53C386
SHA1:	B7ED34A22D059B23E9D0C13BDFCC120F86EFD7DD
SHA-256:	9010B553D564A569403734959DE5612983A8E0633CBDDC88510C1F2A7846B7FA
SHA-512:	628805EF7900A7E1E1AC60AF665D31334512A4441235451B98EA2A977C15D3929BE6B4543963E721BB40B1E5805518666C30D0BCCB7D25F213E12B491FD8D460
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a4a5a7def17d44edbd9b982974e4e214.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:75582OHyCWP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.460593770827898
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrhpsHVgoU3B0hg2jq:SbFuFyLVIg1BG+f+MzigB0ji4s
MD5:	062ACF5845E90100FA9CFE7ABBBB4285
SHA1:	FA2C716A3FD89F2D0767411DE9667372817FD46C
SHA-256:	EC9EDA21B67D871FD1FB9B36BC74C2611BFF1B7D0D6A119BC74D4F64F68EF6E8
SHA-512:	512F508792BC62E2264419E231E0EE571968E7DF4DE624A5D627CE3F002277047627C44816047BF65CF7708041F4DA27F3F2ADAF24A1F05C61B776D3E4DD048A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a91c554eed61404c8b0beeeef0834eed.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76009pRyorO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.3908571092899225
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/zScr9TdDlGVGXsjx:SbFuFyLVIg1BG+f+MBBcVG8josQu
MD5:	3CAFE01740BEE2E976DC8664FCF7F362
SHA1:	D431B453303950523B80C1692290CFB67CA34579
SHA-256:	E185303429D0450743985AF5DB86E8C7084FA7EF2DF803060B671FD9D8AC3A03
SHA-512:	FD5E8CD94A56DC3AE717A99E6FC93A02E0F39A5FE6064EE5436D2A9489A09F519FBDE8CE0393D547AE9CF9642ADAF9AB692471039A7DCCB8A1571C07F3498282
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5b1198e851084880a16613aee3f73c0a.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76041f4s8qR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.408289085276858
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvBgTmlOGjXHvTPsje:SbFuFyLVIg1BG+f+MgmlOQPQjdCLKzK
MD5:	A081B3D083A780DE4911A8F7571B31DF
SHA1:	43CD24A823C2883F2A09A2782D639AAA75133DAE
SHA-256:	88E48A6D6A51EDDBDF3C8ECA678F16EE003AC6DA2896F35B9BEB76FBE6597477
SHA-512:	3684AC8FF3D178A523E8E0A873D0146B1C04412453A1A4616269F25610136077E1B36DD1D4E52F66F89A43BFDD73B3B4D310E3D35EBBFD9BDA56FAC9B4962A7C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ed231b94650f43b8947c9aacec2b796b.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:76060PfzFuP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.440959780105219
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M4bEJR5KF2jFmzXvn:qgFqo6g7/+0+f+M4bEJR5/QXvn
MD5:	9FB4693668052DEFDF14556AB13BEFD0
SHA1:	C7D2DF87C0884A294983F1DB233CC536383D1CAF
SHA-256:	4E62B2E4C6F0BF74B1CA8538B39E395DCF0763585F103DAF2C7C844B8DECF21E
SHA-512:	E5C44D22D111A0BA354888459C341BCA55F1D1E6916B2D49F02FF99CAB49F3C1B825E65863D153049970862B03A650ED250A2ECB5F5747B42E1DE85A84C77919
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2303dc61b3454e2fa5d7490d2503c2d8.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:76072gtYxcQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.439217202377235
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M8Mgeb19N2jFmzXvn:qgFqdg7/+0+f+M8MgE1/EQXvn
MD5:	6D3A23622DCA08BBFB9C53BBA5215B97
SHA1:	6BD9700453B8F6E43CF024AEDED30AA577A08EF1
SHA-256:	247E854FB5CE4BD4AD943C32B95B94A0D72249BDC06EC3C42D3DCE046D3245D7
SHA-512:	86A82649E9BF48E91EECA03DF8A3BF7FB481CE7F25245D12AD1BAF94B7B892E92F8FD2CD3E7C3326DC277D37E0CE1CB90F83A3D2D96E277498E299E7386CAE6A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=62b977293cc14896908384988e459228.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:76082WYzfHP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.370879075326915
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoZL4QzBBHydbYlsjt:SbFuFyLVIg1BG+f+Mo1dDydbbjtWL0
MD5:	67DD73CBB1149658EC2FA50032C40A76
SHA1:	51DF4CF9371A89141361F4D7A796E2DA7CCE2FED
SHA-256:	781208131BD6CAF4DDF5B52A8FCE27A261D50E3C31333C292F2BE29D3CAFCFD2
SHA-512:	71C45FFA346859694D006B4AB4DC32A8FB557DADDB88D8A4508C3BEFDC28104D438BF187263EE8EFC18327E5E9F0A84D2FD171A0A943AB888C6F892E2BF11330
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b60ce39567bc4995957e8fdbb7816eab.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:77078IDFVtP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.445049291437353
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7LDCqccEEL7ujgrqO:SbFuFyLVIg1BG+f+MTCgqjNE
MD5:	76697CB8C735A79E7C6E253692247EB8
SHA1:	73FB47A67A5254B15A6C05D2838E29E567EFDCB1
SHA-256:	C5F9D9E79B36A93A5FC85FDC739B334ACD38909C693201F17C760D895940050B
SHA-512:	1A526C2FCDB77BEC4F13244D553093EBFFFAA5E58EB38F23C866A2797F16D2BF53ADE3A9E10EE435DA55C4927FC764CD9CF227DF59C0F4B79D756B5881D478D9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1f28992308b543159aaca3ef51444897.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:77079Ayu7dQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.408575876553764
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MsAlHfWy2jZcHcljX+:qgFq6g10+f+MsMHfZYmAu
MD5:	D5953C6DB8D889DF80EF7F8AD88659A3
SHA1:	762319D096FED32B4E16465D874EF118935FCEDD
SHA-256:	47374CC05751615E8A7504BB3A2E0FA37ABF4BD208FF71CB69A19545EB101D69
SHA-512:	A15A940D8956B29C812D18C706C5880173086E9611B903828A58BB7B23EA92EC117F4A11CCF324C94D33A88C068B7762E26458BCBEF19F20B5EDAE4438CC425F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f48a4e7700d54edb94d0000c78a93900.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:7709920mBPQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.421591333135346
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/HaacREtxZ8jshKJg:SbFuFyLVIg1BG+f+MzBtUjbVC
MD5:	E1E2F3EFF5661A4BB137565558D0C18B
SHA1:	9CB7F152419D478D57B18AE790FB3BA67D98DEE4
SHA-256:	696E65174682BA281DFB0B4804CBB8F22B236E3517B80549178ED2C1289BE1B0
SHA-512:	6DBAE5680BD379B89CE2A95C1451A8192D3309BE6891254F6B44E7B5301BA28AFC1C9F23D7CA5B323B6F237FFEB691A90CA68B153BAEADE3860F3B51AB2E6ED0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5df5921e42b7425894a5365356a0408d.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:77214vXGAPN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.369223234223625
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmy9kGd3pHWh02lsjsV:SbFuFyLVIg1BG+f+MyT3p+0jLkGq
MD5:	AA7BDD7D4C194BFACA2C5DF3315E5648
SHA1:	19D0CECFDED2D61ADFA91AD34577392F224BF766
SHA-256:	472A82FF7012DCEA8721E4474F6AE7C7D004E2B022438CCF59EA39A7859D6C3A
SHA-512:	92D68B16F7AA57DD65B15A263829B39CD53B89A2B3D6DB295FEAB6A47C628A65C1A1E54A4C999D11CAA30F37D64945D92E8A5D3480E89952668B8F2187B5A7A0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=802dcd8c21454a05bee6b07cb60ad5ab.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:775000JkmgP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.449179191056596
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm/kEYWh0tAFOhq22js2o:SbFuFyLVIg1BAf+MVhc822jNALyAZD
MD5:	ADCE881A9DCB6A6E0245D448BEE27F50
SHA1:	D2BCC9F080A6382322658BBB311994F70C0E1089
SHA-256:	F2037EF16B12F8C639CAC9949D09ABBEAE6A0BBE3702A0928AEF6881855470E6
SHA-512:	D20200E1ABB93C39E4F7358BC6347F945152E4B1C8E640EBC1C1BA27A04395DA3ACEAB1956BF5E60DE05F6219859CAD626CA872474309F1DC08CAB3210BF4DDA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5081a2f1a3784bb18f583e197970bd06.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77503PWWwbS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.46186933222869
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M4WEA3FTjdCt/rRMtq:qgFq6g10+f+M4zCCDL
MD5:	F08BBB79116226DFD9263011D148DFAC
SHA1:	248D95CB617B6D66800354E23FCF1E63A09F9DC1
SHA-256:	312BB342818CBA91C79346FCEE91AADBB8C9B6DC6296A85EFE9165A562B2973E
SHA-512:	5BC1823CCBF57862099A6DA899B40774FC20A189C0E712C6CE955E59E6D1D1917AF92FA81F1A69B48DC5E9FEAFCC9B872E53E7204096090A6E82AA6856C7580A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=26f27a166242478cae8351951f02039e.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:77671V2LPDP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.435535117362243
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmukRBawvswsjs2BbQIeT:SbFuFyLVIg1BAf+MukR8ZjNdQIeXD
MD5:	3F7233BFC93F407822F0C44F542446DC
SHA1:	A309BDA098ADBBFBC3C11773923A4B84D42BD4FC
SHA-256:	E041C013186E74A8A3802AA533C720FC48EA1CFEA9A5A7C433B4FEFE1B8A52BA
SHA-512:	133F21D9B92A081AC5EF9514C81C4DCD9813DA83DAFE221F6F8852FC18C6F10612E0B3E785442282D1F12BC89E4AB24E121DE794DF44587D1AFBCE9D158F4C10
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=de184568486d47838ea83a59db9cead0.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77680CVlH0O

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.357102868932131
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmpLLnTQTKdUXQBLhglsH:SbFuFyLVIg1BAf+MlFWeTjNTZD
MD5:	CFA2FB502FE4289EB865BFA6D93D1EC0
SHA1:	D66F23D6717C7FD297D5B818212F7226CF759619
SHA-256:	C00FDEE25209062B5C8110CDE6ED7F81AF27A751523AEB684211E877565E4C83
SHA-512:	078A1F7F8F89220A860AB65D98CAF32C8BAA9776B0F107D5C8DBD131073C2E42FF92016B0B8E0E32B320AE3FCDBC665620DE519334145FF3B9CF66C95C017A3B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c46dd239ae934d65846c812e88d46de0.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78155inkhqP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.401335911645253
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/dBt9xgHo/XsjswxM:SbFuFyLVIg1BG+f+MH2He8jLTTIWTIL
MD5:	E92A5D35CEAD342C2323F7A8FB258C93
SHA1:	4C88161E4852238588FF1AFA751ACA41A5409AA3
SHA-256:	8C31F9E84E1D699410ED3321AFBE88D92A7818F53D8A01FA10C47DDB847CDFFB
SHA-512:	295ED0DB10F24841269E42484DC52AE9FEEDA95D23FA38E2A4C18C08519AEC53F0890DA6F17BC3C0C472EB4BA6A00D76AA8AACBF4226C0DD01948A3B60A38F03
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=51a51ee0022842be8c4b4920a75bc52b.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:78225DQalkQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.341052057842698
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmyr7V1AGSJzXvZjk:SbFuFyLVK6g7/+BG+f+MyrR1AzbZjNq
MD5:	EE6B2071C077F10DA6C07A369599A30D
SHA1:	2819BB81A7CEEDE2994199127FCB92A888118AE0
SHA-256:	E6F843B7E2703A1CB1E89D5F4550C9C252C3E738748441BAB23711D98EFBD287
SHA-512:	E9253C4F54DB228442899578FA52E47EC5C4749CAC7EB4615EF32FFA74B39AC4ADCBA33998B6C5751D5941E2F719C0900C7946369F7FAE55E3DAF4A55587E2F8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8edd3e4500624ec28ef0e3eacad2d766.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78227D0P4BR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.425699429261552
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmuNj4qbVgTjs2BD0:SbFuFyLVI6g7/+BG+f+MuNHVcjNq
MD5:	EFCEBFA78ADD60927C5DC1A295150FCA
SHA1:	54AF1D3D1584095F331A12DB4BF1DA04D83B6E77
SHA-256:	F2AA31E3AA78385745DE6F8933FF7AE9EF6258C1BCDCAB3D7BB591FEA4AB1F79
SHA-512:	84E2720E431E858F70DF6D13597C88F54177DA2F585B83C3F2504EEE81A02A1E27FFB488FDEEADF7797AFCBBE2E6A23D7CC873C580FB8FAD5B98E498DC96B5EC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d912c6ef45e447f89fb35eeec583dfa5.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78263T46iYR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.54251587295533
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MoDiyW0QRKjFQMzKaBu:qgFqo6g7/+0+f+MoDW7KTmh
MD5:	20B5DFD9B1143D2D12D367ECD4FE11D5
SHA1:	93BD9D69A4AF02DC1F9A40863687449D511CD335
SHA-256:	9547ADA5A84361C3F79AA6B1BA334151C19694F5153D06570A4EDFF3AEC24076
SHA-512:	4A2AE2E78C010620872DD2F1FA375BA84FB5F822708BD776B3B464AA051723F0D2ACAFA7FC4007AC60E45DEE2A8932F3570DBF308FA2D4D68F3A75BDD223B3E7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bf5c79bc11e34c72af8fff37b1aab495.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:782693WP3lQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.514606184800176
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm5nX5Qtuxsjs+QMM:SbFuFyLVI6g7/+BG+f+MjYjFQMzKaBu
MD5:	CBC791A8B01DCE880F2767C20ED85DBA
SHA1:	E8EDA6A6818B59D6E6392BB5C2A4A286100E12A0
SHA-256:	8D88D5527E5F327B8E31263C42064E2C78D8EE0070361B47DE5A887DFCBA148B
SHA-512:	86856779E5BA6B2B31E34E9137DC315C8C94694D28724857F49D32B821E428FA0B839C08DEE6FDE071E7A76EBA14CE04AD64C66A5D9D06A935A62F7C05B15BF2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=35146532df7b49f08bbf703a1700fa22.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/seats/.#seat0Wfb4AU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0mZB9SW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/users/.#1279pKMeV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.309261470622769
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gGLlV02thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+gUrthQHtPYq9M
MD5:	118AD12973CB2F9DB37F7B0E0C45B57F
SHA1:	BB6CC7D748DED8775FE30574F788F3A9BFA7E7DA
SHA-256:	27BC078AD48A050D5C1C54BDF4086B0796379D68B70765E8E0BF491F0A151902
SHA-512:	EC78AF341D21840A6AECE25A4355828DB8B7CC1B10D884F10547ED72A273984BA3F99A833D6CEB0E2607EE62E056C21FB4153E1606CB1DAE6E9428700EB9A54C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1735961914138624.MONOTONIC=459954695.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127aBIZSU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.494167055347199
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6lgTgGLl2gt69m:qgFq30dABibB3TgUwgI9m
MD5:	928F2A900E5ED3C554EDBE5A20F68513
SHA1:	DF9EEF73B93BB6CAB8BA748BFA9536F6F6CBA9CD
SHA-256:	3164A769A8B6567BEE01430A6BEDE40B293F59BF3E0D6FCF526516C5649273FF
SHA-512:	7BB9405E14F9A4EA6CA0BF07B70936A4E20A177859D9ABED3F113B71444875EA494080826A22C22C1CD22E5A0C2552BD0D92836E803FC8669F514A9244AFF28B
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12412.REALTIME=1735961914138624.MONOTONIC=459954695.LAST_SESSION_TIMESTAMP=460038706.

/run/systemd/users/.#127mreoUT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127uPA7EU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.494167055347199
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6lgTgGLl2gt69m:qgFq30dABibB3TgUwgI9m
MD5:	928F2A900E5ED3C554EDBE5A20F68513
SHA1:	DF9EEF73B93BB6CAB8BA748BFA9536F6F6CBA9CD
SHA-256:	3164A769A8B6567BEE01430A6BEDE40B293F59BF3E0D6FCF526516C5649273FF
SHA-512:	7BB9405E14F9A4EA6CA0BF07B70936A4E20A177859D9ABED3F113B71444875EA494080826A22C22C1CD22E5A0C2552BD0D92836E803FC8669F514A9244AFF28B
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12412.REALTIME=1735961914138624.MONOTONIC=459954695.LAST_SESSION_TIMESTAMP=460038706.

/run/systemd/users/.#127w5SOWU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.34578119920695
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgA3cIl046c6K2xi206qodqMmTv:SbFuFyL3BVgdL87iesnAiRJgGLl2gt6o
MD5:	584539B5074ED35F75F179422B8BCB70
SHA1:	DE9FA9586EEA9F66DBFE6BE8938C78AD0E109D8D
SHA-256:	3AABBEA0993A429A3326E7D6EA45686A116603655189F8771856F87458B21970
SHA-512:	3BA057291EFEDCDB443520903A458CD9680C453A34FA8A5C6E23F7242DB16D631BA3136B0516530A607A1B1A79EFAF9D299E52B26A84AD49A919F1B73AF44F9D
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1735961914138624.MONOTONIC=459954695.LAST_SESSION_TIMESTAMP=460038706.

/run/systemd/users/.#127z0Ed5U

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.309261470622769
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gGLlV02thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+gUrthQHtPYq9M
MD5:	118AD12973CB2F9DB37F7B0E0C45B57F
SHA1:	BB6CC7D748DED8775FE30574F788F3A9BFA7E7DA
SHA-256:	27BC078AD48A050D5C1C54BDF4086B0796379D68B70765E8E0BF491F0A151902
SHA-512:	EC78AF341D21840A6AECE25A4355828DB8B7CC1B10D884F10547ED72A273984BA3F99A833D6CEB0E2607EE62E056C21FB4153E1606CB1DAE6E9428700EB9A54C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1735961914138624.MONOTONIC=459954695.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:c6:c6
MD5:	EECFCEBBE2BFEB882B4A9985759B6DD3
SHA1:	A77C41C91AF8CE5F06FB64BD92971B08F3745F0D
SHA-256:	B91B75CBC42D078630D8032195BE2E7688C62AF30BEB8D5A145220C1F5484FED
SHA-512:	557A053D9B36CABBC5369496F2DEE9B63930CFF70C164230B8F392BB21C752F48E344D1E80B87D1E68224C8AE838CA6F0AB1F1771701E4696CFC5EAE190201F8
Malicious:	false
Preview:	6325.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:ns1sXlXEWtl/xlD4/:sQ+ylo/
MD5:	3AD404811F1EF93AD3D1AC8E16A59A5E
SHA1:	58D8A90470765750C60B5384FCD1EA458E30B642
SHA-256:	2266B5CBCEF20365F0F04E5ABD1AE92DA99E6F267FA17B0E76610E532F4AD828
SHA-512:	115E2531D798015C778F4BE9D218E20D4B8E09589BC8AACDFC27127D85FFC61FADD67EB373B9DF097058B70F3443128737B8D7133D704129EBDA475601A3ADE4
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................(.xg.8......................................

/tmp/qemu-open.vKZHzJ (deleted)

Download File

Process:	/tmp/Fantazy.arm4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	3.578868021290193
Encrypted:	false
SSDEEP:	6:OgDF6ElR0Jznj/VUX/vYDF6ElR0JzC7Y/V3Y/VjmsVot/VOArB/VH:OYNlR0JznyXQNlR0JzDl
MD5:	9F11127DAAE371FF24035CEB57B1D9BF
SHA1:	A9DA07F9CF22C981D500410ED078AAC8011CF5CD
SHA-256:	9359C739AF2FB8C563B5879E9780B427E1BEC6F4839E5C51B3A620008F380E26
SHA-512:	39A51CDA08D24C843FD0248FAD7E21C8E381EA0D31EFB1918C143F6CAED1489085EF3FF30516BA54BD00C08E4521714460074DC7EB3FD999218836B50C7AA142
Malicious:	false
Preview:	8000-1b000 r-xp 00000000 fd:00 531606 /tmp/Fantazy.arm4.elf.22000-23000 rw-p 00012000 fd:00 531606 /tmp/Fantazy.arm4.elf.23000-24000 rw-p 00000000 00:00 0 .24000-26000 rw-p 00000000 00:00 0 .ff7ef000-ff7f0000 ---p 00000000 00:00 0 .ff7f0000-ffff0000 rw-p 00000000 00:00 0 [stack].

/var/lib/AccountsService/users/gdm.5ZQPZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	678
Entropy (8bit):	4.77703951093466
Encrypted:	false
SSDEEP:	12:NF0hLadwFrjT4p1Wr4qF0nCLGaWr4LRF0hLajOpRFXZzfbZUQU:gj0pYr4nJr4qhrCQU
MD5:	0A776FD5D2247364EE70E4B8D8911D1D
SHA1:	83CEDF25DA74A75D157E5542EABF15EFF3C233B0
SHA-256:	5A4A5A536295D129F93D680354B5381DE8EBB6F8506C159B2BA3685690B6E1E8
SHA-512:	26C204B352F6FE53557A74BB4C6C3ADCEEBB5E6C16073334523AB46643586EAE34808FA9541F58E7170FAD1466B81CE8A58A3424650D8B259DBFE2FF6FECBDBF
Malicious:	false
Preview:	Jan 3 21:38:34 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Jan 3 21:38:34 galassia systemd-logind[6331]: Failed to start session scope session-c1.scope: Unit session-c1.scope already exists..Jan 3 21:38:34 galassia gdm-launch-environment]: pam_systemd(gdm-launch-environment:session): Failed to create session: Unit session-c1.scope already exists..Jan 3 21:38:35 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session closed for user gdm.Jan 3 21:38:43 galassia dbus-daemon[6315]: [system] Failed to activate service 'org.bluez': timed out (service_start_timeout=25000ms).

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4147139881914779
Encrypted:	false
SSDEEP:	3:F31Hl/MJhq7XPMJhq7n:F3UjAEjA
MD5:	A46437ACF670778A875B42B3C3F48779
SHA1:	97C4D70C274B9B25BFA6F22B6B536BECEF830564
SHA-256:	13BDB040F2CEDDC51BCDC7322F99B3D2BD8AE2B83D06312027D4BFA61C3B0698
SHA-512:	8A819DD2B3C2403A46033A618B04679C9FBABE4AF4628E0D4461807C0670627FC1F1E9DB1DD70FBA9B557C57A005DF34934F578DA13E3516D111B70B20B909D3
Malicious:	false
Preview:	LPKSHHRH......................L..e..........................................L..e............................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4313806548581445
Encrypted:	false
SSDEEP:	3:F31Hl5FS0AFS0mll/l:F3/S0oS0Sl/
MD5:	943B6F4B9164E5EEF1A3687F9F23EEB8
SHA1:	576007BED65C86812F29FE7E044481DBD787172C
SHA-256:	259A67C02C00BDF35C53D9BB84A34052387C311D8B18CEFBE009613BB256EAA6
SHA-512:	54E303337E8E00E8D84F54E2DA93FBD9D64F26BDD4697FD0626C1A70048912DA09A6CCD855D597F626DD3BE0FC8227E42CAF06BAFCA3F0FD5503F9008A070388
Malicious:	false
Preview:	LPKSHHRH..................-..?L..C..r^....................................-..?L..C..r^..........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	CSV text
Category:	dropped
Size (bytes):	6495
Entropy (8bit):	4.682952647105443
Encrypted:	false
SSDEEP:	96:DrfD1OhhK0eXyP5BNLDd2+ufkfuzL4esg1uN5p1:/LAhB+TWk4rTX
MD5:	0824C05E268756AC0C4A579A9F131D8B
SHA1:	33505C8AD3D3F9913B2365B8101E3F31A0F68431
SHA-256:	AA17D59D32B1F3442621B8AD1ABF809F84F201532AC21149BC7230B528300C8A
SHA-512:	43EEC1B5193576CFDCFEA072889E5AE3EC1CFB626A16DA1A79EF1AF17576414CD10407F117022326B3F81BE875EE5C1352F00F767E377689B5BBB33054D829AD
Malicious:	false
Preview:	Jan 3 21:38:18 galassia kernel: [ 441.450608] New task spawned: old: (tgid 6324, tid 6324), new (tgid: 6324, tid: 6397).Jan 3 21:38:18 galassia kernel: [ 443.467676] New task spawned: old: (tgid 6402, tid 6402), new (tgid: 6406, tid: 6406).Jan 3 21:38:18 galassia kernel: [ 443.538567] New task spawned: old: (tgid 6406, tid 6406), new (tgid: 6407, tid: 6407).Jan 3 21:38:18 galassia kernel: [ 443.782848] New task spawned: old: (tgid 6402, tid 6402), new (tgid: 6408, tid: 6408).Jan 3 21:38:18 galassia kernel: [ 443.830855] New task spawned: old: (tgid 6405, tid 6405), new (tgid: 6405, tid: 6409).Jan 3 21:38:18 galassia kernel: [ 443.831833] New task spawned: old: (tgid 6405, tid 6405), new (tgid: 6405, tid: 6410).Jan 3 21:38:18 galassia kernel: [ 443.837098] New task spawned: old: (tgid 6405, tid 6409), new (tgid: 6405, tid: 6411).Jan 3 21:38:18 galassia kernel: [ 443.851957] New task spawned: old: (tgid 6408, tid 6408), new (tgid: 6412, tid: 6412).Jan 3 21:38:18 galassia

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (317)
Category:	dropped
Size (bytes):	26872
Entropy (8bit):	4.963705984700437
Encrypted:	false
SSDEEP:	768:7M9QoFZHiKwsysrWKo38jf9VjvRwWaEm0wiGBF320IK0BdfljnZQWSsA6+EGPrRx:fX
MD5:	28F0629AB9A4ED7733EF2C39823B0C4D
SHA1:	984CCA93BBACE55D9CF5CC516275E5A3E2EA1125
SHA-256:	E9F150E8AF964B19BF1D9DB253CF73DA77296113056201BB8CE73F78463C80E7
SHA-512:	9CCED2BAF8D1EE9C094A7A04386EC81B1E9C82A904AC458295F6CD1AA2050728A5B7C916C198412B1891627C5C761A883460226085A9D0EB76E660884937567B
Malicious:	false
Preview:	Jan 3 21:38:17 galassia multipathd[658]: sda: add missing path.Jan 3 21:38:18 galassia kernel: [ 441.450608] New task spawned: old: (tgid 6324, tid 6324), new (tgid: 6324, tid: 6397).Jan 3 21:38:17 galassia multipathd[658]: sda: failed to get udev uid: Invalid argument.Jan 3 21:38:18 galassia kernel: [ 443.467676] New task spawned: old: (tgid 6402, tid 6402), new (tgid: 6406, tid: 6406).Jan 3 21:38:17 galassia multipathd[658]: sda: failed to get sysfs uid: Invalid argument.Jan 3 21:38:18 galassia kernel: [ 443.538567] New task spawned: old: (tgid 6406, tid 6406), new (tgid: 6407, tid: 6407).Jan 3 21:38:18 galassia kernel: [ 443.782848] New task spawned: old: (tgid 6402, tid 6402), new (tgid: 6408, tid: 6408).Jan 3 21:38:17 galassia multipathd[658]: sda: failed to get sgio uid: No such file or directory.Jan 3 21:38:18 galassia kernel: [ 443.830855] New task spawned: old: (tgid 6405, tid 6405), new (tgid: 6405, tid: 6409).Jan 3 21:38:18 galassia kernel: [ 443.831833] New

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:ns1sXlXEWtl/xlD4/:sQ+ylo/
MD5:	3AD404811F1EF93AD3D1AC8E16A59A5E
SHA1:	58D8A90470765750C60B5384FCD1EA458E30B642
SHA-256:	2266B5CBCEF20365F0F04E5ABD1AE92DA99E6F267FA17B0E76610E532F4AD828
SHA-512:	115E2531D798015C778F4BE9D218E20D4B8E09589BC8AACDFC27127D85FFC61FADD67EB373B9DF097058B70F3443128737B8D7133D704129EBDA475601A3ADE4
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................(.xg.8......................................

Source: Fantazy.arm4.elf	ReversingLabs: Detection: 68%
Source: Fantazy.arm4.elf	Virustotal: Detection: 57%			Perma Link

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	6.118837758820531
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Fantazy.arm4.elf
File size:	76'440 bytes
MD5:	60fa0a202c149e60c54744c0ba07f6b3
SHA1:	5e3b56939399180954a5732a955936dac50ff2d0
SHA256:	d644b15e365deffc71e2145536c5dc276a697d6f57e0a549c12ef4b532ce6fe3
SHA512:	8414bd68f93e23020545e3b3a2e16eac90677fbf6b639284a57f1257e84a314d3e9107310e0497b957ec77cffcc7458ad9478b1ad055e34cb4d6254d66d710cc
SSDEEP:	1536:kxEY01uNmZWlHT9+DJaRvdrXfU2/OHk8Bl5y:kxD01uN/A8vd7M2T8Bl5y
TLSH:	46730786BC40AA16D7C00777FE6F108E3314A7D9E1EA32029C256FA47B8ED2B0D67755
File Content Preview:	.ELF...a..........(.........4....)......4. ...(......................&...&...............&...&...&..,...............Q.td..................................-...L."....D..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	76040
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x11340	0x0	0x6	AX	16
.fini	PROGBITS	0x193f0	0x113f0	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x19404	0x11404	0x1294	0x0	0x2	A	4
.ctors	PROGBITS	0x2269c	0x1269c	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x226a4	0x126a4	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x226b0	0x126b0	0x218	0x0	0x3	WA	4
.bss	NOBITS	0x228c8	0x128c8	0x558	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x128c8	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x12698	0x12698	6.1389	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x1269c	0x2269c	0x2269c	0x22c	0x784	2.9632	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 4, 2025 04:38:16.446625948 CET	192.168.2.23	1.1.1.1	0x4736	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 4, 2025 04:38:16.446666002 CET	192.168.2.23	1.1.1.1	0x2575	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Jan 4, 2025 04:38:16.804157972 CET	192.168.2.23	1.1.1.1	0x7a7e	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 4, 2025 04:38:16.468106031 CET	1.1.1.1	192.168.2.23	0x4736	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Jan 4, 2025 04:38:16.468106031 CET	1.1.1.1	192.168.2.23	0x4736	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2025-01-04 03:38:20 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2025-01-04 03:38:20 UTC	25	IN	HTTP/1.1 100 Continue
2025-01-04 03:38:20 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2025-01-04 03:38:20 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2025-01-04 03:38:20 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2025-01-04 03:38:20 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2025-01-04 03:38:20 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2025-01-04 03:38:20 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2025-01-04 03:38:20 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2025-01-04 03:38:20 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2025-01-04 03:38:20 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2025-01-04 03:38:20 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2025-01-04 03:38:20 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Sat, 04 Jan 2025 03:38:20 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	03:37:47
Start date (UTC):	04/01/2025
Path:	/tmp/Fantazy.arm4.elf
Arguments:	/tmp/Fantazy.arm4.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	03:37:54
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	03:37:56
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	03:38:13
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	03:38:14
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	03:38:15
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	03:38:16
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	03:38:17
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	03:38:18
Start date (UTC):	04/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	03:38:19
Start date (UTC):	04/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	03:38:20
Start date (UTC):	04/01/2025
Path:	/usr/share/gdm/generate-config
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	03:38:22
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Fantazy.arm4.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6468/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:75579k0KYUQ

/run/systemd/journal/streams/.#9:75582OHyCWP

/run/systemd/journal/streams/.#9:76009pRyorO

/run/systemd/journal/streams/.#9:76041f4s8qR

/run/systemd/journal/streams/.#9:76060PfzFuP

/run/systemd/journal/streams/.#9:76072gtYxcQ

/run/systemd/journal/streams/.#9:76082WYzfHP

/run/systemd/journal/streams/.#9:77078IDFVtP

/run/systemd/journal/streams/.#9:77079Ayu7dQ

/run/systemd/journal/streams/.#9:7709920mBPQ

/run/systemd/journal/streams/.#9:77214vXGAPN

/run/systemd/journal/streams/.#9:775000JkmgP

/run/systemd/journal/streams/.#9:77503PWWwbS

/run/systemd/journal/streams/.#9:77671V2LPDP

/run/systemd/journal/streams/.#9:77680CVlH0O

/run/systemd/journal/streams/.#9:78155inkhqP

/run/systemd/journal/streams/.#9:78225DQalkQ

/run/systemd/journal/streams/.#9:78227D0P4BR

/run/systemd/journal/streams/.#9:78263T46iYR

/run/systemd/journal/streams/.#9:782693WP3lQ

/run/systemd/seats/.#seat0Wfb4AU

/run/systemd/seats/.#seat0mZB9SW

/run/systemd/users/.#1279pKMeV

/run/systemd/users/.#127aBIZSU

/run/systemd/users/.#127mreoUT

/run/systemd/users/.#127uPA7EU

/run/systemd/users/.#127w5SOWU

/run/systemd/users/.#127z0Ed5U

Linux Analysis Report
Fantazy.arm4.elf

Start time (UTC):	03:38:32
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	03:38:33
Start date (UTC):	04/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	03:38:34
Start date (UTC):	04/01/2025
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	03:38:35
Start date (UTC):	04/01/2025
Path:	/usr/bin/dbus-run-session
Arguments:	-
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4

Start time (UTC):	03:38:56
Start date (UTC):	04/01/2025
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre