Edit tour

Linux Analysis Report
Fantazy.mpsl.elf

Overview

General Information

Sample name:	Fantazy.mpsl.elf
Analysis ID:	1584048
MD5:	c405fb4133dc722a54f3507c538efc9c
SHA1:	0b63fd16a318b87f65c23b42295e0008f9ec883e
SHA256:	f5c7799d61d4078d760f92fe987903f46d3dbc6f4614a0cdf48922be21ed14ba
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584048
Start date and time:	2025-01-04 04:42:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Fantazy.mpsl.elf
Detection:	MAL
Classification:	mal68.spre.troj.linELF@0/42@3/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing network information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/Fantazy.mpsl.elf
PID:	6243
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	VegaSec-KATANA001
Standard Error:

Process Tree

system is lnxubuntu20

Fantazy.mpsl.elf (PID: 6243, Parent: 6159, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/Fantazy.mpsl.elf

Fantazy.mpsl.elf New Fork (PID: 6245, Parent: 6243)

Fantazy.mpsl.elf New Fork (PID: 6246, Parent: 6243)

Fantazy.mpsl.elf New Fork (PID: 6249, Parent: 6246)

Fantazy.mpsl.elf New Fork (PID: 6250, Parent: 6246)

Fantazy.mpsl.elf New Fork (PID: 6252, Parent: 6246)

systemd New Fork (PID: 6258, Parent: 1)

journalctl (PID: 6258, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6276, Parent: 1)

systemd-journald (PID: 6276, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6278, Parent: 1)

journalctl (PID: 6278, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6334, Parent: 1)

dbus-daemon (PID: 6334, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gdm3 New Fork (PID: 6343, Parent: 1320)

Default (PID: 6343, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6345, Parent: 1320)

Default (PID: 6345, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6346, Parent: 1320)

Default (PID: 6346, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6347, Parent: 1860)

pulseaudio (PID: 6347, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6350, Parent: 1)

rtkit-daemon (PID: 6350, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6353, Parent: 1)

systemd-logind (PID: 6353, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6415, Parent: 1)

polkitd (PID: 6415, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6421, Parent: 1)

gpu-manager (PID: 6421, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6423, Parent: 6421)

sh (PID: 6423, Parent: 6421, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6424, Parent: 6423)

grep (PID: 6424, Parent: 6423, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6425, Parent: 6421)

sh (PID: 6425, Parent: 6421, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6428, Parent: 6425)

grep (PID: 6428, Parent: 6425, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6429, Parent: 6421)

sh (PID: 6429, Parent: 6421, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6430, Parent: 6429)

grep (PID: 6430, Parent: 6429, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6431, Parent: 6421)

sh (PID: 6431, Parent: 6421, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6432, Parent: 6431)

grep (PID: 6432, Parent: 6431, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6433, Parent: 6421)

sh (PID: 6433, Parent: 6421, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6434, Parent: 6433)

grep (PID: 6434, Parent: 6433, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6436, Parent: 6421)

sh (PID: 6436, Parent: 6421, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6437, Parent: 6436)

grep (PID: 6437, Parent: 6436, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6441, Parent: 6421)

sh (PID: 6441, Parent: 6421, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6442, Parent: 6441)

grep (PID: 6442, Parent: 6441, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6443, Parent: 6421)

sh (PID: 6443, Parent: 6421, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6444, Parent: 6443)

grep (PID: 6444, Parent: 6443, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6422, Parent: 1)

agetty (PID: 6422, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6435, Parent: 1)

rsyslogd (PID: 6435, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6447, Parent: 1)

generate-config (PID: 6447, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6448, Parent: 6447)

pkill (PID: 6448, Parent: 6447, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6452, Parent: 1)

gdm-wait-for-drm (PID: 6452, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6457, Parent: 1)

gdm3 (PID: 6457, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6462, Parent: 6457)

plymouth (PID: 6462, Parent: 6457, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6479, Parent: 6457)

gdm-session-worker (PID: 6479, Parent: 6457, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6483, Parent: 6479)

gdm-wayland-session (PID: 6483, Parent: 6479, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6485, Parent: 6483)

dbus-daemon (PID: 6485, Parent: 6483, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6487, Parent: 6485)

dbus-daemon New Fork (PID: 6488, Parent: 6487)

false (PID: 6488, Parent: 6487, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6489, Parent: 6483)

dbus-run-session (PID: 6489, Parent: 6483, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6490, Parent: 6489)

dbus-daemon (PID: 6490, Parent: 6489, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6491, Parent: 6457)

Default (PID: 6491, Parent: 6457, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6492, Parent: 6457)

Default (PID: 6492, Parent: 6457, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6463, Parent: 1)

accounts-daemon (PID: 6463, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6474, Parent: 6463)

language-validate (PID: 6474, Parent: 6463, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6475, Parent: 6474)

language-options (PID: 6475, Parent: 6474, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6476, Parent: 6475)

sh (PID: 6476, Parent: 6475, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6477, Parent: 6476)

locale (PID: 6477, Parent: 6476, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6478, Parent: 6476)

grep (PID: 6478, Parent: 6476, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

gvfsd-fuse New Fork (PID: 6505, Parent: 2038)

fusermount (PID: 6505, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6546, Parent: 1860)

dbus-daemon (PID: 6546, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6435)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /tmp/Fantazy.mpsl.elf (PID: 6243)	Socket: 127.0.0.1:59025	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6457)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6485)	Socket: unknown address family	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.243
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.243
Source: unknown	TCP traffic detected without corresponding DNS query: 151.96.225.91
Source: unknown	TCP traffic detected without corresponding DNS query: 201.56.194.9
Source: unknown	TCP traffic detected without corresponding DNS query: 194.126.84.65
Source: unknown	TCP traffic detected without corresponding DNS query: 72.45.183.228
Source: unknown	TCP traffic detected without corresponding DNS query: 42.0.23.32
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.180.31
Source: unknown	TCP traffic detected without corresponding DNS query: 71.160.52.120
Source: unknown	TCP traffic detected without corresponding DNS query: 192.52.40.204
Source: unknown	TCP traffic detected without corresponding DNS query: 72.142.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 23.139.26.221
Source: unknown	TCP traffic detected without corresponding DNS query: 94.92.169.220
Source: unknown	TCP traffic detected without corresponding DNS query: 35.225.145.118
Source: unknown	TCP traffic detected without corresponding DNS query: 186.179.143.237
Source: unknown	TCP traffic detected without corresponding DNS query: 97.130.244.148
Source: unknown	TCP traffic detected without corresponding DNS query: 27.66.68.10
Source: unknown	TCP traffic detected without corresponding DNS query: 209.142.133.45
Source: unknown	TCP traffic detected without corresponding DNS query: 195.170.132.3
Source: unknown	TCP traffic detected without corresponding DNS query: 172.103.173.17
Source: unknown	TCP traffic detected without corresponding DNS query: 202.156.40.146
Source: unknown	TCP traffic detected without corresponding DNS query: 80.92.35.202
Source: unknown	TCP traffic detected without corresponding DNS query: 218.67.207.134
Source: unknown	TCP traffic detected without corresponding DNS query: 162.170.6.168
Source: unknown	TCP traffic detected without corresponding DNS query: 79.1.175.144
Source: unknown	TCP traffic detected without corresponding DNS query: 44.17.92.200
Source: unknown	TCP traffic detected without corresponding DNS query: 207.216.64.50
Source: unknown	TCP traffic detected without corresponding DNS query: 158.146.198.247
Source: unknown	TCP traffic detected without corresponding DNS query: 123.37.220.156
Source: unknown	TCP traffic detected without corresponding DNS query: 113.167.207.144
Source: unknown	TCP traffic detected without corresponding DNS query: 209.16.28.67
Source: unknown	TCP traffic detected without corresponding DNS query: 189.69.20.196
Source: unknown	TCP traffic detected without corresponding DNS query: 117.52.164.207
Source: unknown	TCP traffic detected without corresponding DNS query: 200.60.176.178
Source: unknown	TCP traffic detected without corresponding DNS query: 216.52.44.245
Source: unknown	TCP traffic detected without corresponding DNS query: 125.11.145.238
Source: unknown	TCP traffic detected without corresponding DNS query: 20.172.124.39
Source: unknown	TCP traffic detected without corresponding DNS query: 125.232.233.181
Source: unknown	TCP traffic detected without corresponding DNS query: 69.54.156.57
Source: unknown	TCP traffic detected without corresponding DNS query: 197.111.109.136
Source: unknown	TCP traffic detected without corresponding DNS query: 31.181.190.220
Source: unknown	TCP traffic detected without corresponding DNS query: 44.60.132.77
Source: unknown	TCP traffic detected without corresponding DNS query: 106.112.170.44
Source: unknown	TCP traffic detected without corresponding DNS query: 59.153.248.255
Source: unknown	TCP traffic detected without corresponding DNS query: 41.85.142.43
Source: unknown	TCP traffic detected without corresponding DNS query: 179.92.250.14
Source: unknown	TCP traffic detected without corresponding DNS query: 54.141.125.193
Source: unknown	TCP traffic detected without corresponding DNS query: 38.113.169.169
Source: unknown	TCP traffic detected without corresponding DNS query: 47.223.54.1
Source: unknown	TCP traffic detected without corresponding DNS query: 115.152.32.39

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.65.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53702
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 6062, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 6226, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 6227, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 6246, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 6250, result: unknown	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 6062, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 6226, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 6227, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 6246, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6250)	SIGKILL sent: pid: 6250, result: unknown	Jump to behavior

Source: classification engine

Classification label: mal68.spre.troj.linELF@0/42@3/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6334)	File: /proc/6334/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6485)	File: /proc/6485/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6505)	File: /proc/6505/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6546)	File: /proc/6546/mounts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6276)	File: /run/systemd/journal/streams/.#9:747096lW2jN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File: /run/systemd/journal/streams/.#9:74714hh0P3J	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File: /run/systemd/journal/streams/.#9:75967e2do7M	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File: /run/systemd/journal/streams/.#9:75998ADQkLL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File: /run/systemd/journal/streams/.#9:76002m3MJKJ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File: /run/systemd/journal/streams/.#9:76174rjNFBM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File: /run/systemd/journal/streams/.#9:76175J0Y4HL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File: /run/systemd/journal/streams/.#9:76201ycEAhM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File: /run/systemd/journal/streams/.#9:7658541icuM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File: /run/systemd/journal/streams/.#9:76685HOa24M	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File: /run/systemd/journal/streams/.#9:767812ykKmM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File: /run/systemd/journal/streams/.#9:77555RMrB1I	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File: /run/systemd/journal/streams/.#9:77606vT2cuM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File: /run/systemd/journal/streams/.#9:777219IF8UK	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File: /run/systemd/journal/streams/.#9:779855OHsEN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File: /run/systemd/journal/streams/.#9:77986C13UdN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File: /run/systemd/journal/streams/.#9:78000ZpX91M	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File: /run/systemd/journal/streams/.#9:780010hKjjN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File: /run/systemd/journal/streams/.#9:78112Kd6bJL	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6353)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6353)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6353)	File: /run/systemd/seats/.#seat0yFDbwB	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6353)	File: /run/systemd/users/.#127wo5AzC	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6353)	File: /run/systemd/users/.#127SzS1nA	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6353)	File: /run/systemd/seats/.#seat0gmqKSz	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6353)	File: /run/systemd/users/.#127OGhNUA	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6353)	File: /run/systemd/users/.#127soq1cy	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6353)	File: /run/systemd/users/.#127oKN3BB	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6415)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6483)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6463)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6463)	Directory: /root/.cache	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6350/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6350/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6350/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6350/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6350/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6350/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6350/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6350/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6350/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6350/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6350/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6350/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6350/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6350/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6276/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6276/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6276/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6276/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6276/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6276/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6353/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6353/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6353/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6353/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6353/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6353/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6353/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6353/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6353/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6353/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6353/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6353/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6353/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/6353/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2078/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2078/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2078/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2078/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2078/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2078/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2078/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2077/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2077/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2077/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2077/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2077/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2077/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2077/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2033/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2033/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2033/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2033/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2033/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2033/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2033/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2074/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2074/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2074/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2074/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2074/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2074/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2074/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1532/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1532/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1532/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1532/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1532/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1532/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1532/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1334/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1334/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	File opened: /proc/1334/cgroup	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6423)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6425)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6429)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6431)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6433)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6436)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6441)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6443)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6476)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Source: /bin/sh (PID: 6424)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6428)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6430)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6432)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6434)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6437)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6442)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6444)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6478)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6448)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6276)

Reads from proc file: /proc/meminfo

Jump to behavior

Source: /sbin/agetty (PID: 6422)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6457)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6457)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6463)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6463)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6421)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6435)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6435)	Log file created: /var/log/auth.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 6421)

Truncated file: /var/log/gpu-manager.log

Jump to behavior

Source: /usr/bin/pulseaudio (PID: 6347)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pkill (PID: 6448)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /tmp/Fantazy.mpsl.elf (PID: 6243)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6276)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6347)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6421)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6422)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6435)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6479)	Queries kernel information via 'uname':	Jump to behavior

Source: Fantazy.mpsl.elf, 6243.1.0000559782a4b000.0000559782ad2000.rw-.sdmp, Fantazy.mpsl.elf, 6245.1.0000559782a4b000.0000559782ad2000.rw-.sdmp, Fantazy.mpsl.elf, 6246.1.0000559782a4b000.0000559782ad2000.rw-.sdmp, Fantazy.mpsl.elf, 6249.1.0000559782a4b000.0000559782ad2000.rw-.sdmp, Fantazy.mpsl.elf, 6250.1.0000559782a4b000.0000559782ad2000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mipsel
Source: Fantazy.mpsl.elf, 6250.1.00007ffc5007f000.00007ffc500a0000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.7rlszP
Source: syslog.65.dr	Binary or memory string: Jan 3 21:43:38 galassia kernel: [ 463.134732] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: Fantazy.mpsl.elf, 6243.1.0000559782a4b000.0000559782ad2000.rw-.sdmp, Fantazy.mpsl.elf, 6245.1.0000559782a4b000.0000559782ad2000.rw-.sdmp, Fantazy.mpsl.elf, 6246.1.0000559782a4b000.0000559782ad2000.rw-.sdmp, Fantazy.mpsl.elf, 6249.1.0000559782a4b000.0000559782ad2000.rw-.sdmp, Fantazy.mpsl.elf, 6250.1.0000559782a4b000.0000559782ad2000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mipsel
Source: Fantazy.mpsl.elf, 6243.1.00007ffc5007f000.00007ffc500a0000.rw-.sdmp, Fantazy.mpsl.elf, 6245.1.00007ffc5007f000.00007ffc500a0000.rw-.sdmp, Fantazy.mpsl.elf, 6246.1.00007ffc5007f000.00007ffc500a0000.rw-.sdmp, Fantazy.mpsl.elf, 6249.1.00007ffc5007f000.00007ffc500a0000.rw-.sdmp, Fantazy.mpsl.elf, 6250.1.00007ffc5007f000.00007ffc500a0000.rw-.sdmp	Binary or memory string: $x86_64/usr/bin/qemu-mipsel/tmp/Fantazy.mpsl.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Fantazy.mpsl.elf
Source: syslog.65.dr	Binary or memory string: Jan 3 21:43:38 galassia kernel: [ 463.134755] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: Fantazy.mpsl.elf, 6243.1.00007ffc5007f000.00007ffc500a0000.rw-.sdmp, Fantazy.mpsl.elf, 6245.1.00007ffc5007f000.00007ffc500a0000.rw-.sdmp, Fantazy.mpsl.elf, 6246.1.00007ffc5007f000.00007ffc500a0000.rw-.sdmp, Fantazy.mpsl.elf, 6249.1.00007ffc5007f000.00007ffc500a0000.rw-.sdmp, Fantazy.mpsl.elf, 6250.1.00007ffc5007f000.00007ffc500a0000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mipsel
Source: Fantazy.mpsl.elf, 6250.1.00007ffc5007f000.00007ffc500a0000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.7rlszP@

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6463)

Logged in records file read: /var/log/wtmp

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Fantazy.mpsl.elf	61%	ReversingLabs	Linux.Trojan.Mirai
Fantazy.mpsl.elf	100%	Avira	EXP/ELF.Gafgyt.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.65.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
66.157.202.104	unknown	United States	7018	ATT-INTERNET4US	false
181.161.151.69	unknown	Chile	7418	TELEFONICACHILESACL	false
166.70.225.11	unknown	United States	6315	XMISSIONUS	false
96.52.82.228	unknown	Canada	6327	SHAWCA	false
172.39.133.12	unknown	United States	21928	T-MOBILE-AS21928US	false
158.70.247.117	unknown	United States	7046	RFC2270-UUNET-CUSTOMERUS	false
64.236.101.254	unknown	United States	7029	WINDSTREAMUS	false
151.222.212.203	unknown	unknown	11003	PANDGUS	false
166.135.37.54	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
90.24.246.34	unknown	France	3215	FranceTelecom-OrangeFR	false
210.119.127.220	unknown	Korea Republic of	17579	KREONET2-AS-KRKISTIKR	false
163.112.118.129	unknown	France	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
172.14.34.216	unknown	United States	7018	ATT-INTERNET4US	false
208.172.153.60	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
4.196.71.113	unknown	United States	3356	LEVEL3US	false
5.101.119.62	unknown	Estonia	198068	PAGM-ASEE	false
82.184.121.94	unknown	Italy	3269	ASN-IBSNAZIT	false
190.219.200.228	unknown	Panama	18809	CableOndaPA	false
68.225.100.58	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
121.115.241.3	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
44.159.165.138	unknown	United States	62383	LDS-ASBE	false
201.79.114.190	unknown	Brazil	7738	TelemarNorteLesteSABR	false
189.14.5.44	unknown	Brazil	22689	SercomtelParticipacoesSABR	false
60.27.233.7	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
212.93.131.39	unknown	Romania	8708	RCS-RDS73-75DrStaicoviciRO	false
154.255.108.33	unknown	Algeria	36947	ALGTEL-ASDZ	false
157.157.88.28	unknown	Iceland	6677	ICENET-AS1IS	false
220.56.125.43	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
39.119.210.47	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
205.224.228.198	unknown	United States	3356	LEVEL3US	false
71.68.172.72	unknown	United States	11426	TWC-11426-CAROLINASUS	false
122.161.132.171	unknown	India	24560	AIRTELBROADBAND-AS-APBhartiAirtelLtdTelemediaServices	false
41.157.54.10	unknown	South Africa	37168	CELL-CZA	false
171.107.136.189	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
120.43.64.244	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
75.53.8.24	unknown	United States	7018	ATT-INTERNET4US	false
120.214.231.41	unknown	China	24445	CMNET-V4HENAN-AS-APHenanMobileCommunicationsCoLtdCN	false
87.177.81.180	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
93.39.18.230	unknown	Italy	12874	FASTWEBIT	false
79.63.129.114	unknown	Italy	3269	ASN-IBSNAZIT	false
108.45.255.167	unknown	United States	701	UUNETUS	false
177.5.176.244	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
48.144.192.85	unknown	United States	2686	ATGS-MMD-ASUS	false
65.144.3.207	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
147.75.37.61	unknown	Switzerland	54825	PACKETUS	false
106.37.167.255	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
120.63.124.65	unknown	India	17813	MTNL-APMahanagarTelephoneNigamLimitedIN	false
221.227.42.77	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
202.220.213.126	unknown	Japan	2514	INFOSPHERENTTPCCommunicationsIncJP	false
27.227.101.34	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
107.234.192.92	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
103.71.9.248	unknown	Indonesia	55662	IDNIC-CITRAWEB-AS-IDCVCITRAWEBNUSAINFOMEDIAID	false
53.3.252.11	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
53.210.65.85	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
107.117.133.6	unknown	United States	7018	ATT-INTERNET4US	false
179.72.253.226	unknown	Brazil	26615	TIMSABR	false
218.171.117.202	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
147.166.125.246	unknown	United States	1452	DNIC-ASBLK-01451-01456US	false
171.127.148.182	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
59.44.39.149	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
176.73.164.76	unknown	Georgia	20771	CAUCASUS-CABLE-SYSTEMCCSAutonomousSystemGE	false
210.104.183.46	unknown	Korea Republic of	9647	SEOULMETRO-ASSeoulMetropolitanGovernmentKR	false
2.63.123.216	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
40.0.171.193	unknown	United States	4249	LILLY-ASUS	false
77.136.235.75	unknown	France	15557	LDCOMNETFR	false
135.55.81.255	unknown	United States	18676	AVAYAUS	false
111.65.146.247	unknown	Korea Republic of	17573	MINS-AS-KRTBroadKR	false
159.148.251.207	unknown	Latvia	2588	LATNET-ASLV	false
213.170.233.169	unknown	Spain	29119	SERVIHOSTING-ASAireNetworksES	false
17.149.252.230	unknown	United States	714	APPLE-ENGINEERINGUS	false
109.46.108.4	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
165.19.100.247	unknown	United States	37284	Aljeel-netLY	false
59.63.15.37	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
163.82.23.140	unknown	France	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
208.29.173.87	unknown	United States	4133	BITWISEUS	false
194.162.163.238	unknown	Germany	12312	ECOTELDE	false
141.163.238.65	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
42.238.152.202	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
176.198.227.231	unknown	Germany	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
47.85.250.35	unknown	United States	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
157.15.238.229	unknown	unknown	2512	TCP-NETTCPIncJP	false
32.130.150.26	unknown	United States	2686	ATGS-MMD-ASUS	false
168.120.19.242	unknown	Thailand	4274	ERX-AU-NETAssumptionUniversityTH	false
104.186.136.213	unknown	United States	7018	ATT-INTERNET4US	false
151.70.50.172	unknown	Italy	1267	ASN-WINDTREIUNETEU	false
83.250.34.148	unknown	Sweden	39651	COMHEM-SWEDENSE	false
109.81.205.1	unknown	Czech Republic	5610	O2-CZECH-REPUBLICCZ	false
188.233.32.93	unknown	Russian Federation	39435	EVOLGOGRAD-ASRU	false
156.168.179.36	unknown	Egypt	36992	ETISALAT-MISREG	false
20.92.77.27	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
117.221.171.196	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
89.169.70.231	unknown	Russian Federation	31514	INF-NET-ASRU	false
211.0.195.196	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
154.171.97.181	unknown	Ghana	30986	SCANCOMGH	false
192.0.94.57	unknown	United States	2635	AUTOMATTICUS	false
153.72.76.60	unknown	United States	14962	NCR-252US	false
63.175.249.73	unknown	United States	1239	SPRINTLINKUS	false
191.229.15.154	unknown	Brazil	26615	TIMSABR	false
66.28.124.96	unknown	United States	174	COGENT-174US	false
81.73.246.37	unknown	Italy	3269	ASN-IBSNAZIT	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
189.14.5.44	whoareyou.x86	Get hash	malicious	Mirai	Browse
157.157.88.28	hmips.elf	Get hash	malicious	Mirai	Browse
82.184.121.94	nklmpsl.elf	Get hash	malicious	Unknown	Browse
39.119.210.47	HHkVumP4W7.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	Fantazy.arm4.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	sshd.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	jklarm.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Josho.x86.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	185.232.205.45-boatnet.ppc-2025-01-03T23_59_48.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	185.232.205.45-boatnet.spc-2025-01-03T23_59_48.elf	Get hash	malicious	Mirai	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
XMISSIONUS	telnet.arm.elf	Get hash	malicious	Unknown	Browse	166.70.26.8
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse	166.71.105.45
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	166.70.38.130
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	166.70.47.169
	yakuza.mipsel.elf	Get hash	malicious	Mirai	Browse	207.135.135.32
	meerkat.mips.elf	Get hash	malicious	Mirai	Browse	166.70.201.48
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	166.70.47.142
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	166.71.189.219
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	207.135.135.32
	na.elf	Get hash	malicious	Mirai, Moobot	Browse	166.70.225.148
ATT-INTERNET4US	Fantazy.ppc.elf	Get hash	malicious	Unknown	Browse	99.161.251.67
	Fantazy.arm4.elf	Get hash	malicious	Unknown	Browse	69.230.36.212
	Josho.x86.elf	Get hash	malicious	Unknown	Browse	107.128.195.122
	31.13.224.14-mips-2025-01-03T22_14_18.elf	Get hash	malicious	Mirai	Browse	107.74.85.3
	31.13.224.14-x86-2025-01-03T22_14_18.elf	Get hash	malicious	Mirai	Browse	107.121.48.179
	1.elf	Get hash	malicious	Unknown	Browse	107.72.60.192
	3.elf	Get hash	malicious	Unknown	Browse	68.254.2.61
	1.elf	Get hash	malicious	Unknown	Browse	99.0.110.133
	armv5l.elf	Get hash	malicious	Mirai	Browse	12.234.169.84
	armv7l.elf	Get hash	malicious	Mirai	Browse	45.26.62.121
SHAWCA	armv6l.elf	Get hash	malicious	Mirai	Browse	50.70.115.235
	armv5l.elf	Get hash	malicious	Mirai	Browse	50.67.85.217
	1.elf	Get hash	malicious	Unknown	Browse	70.71.46.129
	DEMONS.arm.elf	Get hash	malicious	Unknown	Browse	184.69.183.220
	Hilix.sh4.elf	Get hash	malicious	Mirai	Browse	70.77.98.166
	armv6l.elf	Get hash	malicious	Unknown	Browse	24.70.138.154
	DF2.exe	Get hash	malicious	Unknown	Browse	68.149.143.121
	kwari.arm.elf	Get hash	malicious	Unknown	Browse	50.64.55.68
	vcimanagement.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.11.23.22
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	24.64.127.0
TELEFONICACHILESACL	loligang.ppc.elf	Get hash	malicious	Mirai	Browse	186.108.50.83
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	152.173.168.66
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	191.127.26.41
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	186.106.205.57
	xd.ppc.elf	Get hash	malicious	Mirai	Browse	191.115.92.11
	armv7l.elf	Get hash	malicious	Mirai	Browse	181.163.59.43
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	181.162.230.9
	loligang.mips.elf	Get hash	malicious	Mirai	Browse	181.162.253.201
	jklmpsl.elf	Get hash	malicious	Unknown	Browse	181.161.163.49
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	181.163.35.81

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/6488/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:5:5
MD5:	11746B75ED1EA25A0778919FD973807D
SHA1:	0403DCADD678688D87F21DCD1FB1F473D99E7067
SHA-256:	3E7433F2F29338D7F3480BD5B8F4BE1940373CE56C275FA08FF58A6C93529EF4
SHA-512:	668BF37DD9F9EEC9A5BA164D5FD3E5DCBAD1A47C1972228B8C2D7D2AA52116F28959CDED06DADDA39E7C2472CF45D4651667BDD34407CA7400765D4F7CB3D1E3
Malicious:	false
Reputation:	low
Preview:	6457.

/run/systemd/journal/streams/.#9:747096lW2jN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.558391366738943
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmodkcjRQ+XfVpB9ls+:SbFuFyLVIg1BG+f+ModVj2o/2ji4s
MD5:	085FC037ED6050416118DC82D2A5956C
SHA1:	EB2545DB3CAD55F3AA19D833C2B7D319F7DB1073
SHA-256:	53A7E7DC39D3D953773B095D82CA1B54D26EAF9B987638694CC8DC66581B6D79
SHA-512:	9A8B01FBBDDEDE374F5191FDFCE1D080F0BAC10FB82A9742B5B14DFA995E7BF4207E8E51946466FC26AD1B6483B0C820ED3B665A7FDA0957A079942F887D9E23
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b596d7997457482fa8b8c370d8c2c4d2.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:74714hh0P3J

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.545661588526971
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/dIl1WkRdj0Mqjs77:SbFuFyLVIg1BG+f+Mil1WK0Mqji4s
MD5:	00CE7602B233C07E04D21C0F318411E2
SHA1:	E789EF8EFAFABBF119E2C99961FE284AA0BB6D42
SHA-256:	CEBE2EC00B0ACF9E12B7D1B2A3F32173F0BCD884A28DC3EBD248EDBAA2A0AE60
SHA-512:	358348CC821588C3BCCB8C01A066BFFFD9FEDE3C35EE25C19D1A461CF697948E631282B8D60E41A0FA25E5154449B3831AE1D53C4C4BD38A39F0941CEDA7A45D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5f1af6fbdcb3483bb03cbd7f1689a297.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:75967e2do7M

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.455450391980306
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyoRQGBhSW4D2js1Ha:SbFuFyLVIg1BG+f+MyRGr22josQu
MD5:	F3306C71EEB77248B0C2D6DFC3930712
SHA1:	D0D858F3B126A092EB81121C1F00F3523D555CD0
SHA-256:	54B9576C9D28DE60062E6EE28F38AF12822D262F0E96E552C300A23A08632080
SHA-512:	87BA6A89CEFEA7B036DC38F8444D34678BD69064D5111C31ACE15BD6BFB8C9E841D1B42CA6C40316F52F8A658F03C5383DA8CFE53AAFD7A1DEDC48496C51FE78
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8af68632cfd749ce9573912f43fd40df.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:75998ADQkLL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.363284323743445
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9w/fDVsskqjsmNz0/:SbFuFyLVIg1BG+f+M2/f+yjdCLKzK
MD5:	A0071E67527CA855E60075AD4580314C
SHA1:	5C1790D51F3A4ABE9E9B2F6D17CFC9D73BDE6143
SHA-256:	603ADB476BF51679688AEE6EEAAF4741E86CA6711DF55DD1B350CC30F8CFEA4E
SHA-512:	8BCF98B37B0C935ECD04DD681A4530727C5246A1674B853E8542571B4EC4A10F75E9007479E921FD06DC4015853D7D496E256991D407BC658E9E2A10BE8FB24A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7cffeaff0827449084008dd049b0c6c6.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:76002m3MJKJ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.387609112708439
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmscRREWODKjshQJWL0:SbFuFyLVIg1BG+f+Ms+nOGjtWL0
MD5:	366BFF01619C70CA34668F4EF15CF479
SHA1:	EE346DE2AEAE5BFC2C4166E1D8FA211279522558
SHA-256:	CB0A30415596F44EF1FDF01C3B62718CA6A37A918B44A3B157F5C441FBAC5E69
SHA-512:	630739A70EDDF49C18AD0B94E54782D622FE61C49570E9FC125DE11C9968E66E2B16A438FCBD88AFC02279042BCDD348BCBD9AF296F8A48DF51280C534466F26
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f05bfbc732cb473486a9338d7fd4c45d.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:76174rjNFBM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.4423173911328036
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7tQXi/z56F2jsjOdy:SbFuFyLVIg1BG+f+MpQXj8jNE
MD5:	5037AB46A927CD1B19F6635311C9A064
SHA1:	4E176C75E740309A3A1E300EB6E4FB5D07490E38
SHA-256:	A536D1386E5A5B85B49BDD1DFB44716B1C81177BB0C018F719496CE0D4EBBB6B
SHA-512:	DA6446FE9698CD70C41D82A8D51BB31273463C279C6574E04C76FBB0118125C19C6B94F4A1B7CA34C1AEC630FC1CC031980401DF74F09DFF0EC211C0612D69AA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=158f7523a45a40c9961ed1290648c91d.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:76175J0Y4HL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.461010451795991
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M8mBEBJ2jZcHcljX+:qgFq6g10+f+M8wmAu
MD5:	516533864D7F6DF468A5B5D0D35BAF37
SHA1:	BCE3616145E1850D95CB72DDF38779056256330E
SHA-256:	6CF18BBCC5328598E9B9F75FDB0B6C1B67D047FFEC41E8FA1B6733C41CFBD235
SHA-512:	163CA644F7F9332A3594EE7955C75AAFBEBE3FCCF80DE8B7C9EA0A629CB7C979BDEC2E5F4B50FDC8E8AAA3E9D377664A1953A40D6BB6E60708CCFE9DF8A063E6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6c4b4f88e33548ef8049e49bdb5c3ddb.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:76201ycEAhM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.370737048500084
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpLI1D38AyYgrqjshP:SbFuFyLVIg1BG+f+MoD38AnjbVC
MD5:	D944FCEBF322AD2A391D87FC44F8A8D7
SHA1:	9A3FD4A430CA1D63066D3061094F5253FF1BA912
SHA-256:	272285CF9E3711A2362430EE8E499AD642CF7254EFCCE60167668CEB538D2E1C
SHA-512:	01460F92230F5BE1D8FCE76747E523DEAE82663F5A8BD6DE10D22DEC1DA7A40D5EC0F0AD99CD8349814408E50B5A76CEB060FD91E369F926C82E92E70A49DEDD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c6bf1333ef3f4d20ad89d036dfad0a58.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:7658541icuM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.424910962997265
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmztycKewVqjs2ALAXaGS:SbFuFyLVIg1BAf+MVjNALyAZD
MD5:	A3AE1968539FF8EA752530810272936F
SHA1:	3ED965F1957BD74C21BADE3C349CF53559EDFA77
SHA-256:	A1DFA46785EAF72CC71953F7037AFE2B4E68938026B2C20A4F9995CA35F053E2
SHA-512:	0A0F0F44A3A90DFD018A0BB149FC7CBC3C0D49FDFAF0834F5C7295C4EFEAB1D4CB73BD8118B9908F53EC3F949FEB3AD3FAA04211C5955ECC4B6B6DBC1CF6474B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9c6adcf954cc4d909d3c686750735436.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76685HOa24M

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.45022449875477
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MocLwW6N2jdCt/rRMtq:qgFq6g10+f+MocLwW6NcCDL
MD5:	9CF32F2CBCD1A68EB0D89B36A26D4916
SHA1:	C4ECC7B5A1AEA133EB55B4927F71BA8E51101FD3
SHA-256:	DC19FB5BB8F350C4EFB00BC5FE10BF45DC807873AE8A9C2100B4F378D27951EA
SHA-512:	A8EF6234BF9E48DFE9D4765B040CF272A27BC91B794E02BF900BDC6F59470F56DC39BD83619E7D6B18485CC0C6A7DC045916DAAE466634E88445BB0B5972BC17
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b798da2bf62c4d1e97cdba0fd0b81e4f.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:767812ykKmM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.403387402542946
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6mHDd4CETTivFrxsS:SbFuFyLVIg1BG+f+M6mjd4dTTi0jLkGq
MD5:	674A943348D6E623A9AD897996690670
SHA1:	4A37906E0DBE631460FFD2B1049E1DC3FEDE7AE5
SHA-256:	99E2E398F12CD92770FD1E4A78434B55603452383015BD67C54E2ED1E5534FC5
SHA-512:	66F9A6AEF18DC0C5E7FCF8EC797DC7762B155DF34423FC3676D3934034E5528A0CBBF139D2D3C11A0F0D03BF45B1402FF52B3CC4F1A3ACBAD094F092059ADC58
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0705ed6f8a4f41f8b2191a714a6c4aeb.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:77555RMrB1I

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.4375834752083545
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MoBL9j0pYqjNdQIeXD:qgFq6g1af+MoBLE2D
MD5:	05C9BCF6FF31E0FA8188AE0344ABCF95
SHA1:	CCDECFFAF1970907134398730E97FD24CF269EFE
SHA-256:	6AEB8709728C4CE7FB3EE1CADBD116BF987B2863E17809EDD10F16040AAC45FF
SHA-512:	8EF9B1ED2469B36DBEBC228633F3BCFA16ACFD102A9C02622406EDCBCE65E695E22A6364A9A47061DB2C13E45E07232344BF4E3D7B0F7F98AD937B20354450F3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bd7c040029174fcdbb1aa40056fae541.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77606vT2cuM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.363489522433637
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm5iC063Zi2rxsjs2BZZD:SbFuFyLVIg1BAf+MACBJXqjNTZD
MD5:	B0C40340ACE3A7D5D6987D2DB6105D66
SHA1:	60AD268EB9D4AEECD88920F07D13DF5E859B7FE3
SHA-256:	826A119C173CF9A50B65AB5D2315EF3A130954C6C0A88D1D387B14D08791D85C
SHA-512:	BA8B9B516DED1B490406B35008F61DD814525F7377D1BBACC34F0C3B5E9A07381AC9B3A892C748BF617895682854FC940EBF36F2B5437581151FE44E9AB9EFFC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=325a302f3f14429ba2e949abf6a2f033.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:777219IF8UK

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.419237571334611
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzdthU2XEyLAkhuxsC:SbFuFyLVIg1BG+f+Mm2XBnjLTTIWTIL
MD5:	05027E0CADD88E965F7D74724E6BEC88
SHA1:	FF983FB9CAA6E46D7B54D25E76C08C6BD2946F42
SHA-256:	6A60FBBDDF0CBF36950693D8919D53AEB54C8370EF9C468919CE235CFC05BBC6
SHA-512:	A80941FF37C98B4A20128CC24C6021BDEDC2111277D1355B5592BAFB0DEE7B9B7EC332F2243A045E0D582EB15D6808F0BEBD97FF4B9017A767AADB4AAAD29373
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9953212280884b198235b90b810c85e2.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:779855OHsEN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.413061514150217
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm9YeWBEhDRb9X0ZQ:SbFuFyLVK6g7/+BG+f+MS8hDbX0jNq
MD5:	B9FC0F43956CAAEB157EEDCD585292F5
SHA1:	B135EBD479A8466DFD8BD711AE64261C4FF832A0
SHA-256:	849A449D7B4CAD5DDF570D95B59FF174A5A8D23D16D42305EE319AE1DBA314E1
SHA-512:	62989DE227DA204AC21DD147AA7A7719CFC9E842D51503F819600B73E6A86DCD6C783146D7CFE886BA4FC45D1554E8DFCEF04A52043771E3027836CB5D6B5F6B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=761f5773da7a4fbd8fb244fe544f495d.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:77986C13UdN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.371821288611928
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm4GaIWWd6dBGIqNz:SbFuFyLVI6g7/+BG+f+M4CvV0jNq
MD5:	6432B19A83ED5DBFF8CF1B4BB77D8E38
SHA1:	6375BF77AD7BC3B7F996FBD474B6408BC84F8E55
SHA-256:	5578D135885DBEE7C7F1112298A4B19AA76B2927FD073CCC8B6FAB1FBDC9E11F
SHA-512:	6DFDBC2F55123B7B6728646E79098D090D7F453970E9F7F451635C2331737A70B921D5BAD86B3D96D4526FD402B91B2ADB33AD41DCB3ABF6A1C364C2503BF33B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2ced6e838336411aa68d3d58ec303496.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78000ZpX91M

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.537295263943619
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MGr/QXLuqjFQMzKaBu:qgFqo6g7/+0+f+MbbNTmh
MD5:	B1B296BFB24E7C79A4E5634A16FBE4C0
SHA1:	EA09FF7AD489A9CAC20BDCAFA8270FA8AC6B5DFF
SHA-256:	CAD5D66B7EC11DB66A85A9FA5842FE7C955D876FFC7246415462BECCFA674517
SHA-512:	C946C39F8C4447E44F31A8141484ACCDEE97B11D5C1697CD5505FCE3E2CE6EEBA7E72941AB10916BCAF44AF96350C2FB2F71DB72C8AF37B928B0ABD36A7F2307
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=91e61ff8855b46fb8355e8c420dca5c3.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:780010hKjjN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.504221377812633
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MoI72nxUrTjFQMzKaBu:qgFqdg7/+0+f+MoI72nxUZTmh
MD5:	9F0B41A9427716EEB1917A26AD5BE146
SHA1:	B831948C9EA5858D4FAB91AF4A8AA9725A7B3135
SHA-256:	92802ABF22F4870BAC51409976CF16F79EB0A87B0ACAC283A77537F75EEBB95A
SHA-512:	9CA1A1AC929BF4C051E4C76849D21DEBD4B0724D7BAD0538766DB89188201EB980999639167D02CF8C590A18B59E9374D45F17E85F9D7FB1973F76DDEAFD897F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b6a2897aa4bf4f4b9e5b56bf724b149d.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:78112Kd6bJL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.382305318713374
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmy6WZjjYTjs1Han:SbFuFyLVIg1BG+f+My6GfYTjoa
MD5:	D39FC53BEADC7284B511D18D35701FFB
SHA1:	F9EE06B0C6694F06B9B06DD241F73B83DC223D7C
SHA-256:	1C6F9C038A0AA5C0F332A71A8EF372CCED60A25A13DE4849E64430BEA24575E1
SHA-512:	98D3530BBB5219725A46CD631C59F7A12F824F9C52F4DDC243BF9DC845F034B670399CB0887E33B8EB42A772118BFC660F828CED8F5EEBA9B6FF5C6823D53FBB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=89caf4f4a3d94f3f8238160a1b83672e.IDENTIFIER=dbus-daemon.

/run/systemd/seats/.#seat0gmqKSz

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0yFDbwB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/users/.#127OGhNUA

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.306492963349271
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6NEJglEcz02thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEEJgdzPthQHtPYq9M
MD5:	C32B335190F644B5D8BDFD2006161C95
SHA1:	A2B0E8698D3B80AFCF045997F454535ED573B7AC
SHA-256:	F6E5A05A45E50EC65860B88556338B34FD083084C44A56732B25E1399F3A21A3
SHA-512:	A6539DA0898AECCE26CB78956786BB35502ED903C59C2BA57A4AA60BD71DE2B9DE70017B1E3E746AF7FEA4C2201DE6EF9AE28D69DC6F6C3780964DED3F19B17A
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12287.REALTIME=1735962217434509.MONOTONIC=462311039.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127SzS1nA

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.306492963349271
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6NEJglEcz02thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEEJgdzPthQHtPYq9M
MD5:	C32B335190F644B5D8BDFD2006161C95
SHA1:	A2B0E8698D3B80AFCF045997F454535ED573B7AC
SHA-256:	F6E5A05A45E50EC65860B88556338B34FD083084C44A56732B25E1399F3A21A3
SHA-512:	A6539DA0898AECCE26CB78956786BB35502ED903C59C2BA57A4AA60BD71DE2B9DE70017B1E3E746AF7FEA4C2201DE6EF9AE28D69DC6F6C3780964DED3F19B17A
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12287.REALTIME=1735962217434509.MONOTONIC=462311039.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127oKN3BB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.4747518352899744
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff68CglE7gt6G:qgFq30dABibBAg5IG
MD5:	12FA83365655CE1F0C8B1493A3D861DE
SHA1:	789F3B3D8144C03F655718F561DB1B076D5EF280
SHA-256:	94DE9E1B5C18B0A134BE8122F725BDF70379615C623DAAD59E9F1909171500E1
SHA-512:	A014754EB620C93A185DB27211FD5B9444C7A297B8A32D5A38927D6359DDCB18D655513D5909470BFA8F7DE710D5FC4094AFB9828BCD0F64F711A92FC946961A
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12349.REALTIME=1735962217434509.MONOTONIC=462311039.LAST_SESSION_TIMESTAMP=462431815.

/run/systemd/users/.#127soq1cy

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.329708029769422
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgA07Or5PNLk2g206qodoh/n:SbFuFyL3BVgdL87iesnAiRJglE7gt6G
MD5:	373771819E031D65107C5AE199EA646B
SHA1:	ABB4836EE00FEF0C483334C747C4BA1349F984AD
SHA-256:	77C8C877BD9B873D910F61A26909C89AC42EAA0C135399D0AB8815C72F14A982
SHA-512:	279D49D4956C995E103E2245BDE5C582B0D23B03751B8CCC4FC4A667EC27E3CF509A51668F990AE9EF8E572AD6FD7CCBE2F013D823261F04E350E54537FCD73F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1735962217434509.MONOTONIC=462311039.LAST_SESSION_TIMESTAMP=462431815.

/run/systemd/users/.#127wo5AzC

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:ac:ac
MD5:	20C08E18F5DE67310F4B9FD4F3CC31BA
SHA1:	86F77B1594FEBF2FE58FB3F67B7F47144FFA83F6
SHA-256:	D42F6DF4325382F98F72BE4939F48A59FDF8A5EEAE4A8B7130430B813C79736A
SHA-512:	530B1D568FB6227E7D98024466279E0AB77C98D76167B8AF645194EAD139B50033C54D2C203D3612E9FF6346A48D04FB8CF4C4E616673286A70EC79007996E1E
Malicious:	false
Preview:	6347.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:2s1sXlXEWtl/CO:0+ylN
MD5:	E55494198A5213A9EDAB132025B0937E
SHA1:	8F935A5007ACCA593E1E86D10A9BA8D25D9A9CB6
SHA-256:	32635A5763B7A36C2DD3A112678CE830C93D4712D1050E0FE39646C538F0E5E7
SHA-512:	8B5206B42609025592EAAA0C2FD745985763F6F32BF3908C5746F499F72CFF7CF29B3409C36B3EC5A4947FA91A2992B57313DF7A27AD4BDAD52A0E89A938909E
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................\.xg8.......................................

/tmp/qemu-open.7rlszP (deleted)

Download File

Process:	/tmp/Fantazy.mpsl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	3.5858017607410924
Encrypted:	false
SSDEEP:	6:URgDF6EP0gcdtSY/VUd/vYDF6EP0HVYHT/VtVxGdtj/VDM/V+4D/VH:IYNPktSZdHQN2aKxMfF
MD5:	A57CA37BE4ABAFF7D5B10A107606D921
SHA1:	1C9C9771BAB3934547E4AF8811B161330F2A7512
SHA-256:	371C972454E62DAFE7A7EC10D3B2E3CFDF1F9BDD5E1161819D4F1B5E4AF06290
SHA-512:	5FF468DF65D5D0AB8C2B055794E8E0410C31DB1A4160B45CBD01BEDC57EA36BC86D5D9FE31B1D191C50113A24364CE255F25A859CB222668AE99B09CBFA7D073
Malicious:	false
Preview:	400000-418000 r-xp 00000000 fd:00 531606 /tmp/Fantazy.mpsl.elf.458000-459000 rw-p 00018000 fd:00 531606 /tmp/Fantazy.mpsl.elf.459000-45a000 rw-p 00000000 00:00 0 .45a000-45c000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/var/lib/AccountsService/users/gdm.7JIUZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	678
Entropy (8bit):	4.783562445251392
Encrypted:	false
SSDEEP:	12:mZF0hLadZZFTT4p1Wr4XZF0nCLGaWr4X4F0hLajOC8iFXlczfbZUQU:W0pYr4KJr4dAcrCQU
MD5:	6156C7AE20898362225C36B31255F844
SHA1:	DBBC8520BBE52669AD7DA772C2312B8077AF9AE9
SHA-256:	3FFADD525CE78A5A2BF7FFF548490BE18B1807E9D95E3790EAF96A5003AAC568
SHA-512:	58517D66A0AB9C9CF5335E72D6DA4E7AC483FD5591D819B40AFBF9FB5456741CB5A6957EDAF1DA89AC1D852C0CBA70D0EB7B568E772ADA57EA3ED33C1F4E88A2
Malicious:	false
Preview:	Jan 3 21:43:37 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Jan 3 21:43:37 galassia systemd-logind[6353]: Failed to start session scope session-c1.scope: Unit session-c1.scope already exists..Jan 3 21:43:37 galassia gdm-launch-environment]: pam_systemd(gdm-launch-environment:session): Failed to create session: Unit session-c1.scope already exists..Jan 3 21:43:38 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session closed for user gdm.Jan 3 21:43:46 galassia dbus-daemon[6334]: [system] Failed to activate service 'org.bluez': timed out (service_start_timeout=25000ms).

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31Hl0t9r2dT/tMt9r2dZ/:F3ktgVqtgf
MD5:	ED0E31E1DD2FB68F0909737920B28852
SHA1:	60811687D6F1B685A5A54720F6A0FA31CC6B29B4
SHA-256:	7D15CA81D69CF8717B0C2C7FC037C43E7BAC32CEE911980DDEC7414223888638
SHA-512:	B232A3653A9637BF3510BD1E7FA0EACD25547EA568DEB5BD0EA18EBFD87E5BCD03CCEC308816F845BD6DD753FCB76924C977009AAC06246958600AFFEE178DAF
Malicious:	false
Preview:	LPKSHHRH................5$s..G,.z....4................................5$s..G,.z....4........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31HlB0iptllJ0iZtl:F3xbpvbZ
MD5:	0AC3B0E755F95BCBCC6D77299DDD241C
SHA1:	8CE0C1B69CD61BA4C0FF8CB2EB11A8B1C7891CF6
SHA-256:	169A33F2445130AB095C28469DE7E73B667CFF8C4256EDAC81240F791AE56072
SHA-512:	26EC7570C0EB7F9A82F90466078DD59DB7F426D887A5139B0C23A85A2535F4DA60A38B0E92EF36C8233FC2AB60E43CB5E001345F436239507E5AD7D5A4CDF6A2
Malicious:	false
Preview:	LPKSHHRH......................G..]..>.X......................................G..]..>.X........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	CSV text
Category:	dropped
Size (bytes):	9750
Entropy (8bit):	4.9806296547141695
Encrypted:	false
SSDEEP:	96:rBb4Fr/BlGN/JAWOr8MQOrSY+EuHW5+hlJdSePScRh2YcUD20I:rPsr8BHHxdkR
MD5:	45B328DCEDB2D5D0A9546CD4E6E41BB5
SHA1:	2DE4BC4090D681130C310B8C65998755DD4EBD32
SHA-256:	E093E06591190E1DB59E21A91FBADE7AF4E31F0A618578C104F4B5651C015F20
SHA-512:	1296A5B1F79437DDB478D9B03566263FB6740A06363D9DD7D7E905A7D2C4AE5296943707508C38CC7362789E9998C60F5689629F922481026B977E0639091477
Malicious:	false
Preview:	Jan 3 21:43:20 galassia kernel: [ 444.982996] New task spawned: old: (tgid 6433, tid 6433), new (tgid: 6434, tid: 6434).Jan 3 21:43:20 galassia kernel: [ 445.275474] New task spawned: old: (tgid 6421, tid 6421), new (tgid: 6436, tid: 6436).Jan 3 21:43:20 galassia kernel: [ 445.343943] New task spawned: old: (tgid 6436, tid 6436), new (tgid: 6437, tid: 6437).Jan 3 21:43:20 galassia kernel: [ 445.628545] New task spawned: old: (tgid 6435, tid 6435), new (tgid: 6435, tid: 6438).Jan 3 21:43:20 galassia kernel: [ 445.628698] New task spawned: old: (tgid 6435, tid 6435), new (tgid: 6435, tid: 6439).Jan 3 21:43:21 galassia kernel: [ 445.636371] New task spawned: old: (tgid 6435, tid 6438), new (tgid: 6435, tid: 6440).Jan 3 21:43:21 galassia kernel: [ 445.912497] New task spawned: old: (tgid 6421, tid 6421), new (tgid: 6441, tid: 6441).Jan 3 21:43:21 galassia kernel: [ 445.967615] New task spawned: old: (tgid 6441, tid 6441), new (tgid: 6442, tid: 6442).Jan 3 21:43:21 galassia

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	29966
Entropy (8bit):	5.0348249258282305
Encrypted:	false
SSDEEP:	768:rNhD3pgsOF6uwrZd3jdZrXFimaIm4Eyc1JftaGgSXLNXt5zaA0+6kQWyp9bN3jJJ:jVT
MD5:	E3CC06D88A8AC954DCC14693E28BBC10
SHA1:	6D98A927A0B6F40977492D85C2B96AE8EE343D05
SHA-256:	02075BF02623A4ACD16BF8835C27DFAF7A01BB7666A27B4CAA0143E5CC0740FB
SHA-512:	9831912C144744DD3A231DADB7231986A32E1CCD63642E9D15278E5A5B2F94B4476A2270CE0EF1DC45CA8BD532B3450ADC3B68D20493BAC433D8D6DBD614D4B5
Malicious:	false
Preview:	Jan 3 21:43:20 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Jan 3 21:43:20 galassia kernel: [ 444.982996] New task spawned: old: (tgid 6433, tid 6433), new (tgid: 6434, tid: 6434).Jan 3 21:43:20 galassia kernel: [ 445.275474] New task spawned: old: (tgid 6421, tid 6421), new (tgid: 6436, tid: 6436).Jan 3 21:43:20 galassia kernel: [ 445.343943] New task spawned: old: (tgid 6436, tid 6436), new (tgid: 6437, tid: 6437).Jan 3 21:43:20 galassia kernel: [ 445.628545] New task spawned: old: (tgid 6435, tid 6435), new (tgid: 6435, tid: 6438).Jan 3 21:43:20 galassia kernel: [ 445.628698] New task spawned: old: (tgid 6435, tid 6435), new (tgid: 6435, tid: 6439).Jan 3 21:43:20 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Jan 3 21:43:20 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 1..Jan 3 21:43:20 galassia systemd[1]: Stopped System Logging Service..Jan 3 21:43:20 galassia systemd[1

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:2s1sXlXEWtl/CO:0+ylN
MD5:	E55494198A5213A9EDAB132025B0937E
SHA1:	8F935A5007ACCA593E1E86D10A9BA8D25D9A9CB6
SHA-256:	32635A5763B7A36C2DD3A112678CE830C93D4712D1050E0FE39646C538F0E5E7
SHA-512:	8B5206B42609025592EAAA0C2FD745985763F6F32BF3908C5746F499F72CFF7CF29B3409C36B3EC5A4947FA91A2992B57313DF7A27AD4BDAD52A0E89A938909E
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................\.xg8.......................................

File type:	ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.507161683301146
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Fantazy.mpsl.elf
File size:	100'468 bytes
MD5:	c405fb4133dc722a54f3507c538efc9c
SHA1:	0b63fd16a318b87f65c23b42295e0008f9ec883e
SHA256:	f5c7799d61d4078d760f92fe987903f46d3dbc6f4614a0cdf48922be21ed14ba
SHA512:	7c129141eb901422fe86f6bc067ae1d0fa0fe88edcf45a54800efe765ffe91353a2d6f6fb2ad8bc6d5e060be470d435ae90ef049616c390f774fd2b6c4996218
SSDEEP:	1536:mb7/BCaYLJcXPuyf7j+IyRRiA1HzxZ9t7XYye:kLAaYeXZnWzxSye
TLSH:	CBA3821ABF604EF3ECAFDC77499A2B45248D141A21897B78BD70D814F64A24F19E38B1
File Content Preview:	.ELF....................`.@.4...D.......4. ...(...............@...@..z...z....................E...E.....x...........Q.td...............................<...'!......'.......................<...'!... .........9'.. ........................<...'!............f9

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	99908
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x165f0	0x0	0x6	AX	16
.fini	PROGBITS	0x416710	0x16710	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x416770	0x16770	0x1340	0x0	0x2	A	16
.ctors	PROGBITS	0x458000	0x18000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x458008	0x18008	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x458014	0x18014	0x4	0x0	0x3	WA	4
.data	PROGBITS	0x458020	0x18020	0x258	0x0	0x3	WA	16
.got	PROGBITS	0x458280	0x18280	0x360	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x4585e0	0x185e0	0x20	0x0	0x10000003	WAp	4
.bss	NOBITS	0x458600	0x185e0	0x578	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x678	0x185e0	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x185e0	0x64	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x17ab0	0x17ab0	5.5678	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x18000	0x458000	0x458000	0x5e0	0xb78	4.0110	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 4, 2025 04:43:19.370852947 CET	192.168.2.23	1.1.1.1	0x67dd	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 4, 2025 04:43:19.370910883 CET	192.168.2.23	1.1.1.1	0x39c0	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Jan 4, 2025 04:43:19.704766989 CET	192.168.2.23	1.1.1.1	0x2909	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 4, 2025 04:43:19.378062963 CET	1.1.1.1	192.168.2.23	0x67dd	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Jan 4, 2025 04:43:19.378062963 CET	1.1.1.1	192.168.2.23	0x67dd	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2025-01-04 03:43:23 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2025-01-04 03:43:24 UTC	25	IN	HTTP/1.1 100 Continue
2025-01-04 03:43:24 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2025-01-04 03:43:24 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2025-01-04 03:43:24 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2025-01-04 03:43:24 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2025-01-04 03:43:24 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2025-01-04 03:43:24 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2025-01-04 03:43:24 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2025-01-04 03:43:24 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2025-01-04 03:43:24 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2025-01-04 03:43:24 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2025-01-04 03:43:24 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Sat, 04 Jan 2025 03:43:24 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	03:42:50
Start date (UTC):	04/01/2025
Path:	/tmp/Fantazy.mpsl.elf
Arguments:	/tmp/Fantazy.mpsl.elf
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Start time (UTC):	03:42:57
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	03:42:59
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	03:43:16
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	03:43:17
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	03:43:18
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	03:43:19
Start date (UTC):	04/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	03:43:20
Start date (UTC):	04/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	03:43:21
Start date (UTC):	04/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	03:43:23
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	03:43:22
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	03:43:24
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	03:43:35
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Fantazy.mpsl.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6488/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:747096lW2jN

/run/systemd/journal/streams/.#9:74714hh0P3J

/run/systemd/journal/streams/.#9:75967e2do7M

/run/systemd/journal/streams/.#9:75998ADQkLL

/run/systemd/journal/streams/.#9:76002m3MJKJ

/run/systemd/journal/streams/.#9:76174rjNFBM

/run/systemd/journal/streams/.#9:76175J0Y4HL

/run/systemd/journal/streams/.#9:76201ycEAhM

/run/systemd/journal/streams/.#9:7658541icuM

/run/systemd/journal/streams/.#9:76685HOa24M

/run/systemd/journal/streams/.#9:767812ykKmM

/run/systemd/journal/streams/.#9:77555RMrB1I

/run/systemd/journal/streams/.#9:77606vT2cuM

/run/systemd/journal/streams/.#9:777219IF8UK

/run/systemd/journal/streams/.#9:779855OHsEN

/run/systemd/journal/streams/.#9:77986C13UdN

/run/systemd/journal/streams/.#9:78000ZpX91M

/run/systemd/journal/streams/.#9:780010hKjjN

/run/systemd/journal/streams/.#9:78112Kd6bJL

/run/systemd/seats/.#seat0gmqKSz

/run/systemd/seats/.#seat0yFDbwB

/run/systemd/users/.#127OGhNUA

/run/systemd/users/.#127SzS1nA

/run/systemd/users/.#127oKN3BB

/run/systemd/users/.#127soq1cy

/run/systemd/users/.#127wo5AzC

/run/user/1000/pulse/pid

/run/utmp

Linux Analysis Report
Fantazy.mpsl.elf

Start time (UTC):	03:43:36
Start date (UTC):	04/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	03:43:37
Start date (UTC):	04/01/2025
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	03:43:38
Start date (UTC):	04/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	03:43:59
Start date (UTC):	04/01/2025
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Start time (UTC):	03:45:29
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre