Edit tour

Linux Analysis Report
Fantazy.x86.elf

Overview

General Information

Sample name:	Fantazy.x86.elf
Analysis ID:	1584054
MD5:	14e825fe3753a3f154f4cbd84d0f7a0b
SHA1:	1efc80d5a8637d97b2359c6dc57b5b83bf4c645e
SHA256:	a1dcf02177b2755852b7045242fad9b5d452b5abcb7cc077a9f4e8cb47a94a16
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584054
Start date and time:	2025-01-04 05:02:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Fantazy.x86.elf
Detection:	MAL
Classification:	mal80.spre.troj.linELF@0/42@3/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing network information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/Fantazy.x86.elf
PID:	6224
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	VegaSec-KATANA001
Standard Error:

Process Tree

system is lnxubuntu20

Fantazy.x86.elf (PID: 6224, Parent: 6140, MD5: 14e825fe3753a3f154f4cbd84d0f7a0b) Arguments: /tmp/Fantazy.x86.elf

Fantazy.x86.elf New Fork (PID: 6225, Parent: 6224)

Fantazy.x86.elf New Fork (PID: 6226, Parent: 6224)

Fantazy.x86.elf New Fork (PID: 6227, Parent: 6226)

Fantazy.x86.elf New Fork (PID: 6228, Parent: 6226)

Fantazy.x86.elf New Fork (PID: 6229, Parent: 6226)

systemd New Fork (PID: 6233, Parent: 1)

journalctl (PID: 6233, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6250, Parent: 1)

systemd-journald (PID: 6250, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6257, Parent: 1)

journalctl (PID: 6257, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6313, Parent: 1)

dbus-daemon (PID: 6313, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gdm3 New Fork (PID: 6319, Parent: 1320)

Default (PID: 6319, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6323, Parent: 1320)

Default (PID: 6323, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6324, Parent: 1320)

Default (PID: 6324, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6325, Parent: 1860)

pulseaudio (PID: 6325, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6328, Parent: 1)

rtkit-daemon (PID: 6328, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6331, Parent: 1)

systemd-logind (PID: 6331, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6393, Parent: 1)

polkitd (PID: 6393, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6401, Parent: 1)

gpu-manager (PID: 6401, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6403, Parent: 6401)

sh (PID: 6403, Parent: 6401, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6404, Parent: 6403)

grep (PID: 6404, Parent: 6403, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6405, Parent: 6401)

sh (PID: 6405, Parent: 6401, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6406, Parent: 6405)

grep (PID: 6406, Parent: 6405, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6407, Parent: 6401)

sh (PID: 6407, Parent: 6401, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6408, Parent: 6407)

grep (PID: 6408, Parent: 6407, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6409, Parent: 6401)

sh (PID: 6409, Parent: 6401, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6410, Parent: 6409)

grep (PID: 6410, Parent: 6409, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6411, Parent: 6401)

sh (PID: 6411, Parent: 6401, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6412, Parent: 6411)

grep (PID: 6412, Parent: 6411, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6413, Parent: 6401)

sh (PID: 6413, Parent: 6401, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6414, Parent: 6413)

grep (PID: 6414, Parent: 6413, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6415, Parent: 6401)

sh (PID: 6415, Parent: 6401, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6416, Parent: 6415)

grep (PID: 6416, Parent: 6415, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6418, Parent: 6401)

sh (PID: 6418, Parent: 6401, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6419, Parent: 6418)

grep (PID: 6419, Parent: 6418, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6402, Parent: 1)

agetty (PID: 6402, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6417, Parent: 1)

rsyslogd (PID: 6417, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6425, Parent: 1)

generate-config (PID: 6425, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6426, Parent: 6425)

pkill (PID: 6426, Parent: 6425, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6430, Parent: 1)

gdm-wait-for-drm (PID: 6430, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6435, Parent: 1)

gdm3 (PID: 6435, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6440, Parent: 6435)

plymouth (PID: 6440, Parent: 6435, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6457, Parent: 6435)

gdm-session-worker (PID: 6457, Parent: 6435, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6461, Parent: 6457)

gdm-wayland-session (PID: 6461, Parent: 6457, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6463, Parent: 6461)

dbus-daemon (PID: 6463, Parent: 6461, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6465, Parent: 6463)

dbus-daemon New Fork (PID: 6466, Parent: 6465)

false (PID: 6466, Parent: 6465, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6467, Parent: 6461)

dbus-run-session (PID: 6467, Parent: 6461, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6468, Parent: 6467)

dbus-daemon (PID: 6468, Parent: 6467, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6471, Parent: 6435)

Default (PID: 6471, Parent: 6435, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6472, Parent: 6435)

Default (PID: 6472, Parent: 6435, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6441, Parent: 1)

accounts-daemon (PID: 6441, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6452, Parent: 6441)

language-validate (PID: 6452, Parent: 6441, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6453, Parent: 6452)

language-options (PID: 6453, Parent: 6452, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6454, Parent: 6453)

sh (PID: 6454, Parent: 6453, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6455, Parent: 6454)

locale (PID: 6455, Parent: 6454, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6456, Parent: 6454)

grep (PID: 6456, Parent: 6454, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

gvfsd-fuse New Fork (PID: 6483, Parent: 2038)

fusermount (PID: 6483, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6524, Parent: 1860)

dbus-daemon (PID: 6524, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Fantazy.x86.elf	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x46a:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
Fantazy.x86.elf	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5830:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
Fantazy.x86.elf	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x4f3:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
Fantazy.x86.elf	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0x39b:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
Fantazy.x86.elf	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x1142:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1222:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x12f7:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x15a2:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1a35:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
Fantazy.x86.elf	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0xf788:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
Fantazy.x86.elf	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x2b3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
Fantazy.x86.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xc882:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
Fantazy.x86.elf	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x23a2:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
Fantazy.x86.elf	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xe796:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
Fantazy.x86.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xd2bd:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
Fantazy.x86.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xc852:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 7 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6224.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x46a:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
6224.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5830:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6224.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x4f3:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
6224.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0x39b:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
6224.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x1142:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1222:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x12f7:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x15a2:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1a35:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
6224.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0xf788:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
6224.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x2b3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
6224.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xc882:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6224.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x23a2:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6224.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xe796:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6224.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xd2bd:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6224.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xc852:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6227.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x46a:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
6227.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5830:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6227.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x4f3:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
6227.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0x39b:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
6227.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x1142:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1222:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x12f7:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x15a2:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1a35:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
6227.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0xf788:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
6227.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x2b3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
6227.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xc882:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6227.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x23a2:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6227.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xe796:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6227.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xd2bd:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6227.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xc852:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6226.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x46a:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
6226.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5830:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6226.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x4f3:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
6226.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0x39b:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
6226.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x1142:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1222:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x12f7:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x15a2:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1a35:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
6226.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0xf788:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
6226.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x2b3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
6226.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xc882:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6226.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x23a2:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6226.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xe796:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6226.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xd2bd:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6226.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xc852:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6228.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x46a:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
6228.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5830:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6228.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x4f3:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
6228.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0x39b:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
6228.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x1142:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1222:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x12f7:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x15a2:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1a35:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
6228.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0xf788:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
6228.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x2b3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
6228.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xc882:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6228.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x23a2:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6228.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xe796:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6228.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xd2bd:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6228.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xc852:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6225.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x46a:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
6225.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5830:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6225.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x4f3:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
6225.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0x39b:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
6225.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x1142:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1222:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x12f7:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x15a2:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1a35:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
6225.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0xf788:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
6225.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x2b3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
6225.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xc882:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6225.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x23a2:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6225.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xe796:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6225.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xd2bd:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6225.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xc852:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 55 entries

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6417)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6250)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6435)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6463)	Socket: unknown address family	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.243
Source: unknown	TCP traffic detected without corresponding DNS query: 181.7.98.106
Source: unknown	TCP traffic detected without corresponding DNS query: 45.65.77.162
Source: unknown	TCP traffic detected without corresponding DNS query: 41.144.4.14
Source: unknown	TCP traffic detected without corresponding DNS query: 111.137.187.95
Source: unknown	TCP traffic detected without corresponding DNS query: 159.205.8.39
Source: unknown	TCP traffic detected without corresponding DNS query: 61.245.89.243
Source: unknown	TCP traffic detected without corresponding DNS query: 74.99.83.70
Source: unknown	TCP traffic detected without corresponding DNS query: 85.173.36.45
Source: unknown	TCP traffic detected without corresponding DNS query: 65.240.160.181
Source: unknown	TCP traffic detected without corresponding DNS query: 192.236.95.157
Source: unknown	TCP traffic detected without corresponding DNS query: 120.88.153.145
Source: unknown	TCP traffic detected without corresponding DNS query: 182.188.253.242
Source: unknown	TCP traffic detected without corresponding DNS query: 165.144.55.19
Source: unknown	TCP traffic detected without corresponding DNS query: 222.5.172.140
Source: unknown	TCP traffic detected without corresponding DNS query: 149.51.190.15
Source: unknown	TCP traffic detected without corresponding DNS query: 37.228.226.158
Source: unknown	TCP traffic detected without corresponding DNS query: 63.236.190.151
Source: unknown	TCP traffic detected without corresponding DNS query: 67.68.51.199
Source: unknown	TCP traffic detected without corresponding DNS query: 59.137.187.88
Source: unknown	TCP traffic detected without corresponding DNS query: 101.200.178.164
Source: unknown	TCP traffic detected without corresponding DNS query: 148.235.61.5
Source: unknown	TCP traffic detected without corresponding DNS query: 156.116.201.16
Source: unknown	TCP traffic detected without corresponding DNS query: 48.84.154.28
Source: unknown	TCP traffic detected without corresponding DNS query: 167.37.220.133
Source: unknown	TCP traffic detected without corresponding DNS query: 120.115.155.175
Source: unknown	TCP traffic detected without corresponding DNS query: 176.66.124.240
Source: unknown	TCP traffic detected without corresponding DNS query: 134.241.63.59
Source: unknown	TCP traffic detected without corresponding DNS query: 71.116.128.234
Source: unknown	TCP traffic detected without corresponding DNS query: 174.6.158.139
Source: unknown	TCP traffic detected without corresponding DNS query: 196.6.137.68
Source: unknown	TCP traffic detected without corresponding DNS query: 85.7.92.59
Source: unknown	TCP traffic detected without corresponding DNS query: 147.69.79.245
Source: unknown	TCP traffic detected without corresponding DNS query: 87.101.248.137
Source: unknown	TCP traffic detected without corresponding DNS query: 42.243.191.121
Source: unknown	TCP traffic detected without corresponding DNS query: 124.138.81.42
Source: unknown	TCP traffic detected without corresponding DNS query: 196.130.123.116
Source: unknown	TCP traffic detected without corresponding DNS query: 121.42.26.221
Source: unknown	TCP traffic detected without corresponding DNS query: 161.165.47.253
Source: unknown	TCP traffic detected without corresponding DNS query: 111.67.90.243
Source: unknown	TCP traffic detected without corresponding DNS query: 188.252.17.22
Source: unknown	TCP traffic detected without corresponding DNS query: 91.105.220.179
Source: unknown	TCP traffic detected without corresponding DNS query: 72.115.46.59
Source: unknown	TCP traffic detected without corresponding DNS query: 14.108.131.110
Source: unknown	TCP traffic detected without corresponding DNS query: 209.201.147.137
Source: unknown	TCP traffic detected without corresponding DNS query: 198.88.98.235
Source: unknown	TCP traffic detected without corresponding DNS query: 187.67.197.125
Source: unknown	TCP traffic detected without corresponding DNS query: 13.248.67.62
Source: unknown	TCP traffic detected without corresponding DNS query: 171.83.151.18
Source: unknown	TCP traffic detected without corresponding DNS query: 93.248.171.115

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.72.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38260
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6227.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 6227.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6227.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 6227.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 6227.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 6227.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Source: 6227.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 6227.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6227.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6227.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6227.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6227.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6228.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 6228.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6228.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 6228.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 6228.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 6228.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Source: 6228.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 6228.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6228.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6228.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6228.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6228.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 6051, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 6201, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 6203, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 6226, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 6228, result: unknown	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 6051, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 6201, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 6203, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 6226, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6228)	SIGKILL sent: pid: 6228, result: unknown	Jump to behavior

Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6227.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6227.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6227.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6228.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 6228.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6228.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 6228.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 6228.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 6228.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Source: 6228.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 6228.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6228.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6228.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6228.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6228.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26

Source: classification engine

Classification label: mal80.spre.troj.linELF@0/42@3/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6313)	File: /proc/6313/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6463)	File: /proc/6463/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6468)	File: /proc/6468/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6483)	File: /proc/6483/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6524)	File: /proc/6524/mounts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:76240PLgjeP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:76241TR16KO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:76723IYxNDN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:75586yB5T2O	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:756000p44hO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:75667Mwq23N	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:75668GwduIL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:75688BZzceO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:77919xR56cM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:779304tGQ1M	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:77935lH9ICN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:78092Q5OfuN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:78129PnEHAO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:78255KQAUeP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:78273MbKmBO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:78274T4PFNM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:78290LxnCZN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:78291si0IaP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:79188KvfXFM	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	File: /run/systemd/seats/.#seat0eeAtaU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	File: /run/systemd/users/.#127pdKiTV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	File: /run/systemd/users/.#12790ByLV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	File: /run/systemd/seats/.#seat09O9glT	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	File: /run/systemd/users/.#127eIAUfT	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	File: /run/systemd/users/.#127T8ZRrT	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	File: /run/systemd/users/.#127EoQtbV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	File: /run/systemd/users/.#127vKXJqV	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6393)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6461)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6441)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6441)	Directory: /root/.cache	Jump to behavior

Source: /usr/bin/dbus-daemon (PID: 6313)	File opened: /proc/6461/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6313)	File opened: /proc/6320/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6313)	File opened: /proc/6320/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6313)	File opened: /proc/6331/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6313)	File opened: /proc/6441/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6313)	File opened: /proc/6313/status	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6313)	File opened: /proc/6313/attr/current	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6313)	File opened: /proc/6393/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6313)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6313)	File opened: /proc/6325/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6313)	File opened: /proc/6325/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6313)	File opened: /proc/6325/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6313)	File opened: /proc/6435/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6313)	File opened: /proc/6457/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6313)	File opened: /proc/6457/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6313)	File opened: /proc/6328/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6313/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2078/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2078/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2078/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2078/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2078/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2078/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2078/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2077/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2077/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2077/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2077/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2077/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2077/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2077/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2033/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2033/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2033/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2033/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2033/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2033/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2033/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2074/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2074/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2074/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2074/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2074/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2074/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2074/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2074/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2074/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2074/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2074/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2074/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2074/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2074/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6393/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6393/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6393/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6393/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6393/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6393/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6393/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1532/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1532/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1532/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1532/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1532/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1532/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1532/cgroup	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6403)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6405)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6407)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6409)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6411)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6413)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6415)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6418)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6454)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Source: /bin/sh (PID: 6404)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6406)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6408)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6410)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6412)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6414)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6416)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6419)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6456)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6426)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6250)

Reads from proc file: /proc/meminfo

Jump to behavior

Source: /sbin/agetty (PID: 6402)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6435)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6435)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6441)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6441)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6401)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6417)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6417)	Log file created: /var/log/auth.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 6401)

Truncated file: /var/log/gpu-manager.log

Jump to behavior

Source: /usr/bin/pulseaudio (PID: 6325)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pkill (PID: 6426)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6250)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6325)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6401)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6402)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6417)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6457)	Queries kernel information via 'uname':	Jump to behavior

Source: kern.log.72.dr	Binary or memory string: Jan 3 22:03:29 galassia kernel: [ 454.488169] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: kern.log.72.dr	Binary or memory string: Jan 3 22:03:29 galassia kernel: [ 454.488190] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6441)

Logged in records file read: /var/log/wtmp

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Fantazy.x86.elf	71%	ReversingLabs	Linux.Trojan.Mirai
Fantazy.x86.elf	62%	Virustotal		Browse
Fantazy.x86.elf	100%	Avira	EXP/ELF.Gafgyt.Z.A
Fantazy.x86.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.72.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
72.51.27.59	unknown	Canada	13768	COGECO-PEER1CA	false
72.209.198.145	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
159.7.207.53	unknown	Sweden	1906	NORTHROP-GRUMMANUS	false
18.225.37.234	unknown	United States	16509	AMAZON-02US	false
163.217.149.142	unknown	Japan	7502	IP-KYOTOAdvancedSoftwareTechnologyManagementResearch	false
196.58.100.27	unknown	Seychelles	37518	FIBERGRIDSC	false
185.154.185.7	unknown	Iran (ISLAMIC Republic Of)	202788	KWPAIR	false
184.117.76.129	unknown	United States	7922	COMCAST-7922US	false
119.175.212.114	unknown	Japan	9824	JTCL-JP-ASJupiterTelecommunicationCoLtdJP	false
157.8.236.245	unknown	Japan	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
179.12.199.43	unknown	Colombia	27831	ColombiaMovilCO	false
44.150.102.171	unknown	United States	62383	LDS-ASBE	false
133.50.138.232	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
116.60.81.94	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
192.126.28.41	unknown	Finland	719	ELISA-ASHelsinkiFinlandEU	false
161.22.171.190	unknown	Bolivia	28024	NuevatelPCSdeBoliviaSABO	false
187.247.141.62	unknown	Mexico	13999	MegaCableSAdeCVMX	false
111.141.191.14	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
133.48.31.5	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
223.66.157.135	unknown	China	56046	CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN	false
191.139.46.16	unknown	Brazil	26615	TIMSABR	false
173.236.124.78	unknown	United States	32475	SINGLEHOP-LLCUS	false
77.186.218.191	unknown	Germany	6805	TDDE-ASN1DE	false
171.14.47.246	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
78.185.187.168	unknown	Turkey	9121	TTNETTR	false
106.133.63.186	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
83.8.215.109	unknown	Poland	5617	TPNETPL	false
181.75.29.159	unknown	Chile	6535	TelmexServiciosEmpresarialesSACL	false
209.52.250.243	unknown	Canada	852	ASN852CA	false
109.171.89.59	unknown	Russian Federation	15774	TTK-RTLRetailRU	false
148.88.133.178	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
146.141.165.121	unknown	South Africa	2018	TENET-1ZA	false
105.80.209.184	unknown	Egypt	36992	ETISALAT-MISREG	false
163.163.59.15	unknown	Belgium	5609	ASN-CSELTAS-CSELTCONVERTEDTOASN-CSELTFORRPSLCOMPLIA	false
191.108.204.217	unknown	Colombia	61317	ASDETUKhttpwwwheficedcomGB	false
152.17.254.39	unknown	United States	40245	WAKE-FOREST-UNIVERSITYUS	false
31.121.22.173	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
210.150.43.34	unknown	Japan	2514	INFOSPHERENTTPCCommunicationsIncJP	false
204.158.121.130	unknown	United States	3354	THENET-AS-3354US	false
72.53.93.209	unknown	Canada	11814	DISTRIBUTEL-AS11814CA	false
60.179.68.180	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
39.246.193.45	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
95.117.176.96	unknown	Germany	6805	TDDE-ASN1DE	false
85.45.74.13	unknown	Italy	3269	ASN-IBSNAZIT	false
78.121.132.156	unknown	France	8228	CEGETEL-ASFR	false
115.148.5.9	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
184.60.219.196	unknown	United States	4181	TDS-ASUS	false
218.228.66.200	unknown	Japan	9614	OCTOitaCableTelecomColtdJP	false
83.122.128.183	unknown	Iran (ISLAMIC Republic Of)	197207	MCCI-ASIR	false
158.227.161.172	unknown	Spain	15488	UPV-EHUES	false
37.195.254.139	unknown	Russian Federation	31200	NTKIPv6customersRU	false
102.243.179.33	unknown	Tunisia	36926	CKL1-ASNKE	false
199.38.72.160	unknown	United States	394708	HORIZONCHILLICOTHETELEPHONEUS	false
146.69.149.22	unknown	United States	2018	TENET-1ZA	false
68.93.39.133	unknown	United States	7018	ATT-INTERNET4US	false
220.158.99.44	unknown	Japan	2519	VECTANTARTERIANetworksCorporationJP	false
112.13.105.135	unknown	China	56041	CMNET-ZHEJIANG-APChinaMobilecommunicationscorporationC	false
27.251.192.197	unknown	India	10201	DWL-AS-INDishnetWirelessLimitedBroadbandWirelessIN	false
20.113.156.73	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
110.41.111.144	unknown	China	59011	YLWLBeijingYunlinNetworkTechnologyCoLtdCN	false
93.230.89.18	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
109.249.170.196	unknown	United Kingdom	12576	EELtdGB	false
189.72.70.127	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
171.33.164.76	unknown	United Kingdom	28878	SIGNET-ASNL	false
101.222.31.15	unknown	India	58519	CHINATELECOM-CTCLOUDCloudComputingCorporationCN	false
36.141.188.24	unknown	China	56044	CMNET-AS-LIAONINGChinaMobilecommunicationscorporationC	false
100.41.247.151	unknown	United States	701	UUNETUS	false
151.44.239.215	unknown	Italy	1267	ASN-WINDTREIUNETEU	false
146.209.52.233	unknown	United States	5619	EVRY-NO	false
169.115.36.174	unknown	United States	37611	AfrihostZA	false
72.27.139.178	unknown	Jamaica	30689	FLOW-NETJM	false
166.101.10.235	unknown	United States	58681	NSWPOLSERV-AS-APNewSouthWalesPoliceAU	false
31.43.243.38	unknown	Ukraine	43764	SEVLUSH-ASDataLineUA	false
103.69.72.19	unknown	Australia	55707	SIMTRONIC-AS-APSimtronicAU	false
62.129.10.8	unknown	France	8309	SIPARTECHFR	false
47.26.252.113	unknown	United States	20115	CHARTER-20115US	false
123.208.176.221	unknown	Australia	135887	TELSTRA-BELONG-APTelstraCorporationAU	false
60.203.253.214	unknown	China	9595	XEPHIONNTT-MECorporationJP	false
86.85.55.154	unknown	Netherlands	1136	KPNKPNNationalEU	false
74.252.107.130	unknown	United States	8103	STATE-OF-FLAUS	false
75.69.59.133	unknown	United States	7922	COMCAST-7922US	false
31.185.91.215	unknown	Denmark	39642	DK-ESS-ASDK	false
114.25.246.4	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
182.248.57.122	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
216.204.31.203	unknown	United States	7029	WINDSTREAMUS	false
96.35.63.168	unknown	United States	20115	CHARTER-20115US	false
19.252.74.33	unknown	United States	3	MIT-GATEWAYSUS	false
8.48.223.115	unknown	United States	11273	FDCSGNETUS	false
111.25.84.155	unknown	China	134810	CMNET-JILIN-AS-APChinaMobileGroupJiLincommunicationsco	false
109.208.219.107	unknown	France	3215	FranceTelecom-OrangeFR	false
207.76.22.176	unknown	United States	701	UUNETUS	false
89.125.16.170	unknown	Ireland	25441	IBIS-ASImagineGroupLtdIE	false
198.68.138.50	unknown	United States	1239	SPRINTLINKUS	false
146.65.242.131	unknown	United States	2018	TENET-1ZA	false
218.210.225.108	unknown	Taiwan; Republic of China (ROC)	9919	NCIC-TWNewCenturyInfoCommTechCoLtdTW	false
185.236.50.97	unknown	Germany	3163	DIEMITDE	false
18.74.204.49	unknown	United States	3	MIT-GATEWAYSUS	false
109.52.77.152	unknown	Italy	16232	ASN-TIMServiceProviderIT	false
43.125.241.121	unknown	Japan	4249	LILLY-ASUS	false
62.231.187.74	unknown	Russian Federation	29072	RDTC-ASRDTCAutonomousSystemISPatNovokuznetskcityRU	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
119.175.212.114	gFCq6iZ7Mf	Get hash	malicious	Mirai	Browse
223.66.157.135	H3p06Xn6OP.elf	Get hash	malicious	Mirai, Moobot	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Fantazy.arm4.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	sshd.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	jklarm.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Josho.x86.elf	Get hash	malicious	Unknown	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-CXA-ALL-CCI-22773-RDCUS	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	68.225.100.58
	Josho.x86.elf	Get hash	malicious	Unknown	Browse	70.177.222.122
	DEMONS.spc.elf	Get hash	malicious	Unknown	Browse	98.181.22.151
	armv7l.elf	Get hash	malicious	Unknown	Browse	68.100.70.116
	loligang.mips.elf	Get hash	malicious	Mirai	Browse	72.201.247.81
	loligang.ppc.elf	Get hash	malicious	Mirai	Browse	98.182.113.146
	loligang.x86.elf	Get hash	malicious	Mirai	Browse	68.0.18.5
	botx.mips.elf	Get hash	malicious	Mirai	Browse	66.37.241.253
	loligang.mips.elf	Get hash	malicious	Mirai	Browse	174.64.15.19
NORTHROP-GRUMMANUS	3.elf	Get hash	malicious	Unknown	Browse	157.127.83.218
	loligang.arm.elf	Get hash	malicious	Mirai	Browse	155.104.135.22
	kwari.arm.elf	Get hash	malicious	Unknown	Browse	155.104.123.81
	botx.mpsl.elf	Get hash	malicious	Mirai	Browse	159.4.59.210
	armv4l.elf	Get hash	malicious	Unknown	Browse	129.193.169.217
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	155.110.130.25
	1.elf	Get hash	malicious	Unknown	Browse	157.127.47.199
	loligang.mips.elf	Get hash	malicious	Mirai	Browse	192.45.130.235
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	129.4.123.124
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	155.104.147.70
COGECO-PEER1CA	https://telegra.ph/Clarkson-122025-01-02	Get hash	malicious	Unknown	Browse	64.29.17.193
	https://telegra.ph/Clarkson-122025-01-02	Get hash	malicious	Unknown	Browse	64.29.17.1
	kwari.arm7.elf	Get hash	malicious	Mirai	Browse	64.34.198.36
	armv5l.elf	Get hash	malicious	Mirai	Browse	64.77.179.67
	armv4l.elf	Get hash	malicious	Unknown	Browse	69.90.4.236
	jklspc.elf	Get hash	malicious	Unknown	Browse	66.111.87.168
	splarm.elf	Get hash	malicious	Unknown	Browse	216.157.16.213
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	64.65.112.37
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	216.122.235.235
	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	64.227.192.192

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/6466/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:hn:hn
MD5:	C60E2AB3C7F8E12740CA2DE65544A7F2
SHA1:	FD81A3D8CEFDDC68D50DD6205E3367CB2299CBB5
SHA-256:	687D4D30F8014EEB63BFD2E72A3E0010FF76A8C5DF78E3DDE41A5D5473B5AD55
SHA-512:	506FB9173A5316DBA9F89C8F1F92C629C5B3146E2312A934634EF498E22C7834EE2A25BD2A94E2BF904A6E4577E6234F0D84B5BAE25432BA43DD6AE69AE582CF
Malicious:	false
Reputation:	low
Preview:	6435.

/run/systemd/journal/streams/.#9:75586yB5T2O

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.390733871553765
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuAd/HDUzXhgrxsjst:SbFuFyLVIg1BG+f+Mu4rQMqjdCLKzK
MD5:	77DFC414C050F93CE4090508A3004308
SHA1:	B4EFCAD580E74B8643B1843F91039D2E51871D0A
SHA-256:	446B58876FE9F4EB90A546E1F9E5070C6297A7E4E434CC880444627C36E21115
SHA-512:	D772EF3CD9E35D4F9C56614051895B092DB7C3F8C054DD6D4870007F35AB16F3C7258FF5DC05504A226CC70B16635D7FF8559C4AF9384E21BA70037EB291DCEA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dd87bf20800b4978831fbd3611b27233.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:756000p44hO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.34654975109497
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4D799gXEHUjGY0wsh:SbFuFyLVIg1BG+f+M4D7DgXE06Y0ZjtT
MD5:	F1D9A2FE9A1822A4BAD83A1D2BEAD5AB
SHA1:	FF006B38FE4B4F50FE309C26EF1FECE555D7BF77
SHA-256:	B3D2BA2BEA5D4AC943FCAEF41AAAEC990166D2F42A40750F4EB2A9E9C2C568D3
SHA-512:	A4E178975691FF34523A3EA31997C2643DA6E2D3DAFEA9DD00370FC24C9B59B36E5005A3E2AE3620D236880DEB1806DE0891EF0F17CDCE7D137C02EFAAD0A71D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2f47ab0f20664c5fbb6d32abcfd0c311.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:75667Mwq23N

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.428163292139005
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsu7AnWRAQK94WGvX5:SbFuFyLVIg1BG+f+Msu7AWnK9Mv8jNE
MD5:	C2A00078D2FEB139C66CC276EAC211FD
SHA1:	484CC149336A208CD2D9FBA40A52F2FA1FAA0AEA
SHA-256:	64F40F257C4F91CA1488BF6879DBCC7139225BBFB64057B34AC5D4101C4DC8B0
SHA-512:	A1F7391732BDB6364C522CF27E3B706DAF539EC9D595664DD0C30F55054E37D70EFC033E680CD646BFE8C7AC90745411B4A49853E70BF2B6779EC6CA1CEF4B63
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f85848e9bd534e51b0b8d7d97e3e6cec.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:75668GwduIL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.4728885338509325
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpEWS4W8FXz22jsicN:SbFuFyLVIg1BG+f+MLWuz22jZcHcljX+
MD5:	0FE8CA632B88DDD145B89CD29CA7B7BA
SHA1:	1F969370F0942EB5D926039D55BB1159505F00E5
SHA-256:	4D679919CC7875B3C5C9F0D8165B2FC19C772B38259387F9714BB6FECCA6D2EC
SHA-512:	D9ACAFCA8561654EB99DCEBF7427D7F04DEF7B82B9C3FD72295FDBB9C96C54862EF06DAFFE4DE51C362619DA18E8A0F2E006F4773349FE185953734418CF37DC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cd272c935b4f4c99a9235e319ecb4df9.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:75688BZzceO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.401387872403267
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+RQHXHGHNWMA1hVNz:SbFuFyLVIg1BG+f+M+236rAWjbVC
MD5:	0558BFD89F55BD915B4D9059634866A2
SHA1:	63A61BA7FC792395DDB23F8C687FD52598369BD1
SHA-256:	0C8317D54328DBB6E1822923C1BD3888B9E54121AC1F4A601656F252CB432F1F
SHA-512:	80476538FBC51C55001C02342A9C1BE4910FCB076ED492B1013759CC747FAC370D25ABCB175783617FE6B7AC6EEE2D36B79CC2458C14A96A9C26CF9779148531
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=44c15b2bcb3c4e8ea7710f9bc31a0950.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:76240PLgjeP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.518089303656104
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6xc1WzmQxFcAAlE0o:SbFuFyLVIg1BG+f+M6alllg2ji4s
MD5:	74033A318BD00C1873FE1067670126F3
SHA1:	586E591081FFEE93CADEF4C7E841D35476994FBB
SHA-256:	FA1E33813E4FB05ECDD3BD30BD920C9430B67CAF83F32A61E6767E083DEE2894
SHA-512:	1C3943150C367C5DDCBEA4BBD7F4DBFCEEC7DA7621682F7BDB943595D26C84D0BB6DE262B5C3E151A9596F190D2C1A836AD79A6D0D56DC39AE7686CFB557C968
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0d70e9df357647228654219fec2ee70a.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76241TR16KO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.505663003152334
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmr/GfKySb8js7Lbgw3:SbFuFyLVIg1BG+f+MjGwQji4s
MD5:	0926E4BA2380BD35B977D1E69C329EFD
SHA1:	B8D35D72DF975D01D1F6B74BBAD5F8408F716176
SHA-256:	DA97EFC8F8417EBB516569EF97422913C01EBADE8762AA2571498BFACE4B2EA5
SHA-512:	F35993C1FA45826D4E19C2E703429B5107B688F861942D4DE92219978C35309CB9F07C7705663721E81BC50D084D5AA87489EC9A6224C52C9FE3856074A7598D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a1bcf8c5d8a74c7cabbd5a83dd224717.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76723IYxNDN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.427945592397971
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmr70jfAcFVdSgrqjsc:SbFuFyLVIg1BG+f+Mu8g2josQu
MD5:	E697081DB0B0053323D1D4249BF74FD0
SHA1:	D2BEC5EAA2886C9BD7AEDA9A5407274F21018787
SHA-256:	0837198CBE4C50AF55626C95B633E1A67071D64E670A0D7E86104FA6F177F773
SHA-512:	6A8742DC8D3122595783DECC3B537508DE021DE4CD2DBCBE9EB4B802D83DC13B2EBFDD2F5CE523552768A791626CF33EEA7F55B6F26DEA043F32CC83DD3298B2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ac676e12b4ca4e65b5ff19dafe8b088f.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:77919xR56cM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.452298343590184
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmoaT8WBn87cUHQhg2jsx:SbFuFyLVIg1BAf+MoY8u22jNALyAZD
MD5:	F0DBDDB0CC93B81269A340E2941A6624
SHA1:	31E2B2D27C79A4B8D93E2ED2C3E2B4871DA31FB7
SHA-256:	CCCCC6E9F3661E10752370176D22BE84B8E6955AD6E0071463D7F6EA6773849E
SHA-512:	5E1682BD6244AD01820974C2557F9D934C1851535600B4A6D8598FBE547427CBEA7C595063AED3F6B50BBC505A5A1D86594A9D350835428D327510FB7884532F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b73e6f1dcddd4f6a8259a14c52f321b6.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:779304tGQ1M

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.422634612546642
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MMADwGYTjdCt/rRMtq:qgFq6g10+f+MjElCDL
MD5:	51256062D7562AE5DE144964AB7E7439
SHA1:	29C580919D57DD60FB13B3CE7F3518B60BEAEF3A
SHA-256:	59B1F4C36539256DF0C4B2DAB858B491B85C63B467764828A6298061DA7B8D30
SHA-512:	B776D98655DA47303F47AD1966A4F6C833E2530880182F04D609CC7987053B5FE3784D04D066DF8BBE9709FCB12E6BF9C0B3C716F4740026B72DAC45004F607D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5b4b61912e3a4121a1b1afacd71432e6.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:77935lH9ICN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.431552260956042
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MsWa2ELGIGhTjLkGq:qgFq6g10+f+MsWa2RYT
MD5:	16834B9E2B674105E07501690DE3F741
SHA1:	EEBFC2BF893596D9E8CCF0B3E6E479025E995059
SHA-256:	8B11B344A4DCF4239DCC0F829A354F2BD3624E267A7B5E2679985C1116E905EB
SHA-512:	373860F8D910270E9CEA583FF2BA8D85A077B7DE2C489A3FA65D0D24D0FBDEB2D3EFCC5813EA7C19C8FDD0BAF0E8115231D431FD62EF87D8D73E31385390E0C4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f53c81feb7fd49ac9c4449cc8864fbd6.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:78092Q5OfuN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.444553498843518
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+Mo2kDwehjuqjNdQIeXD:qgFq6g1af+MpM2D
MD5:	93E7C3D5A188D314D6E7AA38DDA23662
SHA1:	FC4E989D0F60000A5423F71A24FCAAE18093C715
SHA-256:	1F115F5C2EAAFDC985F4E12C2BF59E0D16EE3F4D2E5785D01E4FFB4F2008E70E
SHA-512:	929623FEECE858BD71D81FC6C69623E209C4FAB7EB49096BB03D8BD4C7E6EDBE33322E76398780D3169C7B25427B47FEBC84D37EE863A0C9E62F2578B91B5F63
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ca6c8bbddd7f4f8caaeda8163cb26197.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78129PnEHAO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.4215031350374865
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm+jExuqyj5shgrqjs2BP:SbFuFyLVIg1BAf+M+jExuq4F2jNTZD
MD5:	116688781653B52E005DD9064D8444DC
SHA1:	C1167112A6165393839585CA0873B06FE6D49E53
SHA-256:	0055E347AE8B61CEA6A6917B7814C67D50F3C5E3B790CE5B665604AB2F548484
SHA-512:	37866F1B040ADEC22106C4E333E6E93EE547D5C73C50D55C4BFACF8E9E51E468006F05AA2D512D7A2727762FE89A4F8D0D5A8797902A70223F635CFE3FB0D42F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=439bae387b2543f8a2ea15ff29843564.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78255KQAUeP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.451423368756803
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M4QlRKi9ATjLTTIWTIL:qgFq6g10+f+M4Xi9AXEWEL
MD5:	A24EBCE7A812DF9AC90C09F2D581A6A6
SHA1:	D3C91C82E7B01C588D9958BD47DB7C66D2C8CB6D
SHA-256:	B63A8D052A3B25EB0D1744736E50DA3F68AABE775C1F7FE61DAB8F7B7C75A8FF
SHA-512:	03A5FAAA1A2C5028918A90F5EBA509FC9AABF001C0C5B2235AF3658B1672BFD2FCA9C930DFD958561B87ADF5EAF8F5C13AC724C3C95A7F5CF83A21A229C1F84E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2695d0078e614fda97f26a10b589c26d.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:78273MbKmBO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.437230968110203
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm942Qy4BAAi3Mqjk:SbFuFyLVK6g7/+BG+f+MiG4BAJ3MqjNq
MD5:	79EBF971E03E15744598D56123F12895
SHA1:	7716AD51ECD575AFCC028F607111A50CC0A0F67E
SHA-256:	24566CB12D24BE6805A68317928E3A3845F3A6A3319E50E090C88A78B819472C
SHA-512:	8AB7BF1FD70459216C0804E63AF0D9FC5C3F2A5370F8463A6C9CCEA36330B424DB08B0783334CEA405C3E711E85910A60882AAC0263EAE583CA7E46E5A6CA953
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=707e62f949c545c2951b94e4d713a23e.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78274T4PFNM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.417444862725979
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmvRTjrfy3skcvShs:SbFuFyLVI6g7/+BG+f+MVy8VKZjNq
MD5:	2910AD360B825E88D9F1253355C2B69C
SHA1:	51CC40C7C4964C73C2CC5C8E6F606469AF3DC5A7
SHA-256:	76F9280D04297E62A36608CF6F4FF4CC0B7FBC54F0C90783B47F58480892510F
SHA-512:	64413B3586B2CC1C389F3DD35E90229E8C5E4C921931679366B5A6AF398D0809E153653597D3A122881D4B8FA8268E418229BE1BFC23E19020A109BF5C8AD8EF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e33632380a1c4c1a8e286498b874979d.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78290LxnCZN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.509551927711508
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M4c9LN2jFQMzKaBu:qgFqo6g7/+0+f+M4OL+Tmh
MD5:	B457605CCE2F62DCB32BF5DC4266C211
SHA1:	E88CA3721A5A74A5BD7090689A19869AFA43D04E
SHA-256:	B526C6BE77CEEFBC7E63E0209E3CDB85E0ACC3CCD723C31AFA8BFCD3344C7EDE
SHA-512:	13A7AFEDDEC78E63674F7B12956F36E464C094B49701DAAAAE6A0501AC72962604860493214EE7A46B50D56915948B37D84822D604011A922804F4A36193D6CE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=254b6567daa041c78a806d092def9d87.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:78291si0IaP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.546419773281207
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M+Xzv9CjFQMzKaBu:qgFqdg7/+0+f+MAz2Tmh
MD5:	442F23FBE724A848A75C439040121001
SHA1:	B9FE887260CF367DBB61F8D8EE5D86CBB642A418
SHA-256:	A904B1EE026604A56C6E40F7DB93DCB47311F12902A6F8F2293F15C15DDB7F1B
SHA-512:	24BA8FC282592761774892D372CE2D71E71BCAEB1DE2040DC02E80F4DDC8869FFA1063CCEC9C0EBBBBB654E14FB3B6DC5429588C568B2D11E2B7B9A526D94E68
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=49e46851af724e14b7a06c5f38c71d15.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:79188KvfXFM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.34617345933078
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyyWyTngBT5YpUMWNC:SbFuFyLVIg1BG+f+MyyWAngl5FMuqjoa
MD5:	174D95380F889F8F9238AE0565A0491D
SHA1:	5CB78D2212ACE4BF2B0910E89D9C30A19A0142BB
SHA-256:	B8590756F9C38D3C431FC161D9509F9DA53DE5343FB02205D138CDC0CD3D2EF9
SHA-512:	83C05CC4D76A2077B5C32294DDB8A468C26787A5ABC56BDCFB51C1BE48F09F567D83CD0144467450B17D12E64FD564D650D34F88BCF5A74629F96C4CAC0DA55D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=87d81e2668d94d6e9613bdbc1321d033.IDENTIFIER=dbus-daemon.

/run/systemd/seats/.#seat09O9glT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0eeAtaU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/users/.#12790ByLV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.321113364258541
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6NEJgERh8qwpsQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEEJgE3KsjthQHtPYb
MD5:	3B4677DDCD4CFAC03A98BEA381B03FA2
SHA1:	20FB2D7D07D9D42DA663B56A0858C6D3F8C44DB1
SHA-256:	36C354074B8DE68795904CC469FB57E3D86C7242E73476EF15A767B8966F402F
SHA-512:	689A00405F0F62918AE6B9258DA93DFA2F409D67ADF6DC0E30FC53382BE8A7D11529DC5C001B3C56242303638AA1BD1D6A1C01CAE26E7EDE3B02E3EA4B4E61A7
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12287.REALTIME=1735963408297825.MONOTONIC=453605262.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127EoQtbV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.496365373713446
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff68CgERh8qwrit6S:qgFq30dABibBAgE3TIS
MD5:	B8FD8ABB50ADD005A30C9E09C2695F77
SHA1:	388F98009584BE852215679395E7D485F94FF078
SHA-256:	CC30303FD695F97C136B9FE10FA96AD569C0DE9C6D48010C273C5708EA9DA40B
SHA-512:	3125FF633CAD75DA47933C44C292BF7EF3977BF500970BA0C2A42A199053B5B1C9E16026225CB9D664EB5BD8F92E531FEEDE64AE0B98F0024B1FE28EA34CB1DB
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12349.REALTIME=1735963408297825.MONOTONIC=453605262.LAST_SESSION_TIMESTAMP=453696151.

/run/systemd/users/.#127T8ZRrT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.3441116931411266
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgA1R3MuADqx4SCTr6H206qodI:SbFuFyL3BVgdL87iesnAiRJgERh8qwrE
MD5:	7DA56C00073D69A81C3E493D066A4D06
SHA1:	2377C5BC0A6D1AF203508C64329A8B5D200526B4
SHA-256:	D5D60E3E21FF4777CAFBBC8125162A36ADDCFE9EF46D2731F700F949033ACD31
SHA-512:	FD54A02DE0FE671B265EE425F56B006A40C647E7706CEA9246F6BF9F50637DCCD6E1E2FEFDEF5C52E3C4E25A72B2E2D17F96D8F0DAC16ECA735E949411FE8B9D
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1735963408297825.MONOTONIC=453605262.LAST_SESSION_TIMESTAMP=453696151.

/run/systemd/users/.#127eIAUfT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.321113364258541
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6NEJgERh8qwpsQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEEJgE3KsjthQHtPYb
MD5:	3B4677DDCD4CFAC03A98BEA381B03FA2
SHA1:	20FB2D7D07D9D42DA663B56A0858C6D3F8C44DB1
SHA-256:	36C354074B8DE68795904CC469FB57E3D86C7242E73476EF15A767B8966F402F
SHA-512:	689A00405F0F62918AE6B9258DA93DFA2F409D67ADF6DC0E30FC53382BE8A7D11529DC5C001B3C56242303638AA1BD1D6A1C01CAE26E7EDE3B02E3EA4B4E61A7
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12287.REALTIME=1735963408297825.MONOTONIC=453605262.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127pdKiTV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127vKXJqV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.496365373713446
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff68CgERh8qwrit6S:qgFq30dABibBAgE3TIS
MD5:	B8FD8ABB50ADD005A30C9E09C2695F77
SHA1:	388F98009584BE852215679395E7D485F94FF078
SHA-256:	CC30303FD695F97C136B9FE10FA96AD569C0DE9C6D48010C273C5708EA9DA40B
SHA-512:	3125FF633CAD75DA47933C44C292BF7EF3977BF500970BA0C2A42A199053B5B1C9E16026225CB9D664EB5BD8F92E531FEEDE64AE0B98F0024B1FE28EA34CB1DB
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12349.REALTIME=1735963408297825.MONOTONIC=453605262.LAST_SESSION_TIMESTAMP=453696151.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:c6:c6
MD5:	EECFCEBBE2BFEB882B4A9985759B6DD3
SHA1:	A77C41C91AF8CE5F06FB64BD92971B08F3745F0D
SHA-256:	B91B75CBC42D078630D8032195BE2E7688C62AF30BEB8D5A145220C1F5484FED
SHA-512:	557A053D9B36CABBC5369496F2DEE9B63930CFF70C164230B8F392BB21C752F48E344D1E80B87D1E68224C8AE838CA6F0AB1F1771701E4696CFC5EAE190201F8
Malicious:	false
Preview:	6325.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6516795542818556
Encrypted:	false
SSDEEP:	3:q0sXlXEWtl/a8W2lt:qV+ylCW
MD5:	D3E7F740E209CED63537A5CEDD8E22AC
SHA1:	1D41D19016D34103327DF71F59335A896FD66B2E
SHA-256:	7F7948EF642B7B0476C5E6EE1974AAA6096C2F81D7A5B25F1AD1BB291CD49CE9
SHA-512:	5DA6FD454CFAD6D5C83666410F50E16592D11CF962D490FC9FE450086390C26D5FFC08D06522BBE6E1B8E62960D6E6684450C35DF2A5BAC1C1807F6FFB89D71E
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN.....................................................................................................................................................................................................................................................................................................xg........................................

/var/lib/AccountsService/users/gdm.OMVQZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	678
Entropy (8bit):	4.768266152672014
Encrypted:	false
SSDEEP:	12:oHeF0hLadPHeFrjT4p1Wr4VHeF0nCLGaWr4oJeF0hLajOTFX7zfbZUQU:4sOj0pYr4xTJr4CrCQU
MD5:	9DD57F1D5AC733307CB6064D77EA6708
SHA1:	BC2D99415E2966C95D48125C7B0D99640F16710B
SHA-256:	D68A27C2A769623B6FEC6A3C7AAD22F6D97262CFB674C835A2519F51976958FD
SHA-512:	27CC4DE669E5A20D63220858F18CB08B92D1092CAB92F53237E0CB4D2309878DFB315863AF943579F446A7F4A3ADF8BB52460B9436956C8855E6B5E4CDC330BB
Malicious:	false
Preview:	Jan 3 22:03:28 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Jan 3 22:03:28 galassia systemd-logind[6331]: Failed to start session scope session-c1.scope: Unit session-c1.scope already exists..Jan 3 22:03:28 galassia gdm-launch-environment]: pam_systemd(gdm-launch-environment:session): Failed to create session: Unit session-c1.scope already exists..Jan 3 22:03:29 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session closed for user gdm.Jan 3 22:03:37 galassia dbus-daemon[6313]: [system] Failed to activate service 'org.bluez': timed out (service_start_timeout=25000ms).

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31HlwTOKtlYTOu:F3gTOLTOu
MD5:	6431F734CAAB0DEFF3EBD1775F24A2AC
SHA1:	1326C2018E00A1E1AF5E6B026F749FDED2AF9F0C
SHA-256:	4A69B7C5EAE5FCF51ACC3EAB432080CCAEE799947D714482BA8E4999ABA7A54D
SHA-512:	52ECF13302469E785C51317F551D79A104B0BFA34A635A0841E49EEED2BCBA976ECE2DEF2DE27196B73FCA6363E6100045286E475D247F0F9ACFD480EB85149A
Malicious:	false
Preview:	LPKSHHRH.................t%.{.@5.....y...................................t%.{.@5.....y..........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31Hlplhtl:F3Zlx
MD5:	FFF20FF853B401D2ACBA56EE60A4112F
SHA1:	92C2F75DA6CA9FFB1CA0DC18AAD382138EF1F470
SHA-256:	6F4E8F73FAB28EBCF2D4EFD2B76E8389513B1C1D9F26B4212FE708A6EDFBD484
SHA-512:	141274A215A7D3FAF516D125AA5E7FCA3C880C1198909402E852E9621CF55B54790741FA424E2EA52966D9C2E3283799DA85D07DE9A30BD6BA9556E73937B3F4
Malicious:	false
Preview:	LPKSHHRH................._..v.C.......n.................................._..v.C.......n.........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	CSV text
Category:	dropped
Size (bytes):	9506
Entropy (8bit):	4.986623827116881
Encrypted:	false
SSDEEP:	96:DGkBxU8oZ8PPA0l7ndB2luFuHuXWOr8M2OrsY1MuACUG/4dSebVseJYcBjeu1y0p:ZxBMy4ar8lUsdbVVP
MD5:	05454B6DE36405A1868084474FA84D9B
SHA1:	179113DB0BBFC5AA7275999274980CAFEB5C6D02
SHA-256:	9DC82CB350ECAB3D361E2B5CCA018DF18ED4988C1F869E117B7BE67B23E8C5E3
SHA-512:	E640EFB9001D4D043BE78776BA8C1E27B7C80C6B2290FFFEB34BDD6B9A2AE8882C721E2F526C22F0A0DCECB43E170980D9E82133D9E95BC7E46E58F5A14BFCC4
Malicious:	false
Preview:	Jan 3 22:03:12 galassia kernel: [ 436.483582] New task spawned: old: (tgid 6413, tid 6413), new (tgid: 6414, tid: 6414).Jan 3 22:03:12 galassia kernel: [ 436.860369] New task spawned: old: (tgid 6401, tid 6401), new (tgid: 6415, tid: 6415).Jan 3 22:03:12 galassia kernel: [ 436.905661] New task spawned: old: (tgid 6415, tid 6415), new (tgid: 6416, tid: 6416).Jan 3 22:03:12 galassia kernel: [ 437.222258] New task spawned: old: (tgid 6401, tid 6401), new (tgid: 6418, tid: 6418).Jan 3 22:03:12 galassia kernel: [ 437.297098] New task spawned: old: (tgid 6418, tid 6418), new (tgid: 6419, tid: 6419).Jan 3 22:03:12 galassia kernel: [ 437.397697] New task spawned: old: (tgid 6325, tid 6325), new (tgid: 6325, tid: 6420).Jan 3 22:03:12 galassia kernel: [ 437.466989] New task spawned: old: (tgid 6417, tid 6417), new (tgid: 6417, tid: 6421).Jan 3 22:03:12 galassia kernel: [ 437.468561] New task spawned: old: (tgid 6417, tid 6417), new (tgid: 6417, tid: 6422).Jan 3 22:03:12 galassia

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	29416
Entropy (8bit):	5.030068343856199
Encrypted:	false
SSDEEP:	768:ETfhhMeyss2i4sMI7P1xLp1rnk4m2sg6OhN3T/zNSS+gf5tzy0A+MGageLXN1j3Y:2yl
MD5:	EC043DC3D01A2127CBCA7D61A536BA93
SHA1:	2E94631ECAF62FC752FE114E88CF02923EF8BC33
SHA-256:	A2B5AAABD6CED82B44B0446C58645911B509C7955F427A17766AC31206FF5D92
SHA-512:	A2D7D140B880DA90A83D1DE0037C86DFC7453904ADB09159FFAE0A35B34E38EA74E2A44C0BA3E65874C696556BA4C892CCB62E97BF482D65315CC2302FD53D20
Malicious:	false
Preview:	Jan 3 22:03:11 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Jan 3 22:03:12 galassia kernel: [ 436.483582] New task spawned: old: (tgid 6413, tid 6413), new (tgid: 6414, tid: 6414).Jan 3 22:03:12 galassia kernel: [ 436.860369] New task spawned: old: (tgid 6401, tid 6401), new (tgid: 6415, tid: 6415).Jan 3 22:03:12 galassia kernel: [ 436.905661] New task spawned: old: (tgid 6415, tid 6415), new (tgid: 6416, tid: 6416).Jan 3 22:03:12 galassia kernel: [ 437.222258] New task spawned: old: (tgid 6401, tid 6401), new (tgid: 6418, tid: 6418).Jan 3 22:03:12 galassia kernel: [ 437.297098] New task spawned: old: (tgid 6418, tid 6418), new (tgid: 6419, tid: 6419).Jan 3 22:03:12 galassia kernel: [ 437.397697] New task spawned: old: (tgid 6325, tid 6325), new (tgid: 6325, tid: 6420).Jan 3 22:03:12 galassia kernel: [ 437.466989] New task spawned: old: (tgid 6417, tid 6417), new (tgid: 6417, tid: 6421).Jan 3 22:03:11 galassia systemd[1]: rsyslog

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6516795542818556
Encrypted:	false
SSDEEP:	3:q0sXlXEWtl/a8W2lt:qV+ylCW
MD5:	D3E7F740E209CED63537A5CEDD8E22AC
SHA1:	1D41D19016D34103327DF71F59335A896FD66B2E
SHA-256:	7F7948EF642B7B0476C5E6EE1974AAA6096C2F81D7A5B25F1AD1BB291CD49CE9
SHA-512:	5DA6FD454CFAD6D5C83666410F50E16592D11CF962D490FC9FE450086390C26D5FFC08D06522BBE6E1B8E62960D6E6684450C35DF2A5BAC1C1807F6FFB89D71E
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN.....................................................................................................................................................................................................................................................................................................xg........................................

Source: Fantazy.x86.elf	ReversingLabs: Detection: 71%
Source: Fantazy.x86.elf	Virustotal: Detection: 62%			Perma Link

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.424990935607076
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	Fantazy.x86.elf
File size:	70'416 bytes
MD5:	14e825fe3753a3f154f4cbd84d0f7a0b
SHA1:	1efc80d5a8637d97b2359c6dc57b5b83bf4c645e
SHA256:	a1dcf02177b2755852b7045242fad9b5d452b5abcb7cc077a9f4e8cb47a94a16
SHA512:	f34da54d4d781df22103441616ce02a3c115f8340ed4020f0b326aba5ea2704c2834dc8b53071ebadbad68eee0bb30c618d2bdcf182600b54c6ef2dacf42b4e7
SSDEEP:	1536:mOhjXtM7ayXRulHeEqPZTSgLDi8eKcJ37w0hRX84:mkXO7ayUJeEmZTS2D9eKcFMQRX8
TLSH:	F1634BC8A4D3F9F0DC150A3D747AAB725A77F13B2139ED9FD7A81966A802302D40239D
File Content Preview:	.ELF....................d...4...........4. ...(.....................`...`...........................@... ...........Q.td............................U..S.......w....h........[]...$.............U......=@....t..5....$......$.......u........t....h`...........

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	70016
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0xf4b6	0x0	0x6	AX	16
.fini	PROGBITS	0x8057566	0xf566	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x8057580	0xf580	0x13e0	0x0	0x2	A	32
.ctors	PROGBITS	0x8059000	0x11000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x8059008	0x11008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x8059020	0x11020	0x120	0x0	0x3	WA	32
.bss	NOBITS	0x8059140	0x11140	0x8e0	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x11140	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x10960	0x10960	6.5349	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x11000	0x8059000	0x8059000	0x140	0xa20	4.5767	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 4, 2025 05:03:10.378983974 CET	192.168.2.23	1.1.1.1	0x4163	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 4, 2025 05:03:10.378983974 CET	192.168.2.23	1.1.1.1	0xba0	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Jan 4, 2025 05:03:10.724953890 CET	192.168.2.23	1.1.1.1	0xef3e	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 4, 2025 05:03:10.386300087 CET	1.1.1.1	192.168.2.23	0x4163	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Jan 4, 2025 05:03:10.386300087 CET	1.1.1.1	192.168.2.23	0x4163	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2025-01-04 04:03:14 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2025-01-04 04:03:14 UTC	25	IN	HTTP/1.1 100 Continue
2025-01-04 04:03:14 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2025-01-04 04:03:14 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2025-01-04 04:03:14 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2025-01-04 04:03:14 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2025-01-04 04:03:14 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2025-01-04 04:03:14 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2025-01-04 04:03:14 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2025-01-04 04:03:14 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2025-01-04 04:03:14 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2025-01-04 04:03:14 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2025-01-04 04:03:14 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Sat, 04 Jan 2025 04:03:14 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	04:02:41
Start date (UTC):	04/01/2025
Path:	/tmp/Fantazy.x86.elf
Arguments:	/tmp/Fantazy.x86.elf
File size:	70416 bytes
MD5 hash:	14e825fe3753a3f154f4cbd84d0f7a0b

Start time (UTC):	04:02:48
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	04:02:50
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	04:03:07
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	04:03:08
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	04:03:09
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	04:03:10
Start date (UTC):	04/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	04:03:11
Start date (UTC):	04/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	04:03:12
Start date (UTC):	04/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	04:03:15
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	04:03:13
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	04:03:25
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Fantazy.x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6466/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:75586yB5T2O

/run/systemd/journal/streams/.#9:756000p44hO

/run/systemd/journal/streams/.#9:75667Mwq23N

/run/systemd/journal/streams/.#9:75668GwduIL

/run/systemd/journal/streams/.#9:75688BZzceO

/run/systemd/journal/streams/.#9:76240PLgjeP

/run/systemd/journal/streams/.#9:76241TR16KO

/run/systemd/journal/streams/.#9:76723IYxNDN

/run/systemd/journal/streams/.#9:77919xR56cM

/run/systemd/journal/streams/.#9:779304tGQ1M

/run/systemd/journal/streams/.#9:77935lH9ICN

/run/systemd/journal/streams/.#9:78092Q5OfuN

/run/systemd/journal/streams/.#9:78129PnEHAO

/run/systemd/journal/streams/.#9:78255KQAUeP

/run/systemd/journal/streams/.#9:78273MbKmBO

/run/systemd/journal/streams/.#9:78274T4PFNM

/run/systemd/journal/streams/.#9:78290LxnCZN

/run/systemd/journal/streams/.#9:78291si0IaP

/run/systemd/journal/streams/.#9:79188KvfXFM

/run/systemd/seats/.#seat09O9glT

/run/systemd/seats/.#seat0eeAtaU

/run/systemd/users/.#12790ByLV

/run/systemd/users/.#127EoQtbV

/run/systemd/users/.#127T8ZRrT

Linux Analysis Report
Fantazy.x86.elf

Start time (UTC):	04:03:27
Start date (UTC):	04/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	04:03:28
Start date (UTC):	04/01/2025
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	04:03:29
Start date (UTC):	04/01/2025
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Start time (UTC):	04:03:26
Start date (UTC):	04/01/2025
Path:	/usr/lib/accountsservice/accounts-daemon
Arguments:	-
File size:	203192 bytes
MD5 hash:	01a899e3fb5e7e434bea1290255a1f30

Start time (UTC):	04:03:50
Start date (UTC):	04/01/2025
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Start time (UTC):	04:05:20
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre