Edit tour

Linux Analysis Report
Fantazy.mips.elf

Overview

General Information

Sample name:	Fantazy.mips.elf
Analysis ID:	1584091
MD5:	92132a4b27277a33780cf9a73715a7c3
SHA1:	e978a3df576a22c98e48f6b9fd4169d8c16ea5a2
SHA256:	289426e2a50923277ee9ed047e4ef985b91306a66463492a31e28b6f47801cc7
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584091
Start date and time:	2025-01-04 05:47:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Fantazy.mips.elf
Detection:	MAL
Classification:	mal68.spre.troj.linELF@0/42@3/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing network information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/Fantazy.mips.elf
PID:	6216
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	VegaSec-KATANA001
Standard Error:

Process Tree

system is lnxubuntu20

Fantazy.mips.elf (PID: 6216, Parent: 6133, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/Fantazy.mips.elf

Fantazy.mips.elf New Fork (PID: 6218, Parent: 6216)

Fantazy.mips.elf New Fork (PID: 6220, Parent: 6216)

Fantazy.mips.elf New Fork (PID: 6222, Parent: 6220)

Fantazy.mips.elf New Fork (PID: 6223, Parent: 6220)

Fantazy.mips.elf New Fork (PID: 6226, Parent: 6220)

systemd New Fork (PID: 6233, Parent: 1)

journalctl (PID: 6233, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6248, Parent: 1)

systemd-journald (PID: 6248, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6250, Parent: 1)

journalctl (PID: 6250, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6298, Parent: 1)

dbus-daemon (PID: 6298, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6320, Parent: 1860)

pulseaudio (PID: 6320, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6324, Parent: 1)

rtkit-daemon (PID: 6324, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6327, Parent: 1)

systemd-logind (PID: 6327, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6389, Parent: 1)

polkitd (PID: 6389, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6394, Parent: 1)

agetty (PID: 6394, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 6395, Parent: 1320)

Default (PID: 6395, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6396, Parent: 1320)

Default (PID: 6396, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6397, Parent: 1320)

Default (PID: 6397, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6398, Parent: 1)

gpu-manager (PID: 6398, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6399, Parent: 6398)

sh (PID: 6399, Parent: 6398, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6400, Parent: 6399)

grep (PID: 6400, Parent: 6399, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6403, Parent: 6398)

sh (PID: 6403, Parent: 6398, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6404, Parent: 6403)

grep (PID: 6404, Parent: 6403, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6405, Parent: 6398)

sh (PID: 6405, Parent: 6398, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6406, Parent: 6405)

grep (PID: 6406, Parent: 6405, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6410, Parent: 6398)

sh (PID: 6410, Parent: 6398, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6413, Parent: 6410)

grep (PID: 6413, Parent: 6410, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6415, Parent: 6398)

sh (PID: 6415, Parent: 6398, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6416, Parent: 6415)

grep (PID: 6416, Parent: 6415, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6417, Parent: 6398)

sh (PID: 6417, Parent: 6398, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6418, Parent: 6417)

grep (PID: 6418, Parent: 6417, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6419, Parent: 6398)

sh (PID: 6419, Parent: 6398, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6420, Parent: 6419)

grep (PID: 6420, Parent: 6419, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6421, Parent: 6398)

sh (PID: 6421, Parent: 6398, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6422, Parent: 6421)

grep (PID: 6422, Parent: 6421, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6402, Parent: 1)

rsyslogd (PID: 6402, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6424, Parent: 1)

generate-config (PID: 6424, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6425, Parent: 6424)

pkill (PID: 6425, Parent: 6424, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6426, Parent: 1)

gdm-wait-for-drm (PID: 6426, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6431, Parent: 1)

gdm3 (PID: 6431, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6436, Parent: 6431)

plymouth (PID: 6436, Parent: 6431, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6454, Parent: 6431)

gdm-session-worker (PID: 6454, Parent: 6431, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6460, Parent: 6454)

gdm-wayland-session (PID: 6460, Parent: 6454, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6462, Parent: 6460)

dbus-daemon (PID: 6462, Parent: 6460, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6464, Parent: 6462)

dbus-daemon New Fork (PID: 6465, Parent: 6464)

false (PID: 6465, Parent: 6464, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6466, Parent: 6460)

dbus-run-session (PID: 6466, Parent: 6460, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6467, Parent: 6466)

dbus-daemon (PID: 6467, Parent: 6466, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6468, Parent: 6431)

Default (PID: 6468, Parent: 6431, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6469, Parent: 6431)

Default (PID: 6469, Parent: 6431, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6437, Parent: 1)

accounts-daemon (PID: 6437, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6449, Parent: 6437)

language-validate (PID: 6449, Parent: 6437, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6450, Parent: 6449)

language-options (PID: 6450, Parent: 6449, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6451, Parent: 6450)

sh (PID: 6451, Parent: 6450, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6452, Parent: 6451)

locale (PID: 6452, Parent: 6451, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6453, Parent: 6451)

grep (PID: 6453, Parent: 6451, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

gvfsd-fuse New Fork (PID: 6483, Parent: 2038)

fusermount (PID: 6483, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

cleanup

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6402)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /tmp/Fantazy.mips.elf (PID: 6216)	Socket: 127.0.0.1:59025	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6431)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6462)	Socket: unknown address family	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.243
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.243
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.243
Source: unknown	TCP traffic detected without corresponding DNS query: 182.44.221.138
Source: unknown	TCP traffic detected without corresponding DNS query: 103.122.234.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.175.127.138
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.196.141
Source: unknown	TCP traffic detected without corresponding DNS query: 167.75.38.55
Source: unknown	TCP traffic detected without corresponding DNS query: 165.242.59.2
Source: unknown	TCP traffic detected without corresponding DNS query: 175.23.212.246
Source: unknown	TCP traffic detected without corresponding DNS query: 12.69.208.164
Source: unknown	TCP traffic detected without corresponding DNS query: 162.139.138.64
Source: unknown	TCP traffic detected without corresponding DNS query: 151.85.220.248
Source: unknown	TCP traffic detected without corresponding DNS query: 222.127.129.12
Source: unknown	TCP traffic detected without corresponding DNS query: 63.107.93.77
Source: unknown	TCP traffic detected without corresponding DNS query: 43.194.115.144
Source: unknown	TCP traffic detected without corresponding DNS query: 124.43.199.128
Source: unknown	TCP traffic detected without corresponding DNS query: 222.87.232.191
Source: unknown	TCP traffic detected without corresponding DNS query: 194.159.40.34
Source: unknown	TCP traffic detected without corresponding DNS query: 53.52.150.5
Source: unknown	TCP traffic detected without corresponding DNS query: 149.192.216.108
Source: unknown	TCP traffic detected without corresponding DNS query: 174.206.37.136
Source: unknown	TCP traffic detected without corresponding DNS query: 158.137.251.27
Source: unknown	TCP traffic detected without corresponding DNS query: 175.84.191.106
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.243
Source: unknown	TCP traffic detected without corresponding DNS query: 172.82.191.143
Source: unknown	TCP traffic detected without corresponding DNS query: 53.22.63.136
Source: unknown	TCP traffic detected without corresponding DNS query: 2.246.2.203
Source: unknown	TCP traffic detected without corresponding DNS query: 166.232.130.47
Source: unknown	TCP traffic detected without corresponding DNS query: 4.207.190.54
Source: unknown	TCP traffic detected without corresponding DNS query: 209.15.120.238
Source: unknown	TCP traffic detected without corresponding DNS query: 168.113.70.73
Source: unknown	TCP traffic detected without corresponding DNS query: 71.198.156.153
Source: unknown	TCP traffic detected without corresponding DNS query: 119.1.208.184
Source: unknown	TCP traffic detected without corresponding DNS query: 153.152.74.192
Source: unknown	TCP traffic detected without corresponding DNS query: 76.223.165.94
Source: unknown	TCP traffic detected without corresponding DNS query: 176.67.91.55
Source: unknown	TCP traffic detected without corresponding DNS query: 122.192.24.192
Source: unknown	TCP traffic detected without corresponding DNS query: 170.94.212.22
Source: unknown	TCP traffic detected without corresponding DNS query: 218.245.114.242
Source: unknown	TCP traffic detected without corresponding DNS query: 23.244.184.67
Source: unknown	TCP traffic detected without corresponding DNS query: 145.228.77.148
Source: unknown	TCP traffic detected without corresponding DNS query: 161.122.228.173
Source: unknown	TCP traffic detected without corresponding DNS query: 70.200.133.254
Source: unknown	TCP traffic detected without corresponding DNS query: 13.91.12.135
Source: unknown	TCP traffic detected without corresponding DNS query: 111.196.200.216
Source: unknown	TCP traffic detected without corresponding DNS query: 13.142.221.176
Source: unknown	TCP traffic detected without corresponding DNS query: 78.74.102.132
Source: unknown	TCP traffic detected without corresponding DNS query: 151.31.219.126
Source: unknown	TCP traffic detected without corresponding DNS query: 60.135.224.30

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.51.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53716
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 6043, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 6191, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 6192, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 6220, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 6223, result: unknown	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 6043, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 6191, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 6192, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 6220, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	SIGKILL sent: pid: 6223, result: unknown	Jump to behavior

Source: classification engine

Classification label: mal68.spre.troj.linELF@0/42@3/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6298)	File: /proc/6298/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6462)	File: /proc/6462/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6467)	File: /proc/6467/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6483)	File: /proc/6483/mounts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:76029k8Fb4F	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:76030AZbrvC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:75339lzxH4F	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:75531ZUdeiG	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:75539UzX4jD	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:76847d73JXB	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:768489TWz8F	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:76970FpKtjC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:77014bYQtYB	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:76534lQmRQD	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:7663412ZNkD	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:76737zDoowC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:76793GqTATD	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:77930LUa6lC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:77988ozuK8C	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:77990vHkV7C	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:78093vtjKBC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:780989DCm8C	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6327)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6327)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6327)	File: /run/systemd/seats/.#seat0if5zmC	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6327)	File: /run/systemd/users/.#127mKcl2D	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6327)	File: /run/systemd/users/.#127OSQXlC	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6327)	File: /run/systemd/seats/.#seat0hj1rxD	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6327)	File: /run/systemd/users/.#127q5zBfE	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6327)	File: /run/systemd/users/.#1274N9PAE	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6327)	File: /run/systemd/users/.#127K66vYA	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6327)	File: /run/systemd/users/.#1279DUpQA	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6389)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6460)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6437)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6437)	Directory: /root/.cache	Jump to behavior

Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6460/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6298/status	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6298/attr/current	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6320/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6320/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6320/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6454/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6454/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6431/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6324/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6389/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/1389/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6317/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6317/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6327/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6437/cmdline	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/1582/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/2033/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/3088/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/6191/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/6192/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/1579/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/1612/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/1335/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/1334/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/1576/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/2302/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/910/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/4444/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/4445/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/912/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/4446/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/517/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/759/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/2307/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/918/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/1594/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/2285/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/2281/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/1349/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/761/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/884/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/2038/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/1344/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/1465/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/1586/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/1860/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/1463/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/800/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/801/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/4470/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/4474/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/3021/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/491/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/2294/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/772/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/1599/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/774/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/1477/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/654/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/896/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/1476/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/1872/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/2048/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/655/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/1475/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/2289/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/777/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/656/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/657/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/658/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/4467/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/419/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/936/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/2208/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/2180/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/4480/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/1494/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/1886/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/420/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/1489/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/785/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/788/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/667/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/789/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/6155/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/670/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/2746/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/793/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/674/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/1532/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/796/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/675/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/797/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/676/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/677/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/799/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/2749/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/6043/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/6165/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/1389/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/720/maps	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6223)	File opened: /proc/721/maps	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6399)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6403)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6405)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6410)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6415)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6417)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6419)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6421)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6451)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Source: /bin/sh (PID: 6400)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6404)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6406)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6413)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6416)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6418)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6420)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6422)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6453)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6425)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6248)

Reads from proc file: /proc/meminfo

Jump to behavior

Source: /sbin/agetty (PID: 6394)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6431)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6431)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6437)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6437)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6398)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6402)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6402)	Log file created: /var/log/auth.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 6398)

Truncated file: /var/log/gpu-manager.log

Jump to behavior

Source: /usr/bin/pulseaudio (PID: 6320)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pkill (PID: 6425)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /tmp/Fantazy.mips.elf (PID: 6216)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6320)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6394)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6398)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6402)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6454)	Queries kernel information via 'uname':	Jump to behavior

Source: Fantazy.mips.elf, 6223.1.00007ffc888ac000.00007ffc888cd000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.xkcMHI
Source: syslog.51.dr	Binary or memory string: Jan 3 22:48:29 galassia kernel: [ 454.851020] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: Fantazy.mips.elf, 6223.1.00007ffc888ac000.00007ffc888cd000.rw-.sdmp	Binary or memory string: CV/tmp/qemu-open.xkcMHI
Source: Fantazy.mips.elf, 6216.1.00005643dcfa0000.00005643dd027000.rw-.sdmp, Fantazy.mips.elf, 6218.1.00005643dcfa0000.00005643dd027000.rw-.sdmp, Fantazy.mips.elf, 6220.1.00005643dcfa0000.00005643dd027000.rw-.sdmp, Fantazy.mips.elf, 6222.1.00005643dcfa0000.00005643dd027000.rw-.sdmp, Fantazy.mips.elf, 6223.1.00005643dcfa0000.00005643dd027000.rw-.sdmp	Binary or memory string: CV!/etc/qemu-binfmt/mips
Source: Fantazy.mips.elf, 6216.1.00005643dcfa0000.00005643dd027000.rw-.sdmp, Fantazy.mips.elf, 6218.1.00005643dcfa0000.00005643dd027000.rw-.sdmp, Fantazy.mips.elf, 6220.1.00005643dcfa0000.00005643dd027000.rw-.sdmp, Fantazy.mips.elf, 6222.1.00005643dcfa0000.00005643dd027000.rw-.sdmp, Fantazy.mips.elf, 6223.1.00005643dcfa0000.00005643dd027000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: Fantazy.mips.elf, 6216.1.00007ffc888ac000.00007ffc888cd000.rw-.sdmp, Fantazy.mips.elf, 6218.1.00007ffc888ac000.00007ffc888cd000.rw-.sdmp, Fantazy.mips.elf, 6220.1.00007ffc888ac000.00007ffc888cd000.rw-.sdmp, Fantazy.mips.elf, 6222.1.00007ffc888ac000.00007ffc888cd000.rw-.sdmp, Fantazy.mips.elf, 6223.1.00007ffc888ac000.00007ffc888cd000.rw-.sdmp	Binary or memory string: 4GW`7\|x86_64/usr/bin/qemu-mips/tmp/Fantazy.mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Fantazy.mips.elf
Source: Fantazy.mips.elf, 6216.1.00007ffc888ac000.00007ffc888cd000.rw-.sdmp, Fantazy.mips.elf, 6218.1.00007ffc888ac000.00007ffc888cd000.rw-.sdmp, Fantazy.mips.elf, 6220.1.00007ffc888ac000.00007ffc888cd000.rw-.sdmp, Fantazy.mips.elf, 6222.1.00007ffc888ac000.00007ffc888cd000.rw-.sdmp, Fantazy.mips.elf, 6223.1.00007ffc888ac000.00007ffc888cd000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips
Source: syslog.51.dr	Binary or memory string: Jan 3 22:48:29 galassia kernel: [ 454.851050] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6437)

Logged in records file read: /var/log/wtmp

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Fantazy.mips.elf	56%	Virustotal		Browse
Fantazy.mips.elf	61%	ReversingLabs	Linux.Trojan.Mirai
Fantazy.mips.elf	100%	Avira	EXP/ELF.Gafgyt.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.51.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
170.233.22.195	unknown	Brazil	61857	SPEEDFASTTELECOMLTDABR	false
208.75.77.19	unknown	United States	55095	AS-NFLXCORPUS	false
36.122.243.131	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
99.60.170.199	unknown	United States	7018	ATT-INTERNET4US	false
48.143.50.210	unknown	United States	2686	ATGS-MMD-ASUS	false
174.195.62.16	unknown	United States	22394	CELLCOUS	false
119.4.208.118	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
171.255.250.165	unknown	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	false
114.105.158.104	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
148.82.17.94	unknown	Norway	2116	ASN-CATCHCOMNO	false
105.129.198.45	unknown	Morocco	6713	IAM-ASMA	false
116.47.135.95	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
167.177.234.87	unknown	United States	7800	ALLINA-HEALTH-SYSTEM-INCUS	false
145.31.212.213	unknown	Netherlands	42894	MINVENW-RWSMinVenW-RijkswaterstaatBackboneNL	false
218.168.100.165	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
45.73.208.196	unknown	United States	36315	SERVPACUS	false
125.218.235.2	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
78.73.131.38	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
169.200.6.39	unknown	United States	37611	AfrihostZA	false
141.16.126.135	unknown	Germany	8204	FTA-NETDE	false
63.25.241.33	unknown	United States	701	UUNETUS	false
48.82.49.47	unknown	United States	2686	ATGS-MMD-ASUS	false
107.128.100.44	unknown	United States	7018	ATT-INTERNET4US	false
88.90.64.240	unknown	Norway	2119	TELENOR-NEXTELTelenorNorgeASNO	false
163.178.129.245	unknown	Costa Rica	11830	InstitutoCostarricensedeElectricidadyTelecomCR	false
60.68.83.136	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
104.93.240.25	unknown	United States	16625	AKAMAI-ASUS	false
199.90.172.102	unknown	United States	6559	NCIHUS	false
138.214.135.40	unknown	Canada	59121	AKNWS-NETAsahiKaseiNetworksCorporationJP	false
38.88.3.223	unknown	United States	174	COGENT-174US	false
100.10.227.140	unknown	United States	701	UUNETUS	false
158.122.6.135	unknown	United States	8151	UninetSAdeCVMX	false
48.94.45.14	unknown	United States	2686	ATGS-MMD-ASUS	false
217.47.24.122	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
59.185.248.12	unknown	India	17813	MTNL-APMahanagarTelephoneNigamLimitedIN	false
221.170.25.52	unknown	Japan	2518	BIGLOBEBIGLOBEIncJP	false
208.210.124.13	unknown	United States	701	UUNETUS	false
222.118.184.250	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
77.82.88.232	unknown	Russian Federation	34974	KAMCHATKA-ASKamchatkaRussiaRU	false
197.77.185.0	unknown	South Africa	16637	MTNNS-ASZA	false
191.169.241.76	unknown	Brazil	26615	TIMSABR	false
202.118.232.94	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
1.189.116.178	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
142.234.120.105	unknown	United States	7203	LEASEWEB-USA-SFO-12US	false
135.117.75.17	unknown	United States	10455	LUCENT-CIOUS	false
210.82.250.125	unknown	China	9929	CUIICHINAUNICOMIndustrialInternetBackboneCN	false
161.37.114.185	unknown	Spain	158	ERI-ASUS	false
104.194.91.134	unknown	Canada	25820	IT7NETCA	false
123.118.92.32	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
177.222.219.148	unknown	Brazil	263398	FAMATELTELECOMUNICACOESLTDA-MEBR	false
172.55.197.76	unknown	United States	21928	T-MOBILE-AS21928US	false
95.241.234.87	unknown	Italy	3269	ASN-IBSNAZIT	false
188.163.100.182	unknown	Ukraine	15895	KSNET-ASUA	false
211.100.3.16	unknown	China	23724	CHINANET-IDC-BJ-APIDCChinaTelecommunicationsCorporation	false
89.126.200.6	unknown	Ireland	25441	IBIS-ASImagineGroupLtdIE	false
31.253.231.85	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
88.211.64.79	unknown	United Kingdom	35575	VAIONIGB	false
96.198.255.194	unknown	United States	7922	COMCAST-7922US	false
151.75.172.163	unknown	Italy	1267	ASN-WINDTREIUNETEU	false
38.114.1.137	unknown	United States	174	COGENT-174US	false
161.87.121.133	unknown	Netherlands	14298	EPA-NETUS	false
213.139.224.40	unknown	Turkey	62240	CLOUVIDERClouvider-GlobalASNGB	false
27.36.101.217	unknown	China	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
175.145.32.89	unknown	Malaysia	4788	TMNET-AS-APTMNetInternetServiceProviderMY	false
216.242.92.146	unknown	United States	13645	BROADBANDONEUS	false
204.55.30.7	unknown	United States	10846	DEEREUS	false
113.6.132.92	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
98.220.85.28	unknown	United States	7922	COMCAST-7922US	false
74.24.64.167	unknown	United States	7922	COMCAST-7922US	false
72.31.135.200	unknown	United States	33363	BHN-33363US	false
151.11.252.129	unknown	Italy	1267	ASN-WINDTREIUNETEU	false
12.12.207.197	unknown	United States	32328	ALASCOM-IP-MANAGED-NETWORKUS	false
217.142.197.155	unknown	Sweden	16253	BORDERLIGHT-ASVretgrand18SE	false
146.179.197.107	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
57.49.43.21	unknown	Belgium	2686	ATGS-MMD-ASUS	false
61.235.214.235	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
14.251.73.101	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
141.219.187.33	unknown	United States	62618	MICHIGANTECHUS	false
114.94.141.17	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
75.93.164.12	unknown	United States	7029	WINDSTREAMUS	false
5.159.251.51	unknown	Turkey	41296	ABHTR	false
83.163.14.47	unknown	Netherlands	3265	XS4ALL-NLAmsterdamNL	false
32.191.38.211	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
104.15.61.78	unknown	United States	7018	ATT-INTERNET4US	false
148.21.99.83	unknown	United States	6400	CompaniaDominicanadeTelefonosSADO	false
5.40.165.97	unknown	Spain	43160	ES-MDC-DATACENTERMalagaDataCenterES	false
173.73.28.206	unknown	United States	701	UUNETUS	false
171.108.41.163	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
196.14.73.95	unknown	South Africa	3741	ISZA	false
146.170.80.27	unknown	United States	32448	METROCAST-1US	false
148.70.95.70	unknown	China	45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	false
156.5.244.54	unknown	United States	29975	VODACOM-ZA	false
121.85.170.12	unknown	Japan	17511	OPTAGEOPTAGEIncJP	false
66.92.108.29	unknown	United States	18566	MEGAPATH5-US	false
153.20.229.241	unknown	Singapore	9877	NGEEANN-POLY-AS-APNgeeAnnPolytechnicComputerCenterSG	false
35.247.173.1	unknown	United States	15169	GOOGLEUS	false
34.158.103.81	unknown	United States	2686	ATGS-MMD-ASUS	false
89.54.200.227	unknown	Germany	5430	FREENETDEfreenetDatenkommunikationsGmbHDE	false
117.142.104.28	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
20.53.37.124	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
170.233.22.195	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse
105.129.198.45	8jK7X0Nc8M.elf	Get hash	malicious	Mirai	Browse
141.16.126.135	tYV5avLJzh.elf	Get hash	malicious	Mirai	Browse
141.16.126.135	scorp.arm7	Get hash	malicious	Mirai	Browse
36.122.243.131	HA7lK6ldMO.elf	Get hash	malicious	Mirai	Browse
45.73.208.196	meerkat.mpsl.elf	Get hash	malicious	Mirai	Browse
167.177.234.87	4jWjSGM59f.elf	Get hash	malicious	Mirai, Moobot	Browse
171.255.250.165	botx.arm7	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	Fantazy.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	103.149.87.18-arm-2025-01-04T02_30_34.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	Fantazy.x86.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Fantazy.arm4.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	sshd.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNIX-APChinaNetworksInter-ExchangeCN	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	106.37.167.255
	31.13.224.14-x86-2025-01-03T22_14_18.elf	Get hash	malicious	Mirai	Browse	211.152.238.20
	armv6l.elf	Get hash	malicious	Mirai	Browse	117.113.63.133
	DEMONS.ppc.elf	Get hash	malicious	Unknown	Browse	1.202.84.210
	DEMONS.arm.elf	Get hash	malicious	Unknown	Browse	115.170.219.16
	DEMONS.x86.elf	Get hash	malicious	Unknown	Browse	58.133.127.119
	DEMONS.sh4.elf	Get hash	malicious	Unknown	Browse	117.114.147.247
	armv7l.elf	Get hash	malicious	Unknown	Browse	118.225.85.227
	loligang.mips.elf	Get hash	malicious	Mirai	Browse	116.157.131.27
	loligang.ppc.elf	Get hash	malicious	Mirai	Browse	58.131.3.73
SPEEDFASTTELECOMLTDABR	ru39M5F21m.elf	Get hash	malicious	Mirai	Browse	170.233.22.197
	LqNhg5Rbth.elf	Get hash	malicious	Mirai	Browse	170.233.22.179
	9TII6CvXZr.elf	Get hash	malicious	Unknown	Browse	170.233.22.198
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	170.233.22.195
	rsxUqSgaSh	Get hash	malicious	Mirai	Browse	170.233.22.188
	LLv0aMKzsK	Get hash	malicious	Mirai	Browse	170.233.22.185
	i686-20220401-2259	Get hash	malicious	Mirai Moobot	Browse	170.233.22.184
	PHOpfypfLN	Get hash	malicious	Mirai	Browse	170.233.22.185
	RRpFMwKS2V	Get hash	malicious	Mirai	Browse	170.233.22.167
ATT-INTERNET4US	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	68.94.90.188
	Fantazy.x86.elf	Get hash	malicious	Unknown	Browse	68.93.39.133
	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	104.186.136.213
	Fantazy.ppc.elf	Get hash	malicious	Unknown	Browse	99.161.251.67
	Fantazy.arm4.elf	Get hash	malicious	Unknown	Browse	69.230.36.212
	Josho.x86.elf	Get hash	malicious	Unknown	Browse	107.128.195.122
	31.13.224.14-mips-2025-01-03T22_14_18.elf	Get hash	malicious	Mirai	Browse	107.74.85.3
	31.13.224.14-x86-2025-01-03T22_14_18.elf	Get hash	malicious	Mirai	Browse	107.121.48.179
	1.elf	Get hash	malicious	Unknown	Browse	107.72.60.192
	3.elf	Get hash	malicious	Unknown	Browse	68.254.2.61
AS-NFLXCORPUS	RB9ztRoxZ5.elf	Get hash	malicious	Mirai	Browse	208.75.77.188
	in5cyuNWRq.elf	Get hash	malicious	Unknown	Browse	208.75.77.146
	Aa8DegXYI6.elf	Get hash	malicious	Mirai, Moobot	Browse	208.75.77.159
	KQqLTH9a0s.elf	Get hash	malicious	Unknown	Browse	208.75.77.153
	bot.arm	Get hash	malicious	Unknown	Browse	208.75.77.38
	1XHEUQ1mOz	Get hash	malicious	Mirai	Browse	208.75.77.187
	gkBMCovDLy	Get hash	malicious	Mirai	Browse	208.75.77.196
	557IyF5NeE	Get hash	malicious	Unknown	Browse	208.75.77.16

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/6465/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:9n:9n
MD5:	9D94E5F742CF43469192404C58E10F7F
SHA1:	372520B61DE467C05BB9A0ABE6831443E6502895
SHA-256:	56A031BF82BA0C233DB5782CCCDECEA15A4211E80813D0CD644922C5208D0CFF
SHA-512:	5F46B244AD5CD853394246CB3F680E568B758942CEEEDAE91036DE01176459A686A29951355C0F36232C5D43FC805688D53E8AD222FA7997976EDB72E62BD685
Malicious:	false
Reputation:	low
Preview:	6431.

/run/systemd/journal/streams/.#9:75339lzxH4F

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.39796181937214
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsGkWHd7cD000BFZjx:SbFuFyLVIg1BG+f+MstW9o0DZjosQu
MD5:	D456BFF6B2CB11AE3346C8E0FBD3376C
SHA1:	E064AC5985096E7CD3304D64B9EEDE59953E9A85
SHA-256:	86C5A32C0EDDF644CBAFF0FBB20DA27A5B0AC7307348D9366C66805E5C5EFD08
SHA-512:	DF2880B41C7FC4F6792EE0595964715035E2B0098FF1F5DFFCCCEB11FBE33229DBC79A6405CE50A5A787B06602095B8DE8455FA27CFFF2404A66244B6147285F
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fc723be16a7049f7a0b02130b99cd7bf.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:75531ZUdeiG

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.370620633909329
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M4XEy1uyRqjdCLKzK:qgFq6g10+f+M4Uy1xuCLAK
MD5:	85C691241722E24BC816383704CE37D0
SHA1:	B01E283DF29907F0C2A366181B47D3597D9D1080
SHA-256:	B386FDC6FEFFA0B39B9F55025E89D2AF7E9EB401381133F8F0CB45BD999AD0F8
SHA-512:	F431A286DEBA1D9D45E17F41A9ED26DE999B6F56B66D163600D7C6CE3A84B4E468317BE5D23546CD64DA5252EB58F6350C1699A97795AC11EC919D190F05DEEE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2e2a10dcf00141f9a73ad5782f3bd2c3.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:75539UzX4jD

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.320109347091989
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmv8vGzYR1rV22jshQJ:SbFuFyLVIg1BG+f+MkvGzEU2jtWL0
MD5:	3F1E2188FDD9D1CB02D75D10C7375DBD
SHA1:	31A72A9A297F225E6F253974B8DF8C5AFB389B3F
SHA-256:	83DB8FCF0BBEF374FCBB4BF3C945B11C903F928AC2D890D4144ABAB7C9D7236C
SHA-512:	5DA0D3E563C9BA78F624DA373EBDB48ADD5BC2A93B14481481AA6A029A3A2753B9D55EC36FC120A9CFA0AC2EC940924B750CC13372F6FC669C39052BAC59E8FC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ea0cc1c714cd4a17bdefa446a871a52f.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:76029k8Fb4F

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.527057913521573
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmofQfTQiHNrqjs7Lbr:SbFuFyLVIg1BG+f+Mo4UiH5qji4s
MD5:	8DEBB51119715B85EF8642CA19CAC5E8
SHA1:	C0B6BEB29C868BD1448930EFECC7DDC16E09D294
SHA-256:	C13DACD361127AB7E5359354C99D0AC17C70281162DFCCE8BA783C4565363190
SHA-512:	922F656FE44B5FD1B55D4EB5F3486469BD2C1F4EB0E421B309705C2FF4AF05AD7B83D62B899964DF4432C98622BFC6F179107B60399E2732FAAB47D94E708723
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b88572c1e8f24dffb0bdcc53302eca97.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76030AZbrvC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.544619110655627
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmogWKWac5uCAd5qjsv:SbFuFyLVIg1BG+f+MomWJIeji4s
MD5:	C5F7D50252148AEC332F8A7FD87F20E9
SHA1:	75465E090C7EF5F61DF36FBD409073750D5F155B
SHA-256:	68A71966E1D97A09822DA1E4002BD4F17C3466D0B63D2C8227E22577936BB349
SHA-512:	861D276661426BC40C754643544636D3BB1769E8FC032B28D2C7E596149837A45B20D995D5213E950FD9EA11888216D179B4F6AC342D93A7C72D176642DE783F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b5ac34f5344c46db9737a64524e927e8.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76534lQmRQD

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.44594302372752
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Myyf8yQJB0jdCt/rRMtq:qgFq6g10+f+MJf8yQeCDL
MD5:	997175E7AC96399C5B9F5CB094362634
SHA1:	1F75981A7109324ED9CB0E3247BFEAAA15E2B8FC
SHA-256:	64E818E60CDC2B778DD593D12B557C4448076F517769986BF283268C9B71BE87
SHA-512:	236E815D5C8FC8D14AA8650C1914E2A3D2497E0E828EDB43B21C3D18E9D0FFE6D37C29A56520DF44DA7F00A83ED3FA5E75CEB26F1E79261F82A74365D0AD5D46
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1754a4998e594a028fac0d15c5c6333d.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:7663412ZNkD

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.397062729737053
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmvXoRF3D3PXsjs2ALAXA:SbFuFyLVIg1BAf+MARl3UjNALyAZD
MD5:	1C073B149AAB5FA175E1E3B138573FB1
SHA1:	6D9DBC41BD90A0BAE4DE5443AE035FC11C6731BA
SHA-256:	CAAA69FBEE568A36AB4AF26D1BD11CE019F65E52B4F6FC078E6FD0D11DA31B6C
SHA-512:	026B0ED969CA4A3049985086A468C1A71C9699FB466BE2A8B594296820723874A79157DF4F1B1ED37D4F34EF6C095A1F44714618843DC9EE01BCB15E61E2CC28
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e3de9c3e8e8b4d419c3cac75e7e4684b.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76737zDoowC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.453360563061166
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+M+SUR0F6pAqjNdQIeXD:qgFq6g1af+M/I0Yj2D
MD5:	9AB6D07942CA4CDAA7B0027DDB9D2CEF
SHA1:	243E895582BFA912D8F3F26D9BA28549FB02745F
SHA-256:	294BB27E58708C8505D79041F23CAE106DF346A0AD665DBE652BB3FE327310D5
SHA-512:	58C1CFA04445BB0F7BC26DFBD5EDE9E4A6A45C642813CA9116593DFDC1DC4B95108865F1651625E755CC17E7004E15BD37919A81C3019B3C1439B5A59EFCB644
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=481f7cb3fcd14aa89ac956dcf8154dba.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76793GqTATD

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.413951049971155
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm5MSSTZWE0cZdd8hHshD:SbFuFyLVIg1BAf+MS7kcZ0hHRqjNTZD
MD5:	5A9D7211882A72123CA006AD3538A7CC
SHA1:	211D6FE4D5E6D220C83A742A7692C8C94B86925C
SHA-256:	AC9C5C8962084D52EFDDB16C6A9C38DEE1D25C1B8D04E4C06522F110223947B9
SHA-512:	19C1F77E340F0EADE43C72BBEF49A9CC89F350546380F726B820872DE112C65377C5EA571D1CDEF2280FA1E26F7EAB0C4E2ACE932B584192CA5F777E1CB25C14
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=36ec1d5766034cd7b9cf3f88803f821c.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76847d73JXB

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.433520472012941
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpnRQS3pGGUiglsjsx:SbFuFyLVIg1BG+f+Mj5RUiTjNE
MD5:	52E35B562D02E842E3F4B2F6CDC1B7D6
SHA1:	7EF440AE7A64C42DD44E12850A206EC29016C9D2
SHA-256:	00F929D5C761CC3E7C6EEE156EC28C40D20B2C7815158BF5659B309020552E31
SHA-512:	7E9F49AADE778181EF77C946159676D2A206FE08CDC45C876680DC2811E42C973F462211E1831E2F66E5A79E3B500DEA1BDB4090BE3A0CD9ABEA2C8C460A1DB8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c514f7396f30417da7d88d955c839cea.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:768489TWz8F

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.503487624377565
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpQgEdDgTGS0jsicWg:SbFuFyLVIg1BG+f+Mt8WIjZcHcljX+
MD5:	0B1F227C9F343B787AACB62797F8FE80
SHA1:	F4BEC701CA14F17CAFC4BF2FA94F911F7E109735
SHA-256:	03DD56FEABED8B163F2757491815D49167934B6A4051B3CA53845F7664B51AB8
SHA-512:	4918F4D33F90F727994C4D0F822B029B111013DCAB05D7AEFB3B8A9D2C73267874575AFE2CEB8D13B64D70E3F54674C0C17A1EA4201A4D525AB97778CADBF538
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c191b3a76a954e34881c2d0be6562854.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:76970FpKtjC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.441103528257298
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpyRQU3dsqqRFTATj0:SbFuFyLVIg1BG+f+MIVtZqRFTATjbVC
MD5:	94B1999F7AFA233A26F45D5CB5F969E8
SHA1:	D12F63B555E251CC1AE872093ABE4EA0438CC06B
SHA-256:	FAD481A4B58593F3538BF00D34D53BD99E0B995289174B4325C7182B92F76C98
SHA-512:	398004B713C31F95FD6759F0A6E0B6AFDC8F7F82D9A7F0605DC68542617791D1486FD8443A8D7206306B9AF380094935AC798A7669DFDE3AB6C9B04E161437B7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c9c42a45cf6e43ec86f17d79af455b26.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:77014bYQtYB

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.390065768248874
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MuHlfRLBRsrqjLkGq:qgFq6g10+f+MkJ1qT
MD5:	3A536E925D903125883F0B32A3B7ECC5
SHA1:	8FB19BD7DB6F1E683AC5678BB66A27924AE950C8
SHA-256:	7F6CB1BA45BBF189AA740E34FFA8F0101DF3D688875618421E09ACE9DC7E950F
SHA-512:	CF579B3921A9A915F1DFD844D30CD432C7151C85DFA35018B98364A86BBEE2135AD7C9C580E1E526143B36E7E904A00F553F06ACA1AE362E53D0151DF48A1CC3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=df64300e656d4e8487366cc6bd07efd1.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:77930LUa6lC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.469409516705897
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M82pCXUuqjLTTIWTIL:qgFq6g10+f+M82sb+EWEL
MD5:	1261E63525D3B4D750DC7E91AB4067B2
SHA1:	B83EA6DCCDAB494B13CF2D85080E63D22A19EC36
SHA-256:	375CA9D257CDB92B12DA3335A0AC5536FA04A9899419A63011925E8140893774
SHA-512:	86B130C22280736CE5507C5523B1FCA924644C3AFB4FD89E259E0EC4F5CE69862CF5371945C9BFA4BDCC31A116414933B1ADEE990A201C0E949720614832836D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=69b8626999af45b7b1929861143f4ece.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:77988ozuK8C

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.470596288247006
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm57dR9UL5CWoXsjk:SbFuFyLVK6g7/+BG+f+MlhU4cjNq
MD5:	CBC491B3CCE647F5E5FCDD9EFC8F616A
SHA1:	5242D67730577E0C5E9740A9EFAB1E4DDC9A7638
SHA-256:	7F1787C6A2B8D3019F355F9E4CC095EB3E4014B3A22D9B77EFCA5FB02DC29A88
SHA-512:	FFDBDF706AA26490424D7AAB5A3E673C2F672883DB5D0703DAF10FE968EC3CA1EF7538AAE11250B9C66253ADAD11F285095FEBDF5B2DB6A7AC521A0BF08390E5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=322db884c293491796e953f8cb42bc81.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:77990vHkV7C

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.404080232486048
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm/idxQQ7wgREvs2F:SbFuFyLVI6g7/+BG+f+M6dxdt2rqjNq
MD5:	6B64BC0C29D78F1BB9A424653153CA4C
SHA1:	736EDAFF55347BFB146E6259B2F39446844799B3
SHA-256:	37FC4AF75E6F289908E03D22560C07F4C515A14FEB4FF0ACC3AE382679EF4097
SHA-512:	3345AF3A8CB0D1BB47DFB9EA8D86B141A06C6D379FC55AAA38D47A870E0BBD881AF3B9184FEF6B160F003E32294884F7F8866E107DABA4427216EBA3FFF89CD3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5eb8c49eb0bb4e4c88b3266651c2dc4a.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78093vtjKBC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.498182329792915
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MaAKN7UVWa5jFQMzKaBu:qgFqo6g7/+0+f+MaAKNzaPTmh
MD5:	6038E47E786C894C85E62F9FA49686EB
SHA1:	FBA5E44ED7F5F887A4591CAD84D6118E01C53C3C
SHA-256:	9929469D5C838D8F687333A04E27E74A91E54986C9F000BB4095F518B42D4C76
SHA-512:	A47FC7DDFC650FCE6FE255CC2C3BFB1E6B910201429A69C6C38D3A424F529A7D769B0A5BA56118369D90C0F864FAC6F6AD5836F449E0EBEBC36422243AF45778
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3a5090346c4f4201a8c2a6103fce12c0.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:780989DCm8C

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.52752543966778
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MoDMgIucSZjFQMzKaBu:qgFqdg7/+0+f+MoYzSvTmh
MD5:	0E8F7F643B609C77F482628910DFBFCB
SHA1:	0A285793768390BF5B7AAE4F80F0AAA209427759
SHA-256:	617B62174D3D4259EA1DD49A1A023522DFE23FF0D88C176D5057C8081E17E7A8
SHA-512:	33EB845A3647E279F08E1B0B53FE592789594DBC4B41E56764118F40CB9EADF78125C7DEA51573D7112F709E7036FB31217EBF4887B82FE2FC14E76D25F1C713
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bf80b97f0e194f729b2f580c3718a3a8.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/seats/.#seat0hj1rxD

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0if5zmC

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/users/.#1274N9PAE

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.318305802361396
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgAwzV+Xvtg206qodWp:SbFuFyL3BVgdL87iesnAiRJgXktgt6Ap
MD5:	224145CE052979E197DECCA66EA0F5C1
SHA1:	6877C1996E52C40E19786126D6C94A2FC38EC7FB
SHA-256:	60FBE03516B565A5470109A10F9A4AB8327309D6048C6ADA7F17C6D70FB5F4BE
SHA-512:	5D762722159412F956504E3A7559E40720AAB8E22773873A81C82BAE79591ADA76AE0398151336965EDFD4CAA6DD23FBEDE3FE4889DB4E61D8F31CEF89062801
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1735966107965609.MONOTONIC=453992054.LAST_SESSION_TIMESTAMP=454072619.

/run/systemd/users/.#1279DUpQA

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.473511885406452
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6lgTgXktgt6Ap:qgFq30dABibB3TgXggIa
MD5:	E3EA8D923BBCF101190A76F76DD7100B
SHA1:	487571CC6BE81BC05175EE0016FBE2E995EF7724
SHA-256:	0F1F850EC5A899BD609C4934D327358F7C8AC68DCD866D7BE4722C0A838F6C3C
SHA-512:	C294EC542D6D4EDC767FC7C7E0A9652FEF76A777A0A9CA6708036BC7619EFB2327FF409233B423A636C9744101343599DB8DDEC2A703260A8BBADAC267D29787
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12412.REALTIME=1735966107965609.MONOTONIC=453992054.LAST_SESSION_TIMESTAMP=454072619.

/run/systemd/users/.#127K66vYA

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.473511885406452
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6lgTgXktgt6Ap:qgFq30dABibB3TgXggIa
MD5:	E3EA8D923BBCF101190A76F76DD7100B
SHA1:	487571CC6BE81BC05175EE0016FBE2E995EF7724
SHA-256:	0F1F850EC5A899BD609C4934D327358F7C8AC68DCD866D7BE4722C0A838F6C3C
SHA-512:	C294EC542D6D4EDC767FC7C7E0A9652FEF76A777A0A9CA6708036BC7619EFB2327FF409233B423A636C9744101343599DB8DDEC2A703260A8BBADAC267D29787
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12412.REALTIME=1735966107965609.MONOTONIC=453992054.LAST_SESSION_TIMESTAMP=454072619.

/run/systemd/users/.#127OSQXlC

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.302605275787358
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gXkW02thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+gXbthQHtPYq9M
MD5:	AFB6747E04F61B31719ACE6566BBEB00
SHA1:	98FAE4162685F2FC7C6FCFF439724C4C47F35176
SHA-256:	7F8879424D5F57A1FD216538526247F994BBEE9C2002E8184486393BE3F877D9
SHA-512:	3BAA0CF1E0699AFF3CA968FA4FAE782BA11F3864268838A4E27DCD69F0CFB3A5DA039279B14EE8696096BAFDD5D82B21FB305C3C8FA5942438ED479A9E0954A2
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1735966107965609.MONOTONIC=453992054.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127mKcl2D

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127q5zBfE

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.302605275787358
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gXkW02thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+gXbthQHtPYq9M
MD5:	AFB6747E04F61B31719ACE6566BBEB00
SHA1:	98FAE4162685F2FC7C6FCFF439724C4C47F35176
SHA-256:	7F8879424D5F57A1FD216538526247F994BBEE9C2002E8184486393BE3F877D9
SHA-512:	3BAA0CF1E0699AFF3CA968FA4FAE782BA11F3864268838A4E27DCD69F0CFB3A5DA039279B14EE8696096BAFDD5D82B21FB305C3C8FA5942438ED479A9E0954A2
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1735966107965609.MONOTONIC=453992054.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:cF:cF
MD5:	86FE201607799702B89DA68EC32138F4
SHA1:	3F7D5E8CDA7E007A1EC45081D5563F60DEE4F6E8
SHA-256:	7C6EF9C237AFD72B9882FCCDB4A1AB4D0909B87E8F794FB4ACE9BF2BFF8B6307
SHA-512:	A8D3FD5043B63599C3CCBE3302976D23279F7CA86A1FC6BF4D054B15B137CB959A60ECD8F8BB12C8BBB0E2199A9F436A4F0FE6A46F5B47345D725DB032ACCEEE
Malicious:	false
Preview:	6320.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351417
Encrypted:	false
SSDEEP:	3:l0sXlXEWtl/nE:L+yl8
MD5:	997DFD9ECADAC4DDA0A9972E634EEF94
SHA1:	EEBCF47F5E0F74F4F97F6907420BD11DFD47E1F8
SHA-256:	89768FC3B119A65AF067EFC4DC3A52AE6A53252E991C5A4CABA5145792E1FCF0
SHA-512:	0FE6AD7D8D5D31A625EE14A84A4C0E6D93DB62DC1995C9121BE0731E4CC6DB1F6485C8A3BFC635F11D9F89B081C692BA18D682C2B14BCD7A0C51757E5A282DB2
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN.....................................................................................................................................................................................................................................................................................................xg........................................

/tmp/qemu-open.xkcMHI (deleted)

Download File

Process:	/tmp/Fantazy.mips.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	3.6290901843953303
Encrypted:	false
SSDEEP:	6:URgcaFF6EEM///VUmVbscaFF6EE3cdtSY/VR/VDM/V+4D/VH:I9andumVdan0ktSWMfF
MD5:	DAF107FE42412F1B6D0B151D8682D34F
SHA1:	A3AA4794A13620D785CC8318145A24F25802B25C
SHA-256:	C21B3816F3208723B7DF1BA9FD7DEBDBB68677C60F7E551E014BC5DB2F584CE2
SHA-512:	7CC36F12D2A02F71FB8835916E5CCB09C425ED62070866001E6B7BD1B97AFC713E4B928AB60921537732CE80526218FB8F13718E524AE4154937A10889FBCD2E
Malicious:	false
Preview:	400000-418000 r-xp 00000000 fd:00 531563 /tmp/Fantazy.mips.elf.457000-458000 rw-p 00017000 fd:00 531563 /tmp/Fantazy.mips.elf.458000-459000 rw-p 00000000 00:00 0 .459000-45b000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/var/lib/AccountsService/users/gdm.XKCLZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	678
Entropy (8bit):	4.794582970700648
Encrypted:	false
SSDEEP:	12:vRF0hLadWeF0T4p1Wr4MeF0nCLGaWr4CgeF0hLajOkFXqwzfbZUQU:vyt0pYr4MTJr4CewrCQU
MD5:	F06B4FC7E46971D765069CAA793D660F
SHA1:	BB5B8DBA065A58DCB7EEA00FF3FD34DF734ADE53
SHA-256:	CE1CA767C5D6E50BD8CC0B244D3C83493320085C456622D100B136DBF106C3E0
SHA-512:	D7CE209088955D84C6C125DB8330EF0BCF9194EDD6DA2C6F2B39EF470A10B733FE3C7A294165CB423BE882B5715936B2242ED22C98B2A97257AD9A97907D93FF
Malicious:	false
Preview:	Jan 3 22:48:27 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Jan 3 22:48:28 galassia systemd-logind[6327]: Failed to start session scope session-c1.scope: Unit session-c1.scope already exists..Jan 3 22:48:28 galassia gdm-launch-environment]: pam_systemd(gdm-launch-environment:session): Failed to create session: Unit session-c1.scope already exists..Jan 3 22:48:29 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session closed for user gdm.Jan 3 22:48:37 galassia dbus-daemon[6298]: [system] Failed to activate service 'org.bluez': timed out (service_start_timeout=25000ms).

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.448047321524811
Encrypted:	false
SSDEEP:	3:F31HlU+cmZMtM+cmZcl:F3E+cGMq+cGc
MD5:	B20B530BC0452919D3F3B53848B1312E
SHA1:	82120F3210B5858D26BC814CD096DE29F14869F5
SHA-256:	A61BEC474580442ED47CC21947E897DD3BC346C4A3313FB8F26C516951518B90
SHA-512:	D3BA7DDD38D79A7CB5219E386164ED93E3409DA02D07F6F8C47EEC0A5687C802A20C24B19D202E979E945B5805C370AE80424CCD1E1C8AD39220E8C2DACE1F34
Malicious:	false
Preview:	LPKSHHRH................%t.\0MLm...b.Fc}................................%t.\0MLm...b.Fc}........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.43656862359913
Encrypted:	false
SSDEEP:	3:F31Hlz0K2X7E70K2X78t:F3WF8
MD5:	EBA6CF8FC5B550F40B29F5D20116984E
SHA1:	1C7BAE71526B35B44DBAAC7D7A38FBF3606F39CD
SHA-256:	46D2B90F3E3D62C321E82A97619AC5F2C7E951309730A187FE4D911B08AC9B1D
SHA-512:	2E92F378C1874C35CF78E966461DD2A7E2613D8353F1ED8792688EEEAFA9F606B43E14DF493D49D93CB70881E04A8E1E779C849003F97D3F89DD30D6BAF3A9DF
Malicious:	false
Preview:	LPKSHHRH....................s.L....^A.<....................................s.L....^A.<........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	CSV text
Category:	dropped
Size (bytes):	10486
Entropy (8bit):	4.9703719667444295
Encrypted:	false
SSDEEP:	96:YudijL+TnnQdBb0fyntu1DrmChqWOr8MvOr8YNIhkUKK+dSTzGuQlcc3mu:5VTQdB4fG8Dsr8Y2db1N
MD5:	D82ABCB564B220D377621FB1451A41BF
SHA1:	53EFE335E9D7B5AF1AB0F220E855CA910EE150EF
SHA-256:	5CFE1536B5C34F8EB5C14C226A2F5635D521694B50D29B1A0F23C53E66420CF9
SHA-512:	985EEB84067888A903B8222DF359CC49C3045AE9CBED8D4D09DA504A8B524B9C1A0762525277729E3609346A53104E19D298B36C6C78F72CAB3D1BBF8D579715
Malicious:	false
Preview:	Jan 3 22:48:13 galassia kernel: [ 438.168145] New task spawned: old: (tgid 6399, tid 6399), new (tgid: 6400, tid: 6400).Jan 3 22:48:13 galassia kernel: [ 438.318051] New task spawned: old: (tgid 6320, tid 6320), new (tgid: 6320, tid: 6401).Jan 3 22:48:13 galassia kernel: [ 438.443849] New task spawned: old: (tgid 6398, tid 6398), new (tgid: 6403, tid: 6403).Jan 3 22:48:13 galassia kernel: [ 438.503124] New task spawned: old: (tgid 6403, tid 6403), new (tgid: 6404, tid: 6404).Jan 3 22:48:13 galassia kernel: [ 438.695510] New task spawned: old: (tgid 6398, tid 6398), new (tgid: 6405, tid: 6405).Jan 3 22:48:13 galassia kernel: [ 438.738808] New task spawned: old: (tgid 6405, tid 6405), new (tgid: 6406, tid: 6406).Jan 3 22:48:13 galassia kernel: [ 438.913627] New task spawned: old: (tgid 6402, tid 6402), new (tgid: 6402, tid: 6407).Jan 3 22:48:13 galassia kernel: [ 438.914497] New task spawned: old: (tgid 6402, tid 6402), new (tgid: 6402, tid: 6408).Jan 3 22:48:13 galassia

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	30447
Entropy (8bit):	5.0245222732598025
Encrypted:	false
SSDEEP:	768:Sxt3LXKWsqxcxgxux0uiv7FFVaynTBQcIaRSWovJtzjF577eCg3FxDseK4ESOQ/g:wluygMVe
MD5:	7448ED7C6FD7F0E3B0CC633110A9A1F2
SHA1:	1FE69A5AE9A1E2DAF358938A7239E5585CC7979C
SHA-256:	B4754534410DBA56A71AB8E5EBEAD1E1BA600392F341C704023FBD50E55489ED
SHA-512:	DE1BC6FE7957F737CFCE332E49BF7F781575F1EF64105C927510CA5A4E618E4F92071A457E4F80470857A2185088A53892B353AD29FF552A82876551BB67CFC6
Malicious:	false
Preview:	Jan 3 22:48:12 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Jan 3 22:48:12 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Jan 3 22:48:12 galassia rtkit-daemon[6324]: Supervising 1 threads of 1 processes of 1 users..Jan 3 22:48:12 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 1..Jan 3 22:48:12 galassia systemd[1]: Stopped System Logging Service..Jan 3 22:48:12 galassia systemd[1]: Starting System Logging Service....Jan 3 22:48:12 galassia rtkit-daemon[6324]: Successfully made thread 6401 of process 6320 owned by '1000' RT at priority 5..Jan 3 22:48:12 galassia rtkit-daemon[6324]: Supervising 2 threads of 1 processes of 1 users..Jan 3 22:48:13 galassia kernel: [ 438.168145] New task spawned: old: (tgid 6399, tid 6399), new (tgid: 6400, tid: 6400).Jan 3 22:48:13 galassia kernel: [ 438.318051] New task spawned: old: (tgid 6320, tid 6320), new (tgid: 6320, tid: 6401).Jan 3 22:48:13

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351417
Encrypted:	false
SSDEEP:	3:l0sXlXEWtl/nE:L+yl8
MD5:	997DFD9ECADAC4DDA0A9972E634EEF94
SHA1:	EEBCF47F5E0F74F4F97F6907420BD11DFD47E1F8
SHA-256:	89768FC3B119A65AF067EFC4DC3A52AE6A53252E991C5A4CABA5145792E1FCF0
SHA-512:	0FE6AD7D8D5D31A625EE14A84A4C0E6D93DB62DC1995C9121BE0731E4CC6DB1F6485C8A3BFC635F11D9F89B081C692BA18D682C2B14BCD7A0C51757E5A282DB2
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN.....................................................................................................................................................................................................................................................................................................xg........................................

Source: Fantazy.mips.elf	Virustotal: Detection: 55%			Perma Link
Source: Fantazy.mips.elf	ReversingLabs: Detection: 60%

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.536144644823796
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Fantazy.mips.elf
File size:	97'492 bytes
MD5:	92132a4b27277a33780cf9a73715a7c3
SHA1:	e978a3df576a22c98e48f6b9fd4169d8c16ea5a2
SHA256:	289426e2a50923277ee9ed047e4ef985b91306a66463492a31e28b6f47801cc7
SHA512:	61a7f3c5a40fa2431da65e558eb083cc993f257ff2587ec1e31fa1a51aebc1ebd7093a47760d66c1c6fa098dd0d4fac9a83d07afb4c73b5ff853f0a9101a09a0
SSDEEP:	1536:OGuOLw2qT9E3TlWGThUBPufD/N72ajqBVIx0tKtS5yk/:duew2qTC3YGThUBmDl2ajqBVIx0tKk59
TLSH:	A393534D3E314F7DFBAC82398BB75B209209339626E1C584C1ACFE021D7479A745B7A6
File Content Preview:	.ELF.....................@.`...4..z......4. ...(.............@...@....t`..t`..............td.Etd.Etd.......t........dt.Q............................<...'..<...!'.......................<...'......!... ....'9... ......................<...'......!........'9`

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	96932
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x15fa0	0x0	0x6	AX	16
.fini	PROGBITS	0x4160c0	0x160c0	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x416120	0x16120	0x1340	0x0	0x2	A	16
.ctors	PROGBITS	0x457464	0x17464	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x45746c	0x1746c	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x457478	0x17478	0x4	0x0	0x3	WA	4
.data	PROGBITS	0x457480	0x17480	0x258	0x0	0x3	WA	16
.got	PROGBITS	0x4576e0	0x176e0	0x360	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x457a40	0x17a40	0x20	0x0	0x10000003	WAp	4
.bss	NOBITS	0x457a60	0x17a40	0x578	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x678	0x17a40	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x17a40	0x64	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x17460	0x17460	5.5460	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x17464	0x457464	0x457464	0x5dc	0xb74	4.0380	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 4, 2025 05:48:10.571844101 CET	192.168.2.23	8.8.8.8	0xbc58	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Jan 4, 2025 05:48:10.571844101 CET	192.168.2.23	8.8.8.8	0xfb41	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 4, 2025 05:48:10.847508907 CET	192.168.2.23	8.8.8.8	0x49fa	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 4, 2025 05:48:10.578417063 CET	8.8.8.8	192.168.2.23	0xfb41	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Jan 4, 2025 05:48:10.578417063 CET	8.8.8.8	192.168.2.23	0xfb41	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2025-01-04 04:48:13 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2025-01-04 04:48:13 UTC	25	IN	HTTP/1.1 100 Continue
2025-01-04 04:48:13 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2025-01-04 04:48:13 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2025-01-04 04:48:13 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2025-01-04 04:48:13 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2025-01-04 04:48:13 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2025-01-04 04:48:13 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2025-01-04 04:48:13 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2025-01-04 04:48:13 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2025-01-04 04:48:13 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2025-01-04 04:48:13 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2025-01-04 04:48:14 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Sat, 04 Jan 2025 04:48:14 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	04:47:42
Start date (UTC):	04/01/2025
Path:	/tmp/Fantazy.mips.elf
Arguments:	/tmp/Fantazy.mips.elf
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Start time (UTC):	04:47:49
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	04:47:51
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	04:48:08
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	04:48:09
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	04:48:10
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	04:48:12
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	04:48:13
Start date (UTC):	04/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	04:48:14
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	04:48:15
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	04:48:25
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	04:48:26
Start date (UTC):	04/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Fantazy.mips.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6465/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:75339lzxH4F

/run/systemd/journal/streams/.#9:75531ZUdeiG

/run/systemd/journal/streams/.#9:75539UzX4jD

/run/systemd/journal/streams/.#9:76029k8Fb4F

/run/systemd/journal/streams/.#9:76030AZbrvC

/run/systemd/journal/streams/.#9:76534lQmRQD

/run/systemd/journal/streams/.#9:7663412ZNkD

/run/systemd/journal/streams/.#9:76737zDoowC

/run/systemd/journal/streams/.#9:76793GqTATD

/run/systemd/journal/streams/.#9:76847d73JXB

/run/systemd/journal/streams/.#9:768489TWz8F

/run/systemd/journal/streams/.#9:76970FpKtjC

/run/systemd/journal/streams/.#9:77014bYQtYB

/run/systemd/journal/streams/.#9:77930LUa6lC

/run/systemd/journal/streams/.#9:77988ozuK8C

/run/systemd/journal/streams/.#9:77990vHkV7C

/run/systemd/journal/streams/.#9:78093vtjKBC

/run/systemd/journal/streams/.#9:780989DCm8C

/run/systemd/seats/.#seat0hj1rxD

/run/systemd/seats/.#seat0if5zmC

/run/systemd/users/.#1274N9PAE

/run/systemd/users/.#1279DUpQA

/run/systemd/users/.#127K66vYA

/run/systemd/users/.#127OSQXlC

/run/systemd/users/.#127mKcl2D

/run/systemd/users/.#127q5zBfE

Linux Analysis Report
Fantazy.mips.elf

Start time (UTC):	04:48:28
Start date (UTC):	04/01/2025
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	04:48:29
Start date (UTC):	04/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	04:48:51
Start date (UTC):	04/01/2025
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre