Edit tour

Linux Analysis Report
Fantazy.sh4.elf

Overview

General Information

Sample name:	Fantazy.sh4.elf
Analysis ID:	1584095
MD5:	bb781f2947411bc14a474cdd80cd39a2
SHA1:	10954dac8864b254d8b5d2f05affdf2998f04c2c
SHA256:	d430e1d375fa8aaf1da08adebc7a7679c06db222383d6d302d872c65e47cdd4a
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584095
Start date and time:	2025-01-04 06:12:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Fantazy.sh4.elf
Detection:	MAL
Classification:	mal68.spre.troj.linELF@0/44@3/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing network information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/Fantazy.sh4.elf
PID:	6211
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	VegaSec-KATANA001
Standard Error:

Process Tree

system is lnxubuntu20

Fantazy.sh4.elf (PID: 6211, Parent: 6129, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/Fantazy.sh4.elf

Fantazy.sh4.elf New Fork (PID: 6213, Parent: 6211)

Fantazy.sh4.elf New Fork (PID: 6215, Parent: 6211)

Fantazy.sh4.elf New Fork (PID: 6217, Parent: 6215)

Fantazy.sh4.elf New Fork (PID: 6219, Parent: 6215)

Fantazy.sh4.elf New Fork (PID: 6221, Parent: 6215)

systemd New Fork (PID: 6230, Parent: 1)

journalctl (PID: 6230, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6246, Parent: 1)

systemd-journald (PID: 6246, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6249, Parent: 1)

journalctl (PID: 6249, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6298, Parent: 1)

dbus-daemon (PID: 6298, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gnome-session-binary New Fork (PID: 6310, Parent: 1477)

sh (PID: 6310, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/bin/gnome-shell

systemd New Fork (PID: 6316, Parent: 1860)

pulseaudio (PID: 6316, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6321, Parent: 1)

rtkit-daemon (PID: 6321, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6324, Parent: 1)

systemd-logind (PID: 6324, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6386, Parent: 1)

polkitd (PID: 6386, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6391, Parent: 1)

agetty (PID: 6391, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 6392, Parent: 1320)

Default (PID: 6392, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6393, Parent: 1320)

Default (PID: 6393, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6394, Parent: 1320)

Default (PID: 6394, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6395, Parent: 1)

gpu-manager (PID: 6395, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6396, Parent: 6395)

sh (PID: 6396, Parent: 6395, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6397, Parent: 6396)

grep (PID: 6397, Parent: 6396, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6399, Parent: 6395)

sh (PID: 6399, Parent: 6395, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6400, Parent: 6399)

grep (PID: 6400, Parent: 6399, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6402, Parent: 6395)

sh (PID: 6402, Parent: 6395, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6403, Parent: 6402)

grep (PID: 6403, Parent: 6402, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6408, Parent: 6395)

sh (PID: 6408, Parent: 6395, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6409, Parent: 6408)

grep (PID: 6409, Parent: 6408, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6410, Parent: 6395)

sh (PID: 6410, Parent: 6395, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6411, Parent: 6410)

grep (PID: 6411, Parent: 6410, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6412, Parent: 6395)

sh (PID: 6412, Parent: 6395, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6413, Parent: 6412)

grep (PID: 6413, Parent: 6412, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6414, Parent: 6395)

sh (PID: 6414, Parent: 6395, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6415, Parent: 6414)

grep (PID: 6415, Parent: 6414, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6417, Parent: 6395)

sh (PID: 6417, Parent: 6395, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6418, Parent: 6417)

grep (PID: 6418, Parent: 6417, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6401, Parent: 1)

rsyslogd (PID: 6401, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6421, Parent: 1)

generate-config (PID: 6421, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6422, Parent: 6421)

pkill (PID: 6422, Parent: 6421, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6423, Parent: 1)

gdm-wait-for-drm (PID: 6423, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6428, Parent: 1)

gdm3 (PID: 6428, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6432, Parent: 6428)

plymouth (PID: 6432, Parent: 6428, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6449, Parent: 6428)

gdm-session-worker (PID: 6449, Parent: 6428, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6455, Parent: 6449)

gdm-wayland-session (PID: 6455, Parent: 6449, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6457, Parent: 6455)

dbus-daemon (PID: 6457, Parent: 6455, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6459, Parent: 6457)

dbus-daemon New Fork (PID: 6460, Parent: 6459)

false (PID: 6460, Parent: 6459, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6461, Parent: 6455)

dbus-run-session (PID: 6461, Parent: 6455, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6462, Parent: 6461)

dbus-daemon (PID: 6462, Parent: 6461, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6463, Parent: 6428)

Default (PID: 6463, Parent: 6428, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6464, Parent: 6428)

Default (PID: 6464, Parent: 6428, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6434, Parent: 1)

accounts-daemon (PID: 6434, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6444, Parent: 6434)

language-validate (PID: 6444, Parent: 6434, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6445, Parent: 6444)

language-options (PID: 6445, Parent: 6444, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6446, Parent: 6445)

sh (PID: 6446, Parent: 6445, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6447, Parent: 6446)

locale (PID: 6447, Parent: 6446, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6448, Parent: 6446)

grep (PID: 6448, Parent: 6446, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

gvfsd-fuse New Fork (PID: 6478, Parent: 2038)

fusermount (PID: 6478, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6520, Parent: 1860)

dbus-daemon (PID: 6520, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6401)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /tmp/Fantazy.sh4.elf (PID: 6211)	Socket: 127.0.0.1:59025	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6428)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6457)	Socket: unknown address family	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.243
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.243
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.243
Source: unknown	TCP traffic detected without corresponding DNS query: 105.213.48.31
Source: unknown	TCP traffic detected without corresponding DNS query: 119.247.193.56
Source: unknown	TCP traffic detected without corresponding DNS query: 31.183.145.31
Source: unknown	TCP traffic detected without corresponding DNS query: 112.0.87.163
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.85.221
Source: unknown	TCP traffic detected without corresponding DNS query: 108.239.38.225
Source: unknown	TCP traffic detected without corresponding DNS query: 4.222.129.90
Source: unknown	TCP traffic detected without corresponding DNS query: 139.177.214.181
Source: unknown	TCP traffic detected without corresponding DNS query: 45.118.249.61
Source: unknown	TCP traffic detected without corresponding DNS query: 79.226.63.232
Source: unknown	TCP traffic detected without corresponding DNS query: 218.74.116.144
Source: unknown	TCP traffic detected without corresponding DNS query: 221.155.60.223
Source: unknown	TCP traffic detected without corresponding DNS query: 36.175.182.29
Source: unknown	TCP traffic detected without corresponding DNS query: 89.43.140.121
Source: unknown	TCP traffic detected without corresponding DNS query: 88.159.3.104
Source: unknown	TCP traffic detected without corresponding DNS query: 198.12.62.170
Source: unknown	TCP traffic detected without corresponding DNS query: 212.137.111.81
Source: unknown	TCP traffic detected without corresponding DNS query: 13.200.102.92
Source: unknown	TCP traffic detected without corresponding DNS query: 71.40.121.112
Source: unknown	TCP traffic detected without corresponding DNS query: 77.74.55.25
Source: unknown	TCP traffic detected without corresponding DNS query: 166.6.174.249
Source: unknown	TCP traffic detected without corresponding DNS query: 193.131.96.99
Source: unknown	TCP traffic detected without corresponding DNS query: 43.234.217.229
Source: unknown	TCP traffic detected without corresponding DNS query: 18.202.14.196
Source: unknown	TCP traffic detected without corresponding DNS query: 108.43.128.112
Source: unknown	TCP traffic detected without corresponding DNS query: 184.229.228.55
Source: unknown	TCP traffic detected without corresponding DNS query: 147.12.203.136
Source: unknown	TCP traffic detected without corresponding DNS query: 195.16.212.59
Source: unknown	TCP traffic detected without corresponding DNS query: 174.11.35.30
Source: unknown	TCP traffic detected without corresponding DNS query: 203.156.106.193
Source: unknown	TCP traffic detected without corresponding DNS query: 162.178.42.232
Source: unknown	TCP traffic detected without corresponding DNS query: 5.86.190.57
Source: unknown	TCP traffic detected without corresponding DNS query: 149.1.192.255
Source: unknown	TCP traffic detected without corresponding DNS query: 186.111.92.242
Source: unknown	TCP traffic detected without corresponding DNS query: 54.20.35.30
Source: unknown	TCP traffic detected without corresponding DNS query: 53.31.46.137
Source: unknown	TCP traffic detected without corresponding DNS query: 222.32.65.115
Source: unknown	TCP traffic detected without corresponding DNS query: 101.114.60.227
Source: unknown	TCP traffic detected without corresponding DNS query: 23.40.49.71
Source: unknown	TCP traffic detected without corresponding DNS query: 135.194.26.149
Source: unknown	TCP traffic detected without corresponding DNS query: 84.195.91.178
Source: unknown	TCP traffic detected without corresponding DNS query: 204.35.92.103
Source: unknown	TCP traffic detected without corresponding DNS query: 58.14.43.121
Source: unknown	TCP traffic detected without corresponding DNS query: 12.108.225.80
Source: unknown	TCP traffic detected without corresponding DNS query: 57.15.92.246
Source: unknown	TCP traffic detected without corresponding DNS query: 181.69.20.228
Source: unknown	TCP traffic detected without corresponding DNS query: 36.185.9.19

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.57.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 38248 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38248
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 6037, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 6188, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 6189, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 6215, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 6219, result: unknown	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 6037, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 6188, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 6189, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 6215, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6219)	SIGKILL sent: pid: 6219, result: unknown	Jump to behavior

Source: classification engine

Classification label: mal68.spre.troj.linELF@0/44@3/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6298)	File: /proc/6298/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6457)	File: /proc/6457/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6462)	File: /proc/6462/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6478)	File: /proc/6478/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6520)	File: /proc/6520/mounts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6246)	File: /run/systemd/journal/streams/.#9:75446bz5z9u	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File: /run/systemd/journal/streams/.#9:76063rkCQzw	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File: /run/systemd/journal/streams/.#9:77057lxOVcw	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File: /run/systemd/journal/streams/.#9:77076FGGdDu	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File: /run/systemd/journal/streams/.#9:77083wJhPbt	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File: /run/systemd/journal/streams/.#9:770899t5Tvs	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File: /run/systemd/journal/streams/.#9:77099fKqG2s	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File: /run/systemd/journal/streams/.#9:76461862awv	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File: /run/systemd/journal/streams/.#9:76466j4yLxt	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File: /run/systemd/journal/streams/.#9:76591F8Aozs	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File: /run/systemd/journal/streams/.#9:76741M8gJot	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File: /run/systemd/journal/streams/.#9:78152x3ZvVw	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File: /run/systemd/journal/streams/.#9:78158ldwect	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File: /run/systemd/journal/streams/.#9:78331u8jxIt	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File: /run/systemd/journal/streams/.#9:77602mMdSOv	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File: /run/systemd/journal/streams/.#9:77726xnTeJv	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File: /run/systemd/journal/streams/.#9:77793o5jPfu	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File: /run/systemd/journal/streams/.#9:77794aHTROv	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File: /run/systemd/journal/streams/.#9:778131G0Apv	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File: /run/systemd/journal/streams/.#9:77814K3Qbuw	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File: /run/systemd/journal/streams/.#9:79699pLjbTt	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6324)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6324)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6324)	File: /run/systemd/seats/.#seat0UY3d7l	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6324)	File: /run/systemd/users/.#1277QPHdo	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6324)	File: /run/systemd/users/.#127Tq8x2m	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6324)	File: /run/systemd/seats/.#seat0XOryeo	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6324)	File: /run/systemd/users/.#1278vNdin	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6324)	File: /run/systemd/users/.#127NLgnRn	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6324)	File: /run/systemd/users/.#127YC3Afm	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6386)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6455)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6434)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6434)	Directory: /root/.cache	Jump to behavior

Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6298/status	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6298/attr/current	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6386/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6321/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6313/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6313/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6324/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6434/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6455/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/1389/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6449/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6449/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6316/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6316/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6316/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File opened: /proc/6428/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6313/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6313/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6313/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6313/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6313/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6313/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6313/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6313/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6313/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6313/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6313/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6313/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6313/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6313/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6313/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6313/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6313/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6313/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6313/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6313/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6313/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6434/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6434/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6434/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6434/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6434/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6434/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/6434/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2078/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2078/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2078/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2078/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2078/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2078/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2078/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2077/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2077/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2077/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2077/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2077/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2077/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2077/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2033/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2033/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2033/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2033/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2033/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2033/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2033/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2074/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2074/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2074/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2074/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2074/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2074/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2074/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/1532/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/1532/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/1532/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/1532/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/1532/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/1532/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/1532/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/1334/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	File opened: /proc/1334/cgroup	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6396)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6399)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6402)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6408)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6410)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6412)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6414)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6417)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6446)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Source: /bin/sh (PID: 6397)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6400)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6403)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6409)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6411)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6413)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6415)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6418)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6448)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6422)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6246)

Reads from proc file: /proc/meminfo

Jump to behavior

Source: /sbin/agetty (PID: 6391)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6428)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6428)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6434)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6434)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6395)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6401)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6401)	Log file created: /var/log/auth.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 6395)

Truncated file: /var/log/gpu-manager.log

Jump to behavior

Source: /usr/bin/pulseaudio (PID: 6316)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pkill (PID: 6422)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /tmp/Fantazy.sh4.elf (PID: 6211)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6246)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6316)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6391)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6395)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6401)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6449)	Queries kernel information via 'uname':	Jump to behavior

Source: Fantazy.sh4.elf, 6211.1.00007fff6d916000.00007fff6d937000.rw-.sdmp, Fantazy.sh4.elf, 6213.1.00007fff6d916000.00007fff6d937000.rw-.sdmp, Fantazy.sh4.elf, 6215.1.00007fff6d916000.00007fff6d937000.rw-.sdmp, Fantazy.sh4.elf, 6217.1.00007fff6d916000.00007fff6d937000.rw-.sdmp, Fantazy.sh4.elf, 6219.1.00007fff6d916000.00007fff6d937000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/Fantazy.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Fantazy.sh4.elf
Source: Fantazy.sh4.elf, 6211.1.00007fff6d916000.00007fff6d937000.rw-.sdmp, Fantazy.sh4.elf, 6213.1.00007fff6d916000.00007fff6d937000.rw-.sdmp, Fantazy.sh4.elf, 6215.1.00007fff6d916000.00007fff6d937000.rw-.sdmp, Fantazy.sh4.elf, 6217.1.00007fff6d916000.00007fff6d937000.rw-.sdmp, Fantazy.sh4.elf, 6219.1.00007fff6d916000.00007fff6d937000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: Fantazy.sh4.elf, 6219.1.00007fff6d916000.00007fff6d937000.rw-.sdmp	Binary or memory string: 'V/tmp/qemu-open.oIalmt
Source: Fantazy.sh4.elf, 6211.1.000056002a2e2000.000056002a345000.rw-.sdmp, Fantazy.sh4.elf, 6213.1.000056002a2e2000.000056002a345000.rw-.sdmp, Fantazy.sh4.elf, 6215.1.000056002a2e2000.000056002a345000.rw-.sdmp, Fantazy.sh4.elf, 6217.1.000056002a2e2000.000056002a345000.rw-.sdmp, Fantazy.sh4.elf, 6219.1.000056002a2e2000.000056002a345000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4
Source: Fantazy.sh4.elf, 6219.1.00007fff6d916000.00007fff6d937000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.oIalmt
Source: Fantazy.sh4.elf, 6211.1.000056002a2e2000.000056002a345000.rw-.sdmp, Fantazy.sh4.elf, 6213.1.000056002a2e2000.000056002a345000.rw-.sdmp, Fantazy.sh4.elf, 6215.1.000056002a2e2000.000056002a345000.rw-.sdmp, Fantazy.sh4.elf, 6217.1.000056002a2e2000.000056002a345000.rw-.sdmp, Fantazy.sh4.elf, 6219.1.000056002a2e2000.000056002a345000.rw-.sdmp	Binary or memory string: E.*V5!/etc/qemu-binfmt/sh4

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6434)

Logged in records file read: /var/log/wtmp

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Fantazy.sh4.elf	61%	ReversingLabs	Linux.Trojan.Mirai
Fantazy.sh4.elf	57%	Virustotal		Browse
Fantazy.sh4.elf	100%	Avira	EXP/ELF.Gafgyt.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.57.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
68.251.195.254	unknown	United States	393635	AWT-CORP-001US	false
162.152.49.75	unknown	United States	10796	TWC-10796-MIDWESTUS	false
196.129.136.43	unknown	Egypt	36935	Vodafone-EG	false
207.151.187.96	unknown	United States	5726	INTERWORLDUS	false
167.211.194.201	unknown	United States	5696	EXPRESUS	false
170.232.43.169	unknown	United States	11685	HNBCOL-ASUS	false
163.67.217.18	unknown	France	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
92.24.40.51	unknown	United Kingdom	13285	OPALTELECOM-ASTalkTalkCommunicationsLimitedGB	false
198.70.143.247	unknown	United States	1239	SPRINTLINKUS	false
42.20.178.159	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
111.89.177.218	unknown	Japan	2514	INFOSPHERENTTPCCommunicationsIncJP	false
53.152.84.23	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
204.122.187.147	unknown	United States	39999	POLK-COUNTY-PUBLIC-SCHOOLSUS	false
181.166.21.134	unknown	Argentina	10318	TelecomArgentinaSAAR	false
115.10.35.0	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
23.202.179.183	unknown	United States	55410	VIL-AS-APVodafoneIdeaLtdIN	false
87.219.46.198	unknown	Spain	12479	UNI2-ASES	false
146.54.22.145	unknown	United States	1483	DNIC-AS-01483US	false
91.33.179.11	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
185.29.26.161	unknown	Greece	200128	DNHOSTGR	false
120.200.190.110	unknown	China	56044	CMNET-AS-LIAONINGChinaMobilecommunicationscorporationC	false
198.247.43.3	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
4.181.55.222	unknown	United States	3356	LEVEL3US	false
42.93.231.31	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
191.179.213.107	unknown	Brazil	28573	CLAROSABR	false
152.134.134.198	unknown	United States	29992	VA-TMP-COREUS	false
31.198.166.142	unknown	Italy	3269	ASN-IBSNAZIT	false
81.237.167.60	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
218.203.101.28	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
168.235.188.141	unknown	United States	22925	ALLIED-TELECOMUS	false
159.249.24.28	unknown	United States	29899	GEISINGERUS	false
47.63.98.19	unknown	United States	12430	VODAFONE_ESES	false
31.64.110.76	unknown	United Kingdom	12576	EELtdGB	false
39.252.1.193	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
99.186.254.207	unknown	United States	7018	ATT-INTERNET4US	false
184.211.89.211	unknown	United States	10507	SPCSUS	false
14.233.149.217	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
187.203.139.0	unknown	Mexico	8151	UninetSAdeCVMX	false
1.58.34.93	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
99.236.194.119	unknown	Canada	812	ROGERS-COMMUNICATIONSCA	false
216.83.229.82	unknown	United States	7029	WINDSTREAMUS	false
70.235.78.58	unknown	United States	2386	INS-ASUS	false
208.239.72.202	unknown	United States	4208	THE-ISERV-COMPANYUS	false
196.9.48.85	unknown	South Africa	3067	DENINF-IPLANZA	false
213.6.218.29	unknown	Palestinian Territory Occupied	12975	PALTEL-ASPALTELAutonomousSystemPS	false
65.195.72.118	unknown	United States	701	UUNETUS	false
19.207.20.84	unknown	United States	3	MIT-GATEWAYSUS	false
47.114.163.84	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
19.171.57.247	unknown	United States	3	MIT-GATEWAYSUS	false
188.6.43.140	unknown	Hungary	5483	MAGYAR-TELEKOM-MAIN-ASMagyarTelekomNyrtHU	false
85.226.53.82	unknown	Sweden	2119	TELENOR-NEXTELTelenorNorgeASNO	false
37.113.1.77	unknown	Russian Federation	50542	VORONEZH-ASRU	false
78.29.111.209	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
116.217.128.244	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
90.211.195.176	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
189.84.17.182	unknown	Brazil	28271	DataCorporeServicoseRepresentacoesBR	false
69.187.252.93	unknown	United States	3801	MISNETUS	false
193.159.2.168	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
148.247.51.114	unknown	Mexico	3548	CentrodeInvestigacionydeEstudiosAvanzadosdelMX	false
154.104.70.55	unknown	Tunisia	37693	TUNISIANATN	false
142.154.70.84	unknown	Saudi Arabia	25019	SAUDINETSTC-ASSA	false
206.254.76.212	unknown	United States	3354	THENET-AS-3354US	false
103.248.115.171	unknown	India	55832	HOMESYSTEM-AS-APHOMESYSTEMSPVTLTDIN	false
59.129.166.135	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
1.33.89.163	unknown	Japan	2514	INFOSPHERENTTPCCommunicationsIncJP	false
126.139.90.23	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
57.134.189.220	unknown	Belgium	2686	ATGS-MMD-ASUS	false
32.196.150.169	unknown	United States	2686	ATGS-MMD-ASUS	false
92.26.195.124	unknown	United Kingdom	13285	OPALTELECOM-ASTalkTalkCommunicationsLimitedGB	false
76.47.73.105	unknown	United States	18494	CENTURYLINK-LEGACY-EMBARQ-WRBGUS	false
167.204.16.15	unknown	United States	2897	GEORGIA-1US	false
43.157.40.116	unknown	Japan	4249	LILLY-ASUS	false
168.177.95.59	unknown	United States	11663	SUG-1US	false
190.140.199.41	unknown	Panama	18809	CableOndaPA	false
34.97.23.5	unknown	United States	15169	GOOGLEUS	false
177.172.99.226	unknown	Brazil	26599	TELEFONICABRASILSABR	false
172.129.7.95	unknown	United States	7018	ATT-INTERNET4US	false
156.76.237.26	unknown	United States	6341	WIECUS	false
12.187.191.134	unknown	United States	2386	INS-ASUS	false
91.96.201.33	unknown	Germany	9145	EWETELCloppenburgerStrasse310DE	false
170.195.117.143	unknown	United States	17052	TARGETUS	false
40.113.111.211	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
59.92.31.144	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
8.255.253.159	unknown	United States	3356	LEVEL3US	false
130.171.165.128	unknown	United States	12173	UAUS	false
36.185.9.19	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
114.206.14.217	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
63.32.229.93	unknown	United States	16509	AMAZON-02US	false
105.213.48.31	unknown	South Africa	16637	MTNNS-ASZA	false
115.142.9.194	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
45.121.98.253	unknown	China	9381	HKBNES-AS-APHKBNEnterpriseSolutionsHKLimitedHK	false
194.37.15.40	unknown	Austria	1853	ACONETACOnetBackboneAT	false
156.153.204.166	unknown	United States	71	HP-INTERNET-ASUS	false
13.134.4.120	unknown	United States	7018	ATT-INTERNET4US	false
120.207.118.183	unknown	China	56042	CMNET-SHANXI-APChinaMobilecommunicationscorporationCN	false
70.183.145.119	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
93.177.3.204	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
5.46.82.219	unknown	Turkey	20978	TT_MOBILIstanbulTR	false
217.151.141.23	unknown	Russian Federation	20576	GAZSVYAZ16NametkinastreetRU	false
220.228.155.68	unknown	Taiwan; Republic of China (ROC)	9919	NCIC-TWNewCenturyInfoCommTechCoLtdTW	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.29.26.161	NgAzrOQSgK.elf	Get hash	malicious	Mirai	Browse
120.200.190.110	1Uo8fEAB2W	Get hash	malicious	Mirai	Browse
181.166.21.134	i01hLg63ev	Get hash	malicious	Mirai	Browse
115.10.35.0	666.arm7	Get hash	malicious	Mirai	Browse
23.202.179.183	jew.ppc.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Mirai	Browse
	db0fa4b8db0333367e9bda3ab68b8042.arm.elf	Get hash	malicious	Mirai	Browse
	E6RdFEm96d	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	Fantazy.mips.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Fantazy.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	103.149.87.18-arm-2025-01-04T02_30_34.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	Fantazy.x86.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Fantazy.arm4.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	sshd.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TWC-10796-MIDWESTUS	Josho.x86.elf	Get hash	malicious	Unknown	Browse	174.100.168.112
	armv7l.elf	Get hash	malicious	Mirai	Browse	76.190.193.100
	3.elf	Get hash	malicious	Unknown	Browse	65.25.1.152
	DEMONS.x86.elf	Get hash	malicious	Unknown	Browse	162.152.37.95
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	107.11.179.17
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	71.72.221.179
	kwari.ppc.elf	Get hash	malicious	Unknown	Browse	107.11.94.212
	kwari.arm7.elf	Get hash	malicious	Mirai	Browse	70.63.14.217
	botx.sh4.elf	Get hash	malicious	Mirai	Browse	74.160.171.209
	botx.x86.elf	Get hash	malicious	Mirai	Browse	107.10.32.192
INTERWORLDUS	meerkat.mpsl.elf	Get hash	malicious	Mirai	Browse	207.151.187.89
	nabmips.elf	Get hash	malicious	Unknown	Browse	206.117.172.212
	arm7.elf	Get hash	malicious	Mirai	Browse	207.151.163.87
	iMJZGYeU7K.elf	Get hash	malicious	Mirai	Browse	207.151.187.83
	3igeJkzboL.elf	Get hash	malicious	Mirai	Browse	207.151.187.93
	qkPiKABtHC.elf	Get hash	malicious	Mirai, Moobot	Browse	207.151.175.73
	SdR6vL8QVT.elf	Get hash	malicious	Mirai	Browse	207.151.175.72
	9bk7zqYCFO.elf	Get hash	malicious	Unknown	Browse	207.151.163.84
	c3OuYxASg9.elf	Get hash	malicious	Unknown	Browse	207.136.155.241
	SecuriteInfo.com.Linux.Mirai.4514.1952.20875	Get hash	malicious	Mirai	Browse	207.151.175.77
AWT-CORP-001US	rnnTivv9Q5.elf	Get hash	malicious	Mirai	Browse	68.251.195.243
	K46lj7Z4aM.elf	Get hash	malicious	Unknown	Browse	68.251.195.255
	jDSxdSv24i.elf	Get hash	malicious	Mirai	Browse	68.251.195.255
	QHyplBDoPc.elf	Get hash	malicious	Mirai, Moobot	Browse	68.251.195.251
	7WbFyMm8j4	Get hash	malicious	Mirai	Browse	68.251.195.241
	trynagetmybinsufucker98575.arm7	Get hash	malicious	Mirai	Browse	68.251.195.251
Vodafone-EG	1.elf	Get hash	malicious	Unknown	Browse	196.149.161.165
	1.elf	Get hash	malicious	Unknown	Browse	196.133.244.107
	botx.mpsl.elf	Get hash	malicious	Mirai	Browse	196.136.125.50
	loligang.ppc.elf	Get hash	malicious	Mirai	Browse	196.142.34.171
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	196.142.38.97
	armv5l.elf	Get hash	malicious	Unknown	Browse	196.132.32.78
	armv4l.elf	Get hash	malicious	Unknown	Browse	196.150.233.249
	nklarm.elf	Get hash	malicious	Unknown	Browse	196.150.115.77
	ppc.elf	Get hash	malicious	Unknown	Browse	196.141.123.215
	armv6l.elf	Get hash	malicious	Unknown	Browse	196.131.65.219

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/6460/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:f:f
MD5:	D5E92B51880F0FEC2982F66A8699BAA2
SHA1:	6812B3A73700C886B4C47F68AA1E5624B382CEA2
SHA-256:	91C24EFBE9ADBAE93AB227367B38A5115C9017593543AB9C3F606EC018AC30FC
SHA-512:	A03EF374A31E3DE397E197A745E54AB83F874F42F2446B4534522B1D0814DDCFD184480DBB24619622F0AF6E589463022659ADE255FD381A66C64BD11FBEBDE7
Malicious:	false
Reputation:	low
Preview:	6428.

/run/systemd/journal/streams/.#9:75446bz5z9u

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.50819331219637
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7GKwZvXsjs7Lbgwzj:SbFuFyLVIg1BG+f+MG8ji4s
MD5:	F76B3A90FD2F2814F861D0A95E0507ED
SHA1:	E2C04BF228B621BE9B682AA3EC005AACB7E0F1C6
SHA-256:	CFA055EA359CF74228FCD5CC91D21E79A534B71F80A59A6C5A7D53E68C06335C
SHA-512:	872620DDED08C49942EC6BC170652A5DE65A198ADB241523ACD983E12BABE810FB81211B17427E56966DD8D49FDC6A27E24ECDAA6F8C9E6F0338344B7FA8F587
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=16b1a4cf331946b19c98ba2513b1e1fa.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76063rkCQzw

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.53446367340679
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MpiYxl6N091F2ji4s:qgFq6g10+f+MAYTn9nCs
MD5:	7B211ACCFC39B33340328310EEFF9166
SHA1:	A4D4AF62DBA86BBDCB2AA02868225C38F9D2F98D
SHA-256:	0C6CE159A27279207AD245550358F7883F46CE2DED6E8511F7A3174230F4DFA8
SHA-512:	3937AA1D29552F4561139FFE732562D752F71FC84A0B7B3FEFE44BD5511D45E427651F5D4C4F19D26790A724C4322AC816EC19502A835DD4583AA1F6BE2D1777
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9581f964c8db4f499ae30a6ed1578707.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76461862awv

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.478785201056812
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpyk+dT0ITSX5xsjsx:SbFuFyLVIg1BG+f+M0Fp0IekjNE
MD5:	7AB145CB3FC8CFE86AFD9F8FB4384FCC
SHA1:	26B002311320A3DAF6B95B4FC802C4075C2C047A
SHA-256:	B6CBFB9CC7C94DE1A385804E9E56ADA58DE6B44843ADF323AD58D5A2C4653BA5
SHA-512:	1441CCBBFC5CE38D239CEF4CBB377CAF72830752BC07F0B02FF0C8DE678EC63ADC1AB7896919512778F2589A62A51FF36EC23498601D1E02B1F971E255BE4CDF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cf25d19852594cd482f73990366f1672.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:76466j4yLxt

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.439324543008867
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M4BctzBlTK0jZcHcljX+:qgFq6g10+f+M4uWimAu
MD5:	8BC4662AE4C51502F8F0A747EE4AF0AB
SHA1:	7A84C30C908034C89F3213539E9E59BE82FAB65D
SHA-256:	23D325C10EAFA61DBCC7901AAAC45174C031183FDA0C1DAFC5234C5B4AA78502
SHA-512:	8918A3AC7EF01979D7488048BAA8782353D0A33C3921B5A05F2C82E94039A5A73A1ADCA7BE53816A6F8D0581D1803A2849D77C9F367EF64467D978C7287A7722
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=550d9bf4bc1d40d09e2f613e93e43e3d.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:76591F8Aozs

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.43086028206164
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6vkcRRkHAWXVUK0hM:SbFuFyLVIg1BG+f+M6vkUkHAWX+PjbVC
MD5:	66E378AA63019939155DF218513677A5
SHA1:	51086008CC7F1E491C8B08493B112CD109ED390D
SHA-256:	B8E8DC9491DE64DF788AB04FC35DBD9EFFC63B3A6CF6F3216E8E53373B5758A5
SHA-512:	8B98E1CA1215C31D45A36A9244285D8F1296B31536B69FF6EC8F7F910CE5A67E0015B5699568212BDC8F435C12A14512BFBFE0E0ABA143EED6E8C205F795F653
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=03fc72855d234472bf9320cd51ab71d8.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:76741M8gJot

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.435661650245816
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7N3IoBmVHkcwssMxN:SbFuFyLVIg1BG+f+MNhBmtVwNZjLkGq
MD5:	7E2BBE6A684BD9C5954797A271004D9D
SHA1:	E7BA6C37E46B0AAF8FD4BE11CFAE950D4A42F809
SHA-256:	A9DFD942797FC95DE56E2BCFFCD6B4959CFB074FA71CEA7AA39B740AB9082ADF
SHA-512:	F4F46A8EF34FA6E6A04293E89A54F5E515E907DAEAAF29837CEB59522C9F4F231ABC79D19B3A9B9AEB755FD0C4219F5A0FB96D4E829DCFB294C0315501001E13
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1f49ca0f789049ff8fd6360b72985f52.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:77057lxOVcw

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.389501191717488
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5ll+RQw780js1Had9:SbFuFyLVIg1BG+f+MdKjosQu
MD5:	0B1121DE654FCF0AC673F1D6D7699FDD
SHA1:	38326B024834841150E0291E672BF1182FEAA2A2
SHA-256:	D049813FE83BD5B57710B64F44BCC709F592D1EB0963139EE7DA097C08396FE1
SHA-512:	C3D7F95AB4DD8CE044F7C5A744A5F2F66CF743625408DE7595A6FA780A7CD08FA114E8B37CE18730C33E5F6F5C4B8E45F15E8FA9346AD807D96E0CAAD8CAEA5E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3426705baa534d05a7fa54543099dbd9.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:77076FGGdDu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.409007982477402
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M4imjlGTjFmzXvn:qgFqo6g7/+0+f+M4imxUQXvn
MD5:	6AA0E74431956ACDCB9910FB7B3C6494
SHA1:	A3262454987CA18BBE1B59DCE7F5FB29293A8DD1
SHA-256:	770BB6B95DBCE16C2098570AF91AFEE6D83F7BB522DEDD99DA68596EA2CACD1A
SHA-512:	DBCF730AFB56BC6FF47830006E82E05BEAA8677DCA5F3AAD9253EA91191956EEBA93D5ABD1E473E41A5EA96029EE5151145952B7281E61E5BE879429E7EE0CE5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=239a518aa0f5415291280ca4d65802e4.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:77083wJhPbt

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.377185342594401
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmpJL7U3QRy43oglf:SbFuFyLVI6g7/+BG+f+MHtig2jFmzXvn
MD5:	607A660B10710F8A366360705C472E70
SHA1:	7B498BC05401215BB6B2CB634B3DECC0809585F5
SHA-256:	02EFACCDED993D11DDD59D3E66643D8DC2B7DD1156BF2E9781573AAF5B01B0EA
SHA-512:	379838B9273E3F4BD2D04A64C303C0169A2284E7DB2A2489EC547AEE4DF96E749A81A1220751762859D7ADA40E8DCC4225C0D2B3644D055B20A7F108A243827D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c7e0d62dc5ee4384af17a2e45a1a4442.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:770899t5Tvs

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.384747753775705
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5vg1it+wWZjsmNz0/:SbFuFyLVIg1BG+f+MaMtZmjdCLKzK
MD5:	BE8FE6E98685B05A936B2B95331340A5
SHA1:	85B742E7C2E9CCF09C195A6F6ED68C6C0F8473CE
SHA-256:	930D7D9AEE6947C08EAD3A495CD5A53552C583018362E5BB052FA33027EFC9CB
SHA-512:	492BB7637E8F2002A44AF29C0EE81F26D55D3061A438224CC0E56FAAF11E2584B7BDD004F316BB190C2672C3A649DFC8E7CA4EF6678F385FFE27C95928A968F8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3acd3022aaf14db28495e2ebc439681d.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:77099fKqG2s

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.371310506584615
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm90NSEHAd2HQWcfA9O:SbFuFyLVIg1BG+f+M+8EHBwbfA+jtWL0
MD5:	51859F2219950BCD5A71C90EF87A4415
SHA1:	E7B603B91922DD1E55F203F75426838023F8FAE3
SHA-256:	28D98A8B4E4D28383F4C2380B6EF5E8698E02F4C7DC1EB93E2E697AC13EEDD8B
SHA-512:	E97D09ACD1DD30BB235AB3555595895A954EFAC1B133AFE69999EEB7C78721D0E8BDD8ED7D861E0DCCC36775A95432929EB2690B615C6623ABCCB1FDF40CEC3A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=747763d57fe64abe8e6bcb5f916ae127.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:77602mMdSOv

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.409947374181558
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm/qd7V83sjs2BZZGu:SbFuFyLVIg1BAf+MSIcjNTZD
MD5:	11C2DA1413A742C524808E1B5C54E8D4
SHA1:	EA57C9781084091D2EB55AB51F3E59BB76C18FAC
SHA-256:	88557BE7C7F6EF2DD5DC5A3ED00D50D9382005A9409BB5E1EC3541928EF32C26
SHA-512:	CE12EF84EBF987F93E0B7EE5934CAC5DB3EFDB1EE81CF0178EAE07F60DE1BD10956CD9A58C77750559EE7D228EF5846E77E8FF2798B7023CFA19A9A39B65CFC9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5096601ac3a74802b0ccfbfb768dce11.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77726xnTeJv

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.39148672254893
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MNYam/MqjLTTIWTIL:qgFq6g10+f+MNvm/M+EWEL
MD5:	B42D2963659F35BA4EDAD223669CF753
SHA1:	822F55276FE4B33F28C4A1B6C6D3EDF613B5206E
SHA-256:	57219115935A4B891B6F38A66BABC8D03A19DBD066CDB5CCDF24CC4443B62C2D
SHA-512:	5FDEA6A22F38F8ED9B227A82B90AAC9FBAA5991830B2E51A6808A628C82202109E0DC6ACFB5524FE4DD50ACB771BC3FF18178BDF37F26F33E8C587DEB338AE7E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=74f0a4c47b5c42e3afa74092fd94e1ce.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:77793o5jPfu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.4334418651811776
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxms1XUItBBmsshg2Q:SbFuFyLVK6g7/+BG+f+MsxBATjNq
MD5:	27FDEBD393036916E8B1DEC6BE9B45D5
SHA1:	307A160E5705F178C7D7B143A45783DDAA8E9643
SHA-256:	2A0CD8870CC01223B713025986E04AB9DA3C391527AC40A420EB7234E741E8CD
SHA-512:	2334C2A7F952022817CB2C160272750002A8028E01DE5F52CA0C590580C5E440AE97BD0B4B54405AC224DAB47219D72EEF46AF5AB384C8254A4008878D581784
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f43e22af46b745baa137d0d24a1c809f.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:77794aHTROv

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.4700841576310575
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm5lARLzUdhTDET0Q:SbFuFyLVI6g7/+BG+f+MrARCMIjNq
MD5:	5BDC37A8FEFA756671C0326E624F2F25
SHA1:	CC89957BC925D3D853960F14FD45391AC159A693
SHA-256:	84611C38BE69C08653DB7CFADF0683F30A9A4262B989A5F41930F1116A4C11BB
SHA-512:	82E81619F54EF3E5B43E3D3EC66789D3B4003C322E20B7411E5C1F48985EC93104CDC05B867C7BCEB7D3CC48879EE905595C271463FEA1B0B866F4D20DC3A001
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3852c8e77bc9401895c6f856fbbd2566.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:778131G0Apv

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.513159696591614
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MNHCR0XZ3h2jFQMzKaBu:qgFqo6g7/+0+f+M1CRWqTmh
MD5:	C291DB09D7C84FF11D0F54E07B526E02
SHA1:	D040B924C30FB77093048BAA0FDED13A23409D43
SHA-256:	6EAA36EBA8EDDF1AA38D96B60DF26D727ABB8CE27D57D1A4BF9377FD64888213
SHA-512:	C0D7DFA6FB7E7C76551FFABE4D090AA4EE1BCD2971FED2F0D3B9786B183D85AA1D24A5EAC071A27D9A03E6683B22F362AC3F448ED01EEA5125BF4BD6AF015325
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e8d2dc8927444a75a50c5ce61b0c7a62.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:77814K3Qbuw

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.504221377812633
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MZglWqUsMqjFQMzKaBu:qgFqdg7/+0+f+MQWLsvTmh
MD5:	CEFC59A07FEFAA2A8F4A3726D9C4F60C
SHA1:	2B17ABA6A36A556F0E698B21A2B047E86259B581
SHA-256:	430F3AAF5C6201E8298B1F193F10F2B83A13159B31FFE0F92ABD2C43E96BDDB5
SHA-512:	8AAC683B1234E467B028BC58C44D9B470BC4124F266A875415FAECC2C53B627DC23D5A23FE0F49F7193A04B833178F353D8A1A145F07DA7B3244B1659D95804C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e22d0a59358b4b63afd93fdc8a846689.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:78152x3ZvVw

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.464570744574066
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M6qe00NB+jdCt/rRMtq:qgFq6g10+f+Mb7CDL
MD5:	A061D805C035A332DB376377E5EB8820
SHA1:	385995F4D5754839E82B66B586C8A5E0A0CAFA9F
SHA-256:	4FA906796858B125957AA8728292FFA8C99EE364B5030C3396D42D51232D55B2
SHA-512:	249DC312494EA9489304900FEE6352BA2E844F99731AC83EB72E2B210F8990F235FF045E103CA798F43D059A0C46A5F7AB03FF7457A1C0BD9B7902767A70EB0C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0af5798eccea49f7bb5d163dd15f14e2.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:78158ldwect

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.443759324997425
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm/tMAdXnTUAhuqjs2ALl:SbFuFyLVIg1BAf+MVtTUAhTjNALyAZD
MD5:	22F42B5072DE91A8A4AFC2DE09F4E1D5
SHA1:	A9E8FFE16B6CE985C8A41E1494A1BBD821375544
SHA-256:	80EBB4938FBA841477409934D6BFBF55C8366F48111571C96670A8D9451DE8DF
SHA-512:	3E94518D3E3C47715FF253DEBCE1BB5422C43A752FAE5A6A35A3293B44FDB90C035313D3FFAB5AFECD7FC38DB13E7A19E7626E485BB425EFD36A243EA78F0322
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5aa24d032d0d4d48b21f826cb3d9961f.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78331u8jxIt

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.460406474994922
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmyjdX97a7EdUTzglsjsd:SbFuFyLVIg1BAf+MyjDVKzTjNdQIeXD
MD5:	4C4C0F8FF35F155B6EB2F39105A27CE7
SHA1:	51DB1410A1C7920EB85F4A46E6ED5ECDE894BB33
SHA-256:	756E041D2DB45C5A59ED6491468A7A08C4CD81F9EFECF35DCA7E786B87AE7281
SHA-512:	8356BD854F00CC8EB5E29E69581ED3B04F8347A96347596F0028720F36091852965A389E9FEB4DCFDC3EA32C6FE0575513E43ADE5AA9A0A3B37C421E5CC8CFD7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=896e633d95fb4f39a86eba6a7a816692.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:79699pLjbTt

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.369229638698361
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpLOxssdCPAuidFls9:SbFuFyLVIg1BG+f+MYxskCPr1joa
MD5:	3EA9568D13FC4CC5038CE7C0C433FE30
SHA1:	80BCAB48EC22EB6B42E374F4ECE9976D9BAAD2BA
SHA-256:	B02F37DAC7028C3429E7F6198A34FBB9A70A80D5AF15703D0DDEDFCF1CC5F8A6
SHA-512:	E518EEEB6A4FA77C6118CE4813A86B01B6FF15C2CA0A9B3F1A2AD9C1F3030B58BE57C94521C168AF22A32C75D5D4DBF5E385449EDD840D10AF14EB281770F272
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cc9f7420c82c4d82b709fce1cb8174aa.IDENTIFIER=dbus-daemon.

/run/systemd/seats/.#seat0UY3d7l

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0XOryeo

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/users/.#1277QPHdo

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#1278vNdin

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.320405098513081
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gATiHcgxsQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+gATccGsjthQHtPYb
MD5:	81A99F4FD31849158921E3429DC1B5C4
SHA1:	C7EE303C3A663517B591FDA84A4166FE1CA214E9
SHA-256:	035687320C05F076BE33CBF63C0095A2198CDCDC07F163043A90EA1A3E750626
SHA-512:	B7A9B5C37D06F94ACAE9B180FD1F03A6332BA6B5004B27E9D543E51221A99D8DE65B1E47EBD9E3616B66BC050A5DDF85848E827E5A53FB570A95A60060182B65
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1735967608728093.MONOTONIC=453531442.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127NLgnRn

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.352788560982085
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgAxT3SHcg9Fh/x6H206qodkV:SbFuFyL3BVgdL87iesnAiRJgATiHcgpS
MD5:	6BA9FF40BAF316D7AEC8C64BFF443EA2
SHA1:	140C754EFBB39DCB91BA71AABDC54CFA860DC644
SHA-256:	AC4A5A17C8F0BA601C4426B7A4BF939140EC6A84CCCF9EC5EC2700FF0BBF29BC
SHA-512:	F09D7DE7FDC0D351BE090AA39D4153A157D3BAEBE3E4E19EA99FEE97DBACFACBF7651EF7A005FA18D6235DE0351C9962BC43F76B25EFE00BE19622290BE15A30
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1735967608728093.MONOTONIC=453531442.LAST_SESSION_TIMESTAMP=453620820.

/run/systemd/users/.#127Tq8x2m

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.320405098513081
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gATiHcgxsQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+gATccGsjthQHtPYb
MD5:	81A99F4FD31849158921E3429DC1B5C4
SHA1:	C7EE303C3A663517B591FDA84A4166FE1CA214E9
SHA-256:	035687320C05F076BE33CBF63C0095A2198CDCDC07F163043A90EA1A3E750626
SHA-512:	B7A9B5C37D06F94ACAE9B180FD1F03A6332BA6B5004B27E9D543E51221A99D8DE65B1E47EBD9E3616B66BC050A5DDF85848E827E5A53FB570A95A60060182B65
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1735967608728093.MONOTONIC=453531442.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127YC3Afm

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.499115051077066
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6lgTgATiHcgp5it6uV:qgFq30dABibB3TgATccsoIi
MD5:	7EE06AEA019446ED4A98C3A7FDD31DB9
SHA1:	E59DDE7E37DB0B06192857065B452DAEE14B709B
SHA-256:	669D66C6E61897015A20FB5EB01B1585AC22303EBD59CAD3E7236ED12E4C412C
SHA-512:	8B41BC44EF1AFCA4D74F9775A696E199B65BAE539E2B8DB03F21FFD47522E51F5235F3CB07D24DFF03B43D471565B76E2629E8BB8B51F428F92ECFAC95D52C11
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12412.REALTIME=1735967608728093.MONOTONIC=453531442.LAST_SESSION_TIMESTAMP=453620820.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:fj:r
MD5:	7E41AD3DE04DEDE538E3A699CB9BC5BF
SHA1:	3E4CFBC35B69516D7B7684B026097102B0F8F82A
SHA-256:	9533BA2148A77E8734D14A8A56CCCF47E70682911EBA3AE908987573A90461CD
SHA-512:	A665985A11151AD20745B7A06B0B74B35FC8DA3478656530BAFAF12B6ADDCEC70AEEB637B64E82507B32D98787D20CA611F4C9A1182A367E9BF3FC0F1B3B7844
Malicious:	false
Preview:	6316.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6722951801018083
Encrypted:	false
SSDEEP:	3:I0sXlXEWtl/Gqlhj1l:u+ylzlh
MD5:	143C6D8FC0B1274722EC2DB379310004
SHA1:	66BEC8DC636E698472AC57342B87A333064547BD
SHA-256:	4D10E728A341053BA218EB09B594D61FBCE29A4CD76FBA627CAD0F6719E0EC73
SHA-512:	E842CB0EBE018FAC850FDF2EB10AEFEC755E9D805922BF8076AA31755FCFA76D4EBCF2CD721C57D6141B6685409A5028FA89E4A260E9C08D5A25CC14C7E1A634
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................f.xg........................................

/tmp/qemu-open.oIalmt (deleted)

Download File

Process:	/tmp/Fantazy.sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	3.5796258815476407
Encrypted:	false
SSDEEP:	6:URN3dDF6EcSSmb/VUMVbsDF6EcSNj/VWL/VDM/V+4D/VH:IldN4JUbENLeMfF
MD5:	3D3E41982A63F45B2BF1E00F60115FF7
SHA1:	D47EFB716D1DE305EA6D99E88117D14B99A7324D
SHA-256:	4E9673EF0B43B0B677339B63EA341AA222BABA79783936F690122B6C9DE39E52
SHA-512:	BBBE546929D3780D4FF0E78DB467559B94BC5AC96C5A6B33187B96DFFC679234EC4EBE9BA65E04B0411326088DDFE484E80F377C241B9B028C0A06BE778D6004
Malicious:	false
Preview:	400000-411000 r-xp 00000000 fd:00 531606 /tmp/Fantazy.sh4.elf.421000-422000 rw-p 00011000 fd:00 531606 /tmp/Fantazy.sh4.elf.422000-423000 rw-p 00000000 00:00 0 .423000-425000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/var/lib/AccountsService/users/gdm.714ZZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	678
Entropy (8bit):	4.7794669676394586
Encrypted:	false
SSDEEP:	12:oxeF0hLad5xeFtT4p1Wr4TxeF0nCLGaWr4ToJeF0hLajOEt+FXqwzfbZUQU:EY00pYr4lTJr4f/wrCQU
MD5:	1867BE50A6AE7C8453D8CCD171BE4141
SHA1:	077565E9C237ECCD8CC29953C6B54FBDF3278B5B
SHA-256:	619D0C0C6F36C68E70A93363A3F4EA869DD6CA560304D5CC329498B3214B921E
SHA-512:	B7C1B382CD406CE1B162C43400178C217C71002DBAD57223C8095E4D5242D1507B394BF3E2FB8619F8DF5B9CE4D014F1AECBF0D8711F23CFA5D100A9FDCFB38C
Malicious:	false
Preview:	Jan 3 23:13:28 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Jan 3 23:13:28 galassia systemd-logind[6324]: Failed to start session scope session-c1.scope: Unit session-c1.scope already exists..Jan 3 23:13:28 galassia gdm-launch-environment]: pam_systemd(gdm-launch-environment:session): Failed to create session: Unit session-c1.scope already exists..Jan 3 23:13:29 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session closed for user gdm.Jan 3 23:13:37 galassia dbus-daemon[6298]: [system] Failed to activate service 'org.bluez': timed out (service_start_timeout=25000ms).

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4261926861171588
Encrypted:	false
SSDEEP:	3:F31HlQoGxvl1ooGxvPt:F3G+
MD5:	A7C6D2DBBC5E0E27ABB07664F62B4DE1
SHA1:	C5A2D160B17D8684DAAC0DCDC789F69F2DFEC63D
SHA-256:	DA153CF7D1E274E4E31FCC9AEA0787E023A0BCBF3AA8AC59D63CBB2B4C335109
SHA-512:	ED1D94B64FDE414B051D2B0D171C2F2B7B083759875DD9BC23E4FDDAD6A517026ACD6869CA02A4DB906D4BB132D63C45A6BF6DCF8BE059DACE368297216565B7
Malicious:	false
Preview:	LPKSHHRH.................u....M..,D..Z.Z.................................u....M..,D..Z.Z........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31HlWnJ3oXllunJ3oXd:F3GnJ3K/unJ3K
MD5:	C5350CA04C05B5DB4AEB97EDBB2D2CC9
SHA1:	7FE0605745655DF84D8BE5A608900DF979FE04BE
SHA-256:	521D729DB86E72710DDE44DC75C1DB59B33E1648B1F3DD45D363382AB20F6356
SHA-512:	1FDE9D84443C61254B39FB2D5CA1A7323FCC7A9DD89AAA6A9A958E304A2DA15ADCBB2EB667C81B6B6B3C3560D29097C64C3DA562CDB6BB38453C83496A0784F5
Malicious:	false
Preview:	LPKSHHRH................tA.q..G........................................tA.q..G................................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	CSV text
Category:	dropped
Size (bytes):	6209
Entropy (8bit):	4.684703548215058
Encrypted:	false
SSDEEP:	96:/Gir7xeqiOYMDDjXma1OdqHuBHv4HmuFPQU+sVU:aKDQYHuBHAGsIU++U
MD5:	B7364A6619C124C33530553CCB1F0A33
SHA1:	1DD70C1065E21413CE9FC717DFEA8D8B6A42E82F
SHA-256:	8092C31F0F270DC66280921B7B5963FC68E40E881289C8FFEA30F6C49840D32E
SHA-512:	751138F167F2F455A006D8E25E3EF00CB89DF4508A1D622BF4541987124692E81BA1F9BA6670D8D2D0568ED1D7051566ECC2A269AD032A66BD8A34D775FBFDB4
Malicious:	false
Preview:	Jan 3 23:13:12 galassia kernel: [ 436.820390] New task spawned: old: (tgid 6316, tid 6316), new (tgid: 6316, tid: 6398).Jan 3 23:13:12 galassia kernel: [ 436.877084] New task spawned: old: (tgid 6395, tid 6395), new (tgid: 6399, tid: 6399).Jan 3 23:13:12 galassia kernel: [ 436.929045] New task spawned: old: (tgid 6399, tid 6399), new (tgid: 6400, tid: 6400).Jan 3 23:13:12 galassia kernel: [ 437.133012] New task spawned: old: (tgid 6395, tid 6395), new (tgid: 6402, tid: 6402).Jan 3 23:13:12 galassia kernel: [ 437.179014] New task spawned: old: (tgid 6402, tid 6402), new (tgid: 6403, tid: 6403).Jan 3 23:13:12 galassia kernel: [ 437.368793] New task spawned: old: (tgid 6401, tid 6401), new (tgid: 6401, tid: 6404).Jan 3 23:13:12 galassia kernel: [ 437.369711] New task spawned: old: (tgid 6401, tid 6401), new (tgid: 6401, tid: 6405).Jan 3 23:13:12 galassia kernel: [ 437.372074] New task spawned: old: (tgid 6401, tid 6404), new (tgid: 6401, tid: 6406).Jan 3 23:13:12 galassia

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (317)
Category:	dropped
Size (bytes):	26224
Entropy (8bit):	4.938553649882134
Encrypted:	false
SSDEEP:	768:wwUKPxLPx/9RjZNmqYVKuwLxVLrfLJGkwSCs4mv3D90C+Qv5lrn1hDcO64UIkq1P:XJ
MD5:	4090D4FAB88A577F596DD521AC975EB1
SHA1:	73D6190D285A6F14BC360820C578F1D421F52FEF
SHA-256:	91CAB84FA22DDC6DC7F27AD6E9340D539B5833690D348A948464C10FDE445B30
SHA-512:	F0F449FE9B11C0A41764A17E78E8AF657772F68AAC08B44AFD21D0823253A5F995D653BB411B0DE54258CCE406A4A6741125D70C61F522F5028FDCA71C800EF5
Malicious:	false
Preview:	Jan 3 23:13:12 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Jan 3 23:13:12 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Jan 3 23:13:12 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 1..Jan 3 23:13:12 galassia systemd[1]: Stopped System Logging Service..Jan 3 23:13:12 galassia systemd[1]: Starting System Logging Service....Jan 3 23:13:12 galassia rtkit-daemon[6321]: Successfully made thread 6398 of process 6316 owned by '1000' RT at priority 5..Jan 3 23:13:12 galassia rtkit-daemon[6321]: Supervising 2 threads of 1 processes of 1 users..Jan 3 23:13:12 galassia systemd[1]: session-2.scope: Succeeded..Jan 3 23:13:12 galassia kernel: [ 436.820390] New task spawned: old: (tgid 6316, tid 6316), new (tgid: 6316, tid: 6398).Jan 3 23:13:12 galassia kernel: [ 436.877084] New task spawned: old: (tgid 6395, tid 6395), new (tgid: 6399, tid: 6399).Jan 3 23:13:12 galassia kernel: [ 436.9290

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6722951801018083
Encrypted:	false
SSDEEP:	3:I0sXlXEWtl/Gqlhj1l:u+ylzlh
MD5:	143C6D8FC0B1274722EC2DB379310004
SHA1:	66BEC8DC636E698472AC57342B87A333064547BD
SHA-256:	4D10E728A341053BA218EB09B594D61FBCE29A4CD76FBA627CAD0F6719E0EC73
SHA-512:	E842CB0EBE018FAC850FDF2EB10AEFEC755E9D805922BF8076AA31755FCFA76D4EBCF2CD721C57D6141B6685409A5028FA89E4A260E9C08D5A25CC14C7E1A634
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................f.xg........................................

Source: Fantazy.sh4.elf	ReversingLabs: Detection: 60%
Source: Fantazy.sh4.elf	Virustotal: Detection: 57%			Perma Link

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.695322577886729
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Fantazy.sh4.elf
File size:	70'648 bytes
MD5:	bb781f2947411bc14a474cdd80cd39a2
SHA1:	10954dac8864b254d8b5d2f05affdf2998f04c2c
SHA256:	d430e1d375fa8aaf1da08adebc7a7679c06db222383d6d302d872c65e47cdd4a
SHA512:	7ea5fcc4c8feefc2449ac5f82011b5cc597288c75264ae7f222ef3bad67c6f417117719cbf1cb7a6145eef6117723ebf6e9fa9ebdf60b23ce187476bd485f58e
SSDEEP:	1536:P/0w74aVwt+nsDyVWFTf9mJeGJsixyyc/CbIxy:PcwEmrsuMweGlyyc/by
TLSH:	91638D75D5789CA0C5448AB1B6A8D9B44703A80892F77EF1CAC2CF55441BAFCF109BFA
File Content Preview:	.ELF.....................@.4...h.......4. ...(...............@...@.\|...\|.....................B...B.(...............Q.td............................././"O.n........#.@........#.*@.....o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	70248
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x30	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0xf5e0	0x0	0x6	AX	32
.fini	PROGBITS	0x40f6c0	0xf6c0	0x24	0x0	0x6	AX	4
.rodata	PROGBITS	0x40f6e4	0xf6e4	0x1298	0x0	0x2	A	4
.ctors	PROGBITS	0x421000	0x11000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x421008	0x11008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x421014	0x11014	0x214	0x0	0x3	WA	4
.bss	NOBITS	0x421228	0x11228	0x558	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x11228	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x1097c	0x1097c	6.8215	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x11000	0x421000	0x421000	0x228	0x780	2.9924	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 4, 2025 06:13:10.252300978 CET	192.168.2.23	1.1.1.1	0x1d7f	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 4, 2025 06:13:10.252300978 CET	192.168.2.23	1.1.1.1	0x6e1c	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Jan 4, 2025 06:13:10.551668882 CET	192.168.2.23	1.1.1.1	0x10bd	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 4, 2025 06:13:10.259284973 CET	1.1.1.1	192.168.2.23	0x1d7f	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Jan 4, 2025 06:13:10.259284973 CET	1.1.1.1	192.168.2.23	0x1d7f	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2025-01-04 05:13:13 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2025-01-04 05:13:13 UTC	25	IN	HTTP/1.1 100 Continue
2025-01-04 05:13:13 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2025-01-04 05:13:13 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2025-01-04 05:13:13 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2025-01-04 05:13:13 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2025-01-04 05:13:13 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2025-01-04 05:13:13 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2025-01-04 05:13:13 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2025-01-04 05:13:13 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2025-01-04 05:13:13 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2025-01-04 05:13:13 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2025-01-04 05:13:13 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Sat, 04 Jan 2025 05:13:13 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	05:12:41
Start date (UTC):	04/01/2025
Path:	/tmp/Fantazy.sh4.elf
Arguments:	/tmp/Fantazy.sh4.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	05:12:42
Start date (UTC):	04/01/2025
Path:	/tmp/Fantazy.sh4.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	05:12:49
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	05:12:50
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	05:13:08
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	05:13:09
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	05:13:10
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	05:13:11
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	05:13:12
Start date (UTC):	04/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	05:13:13
Start date (UTC):	04/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	05:13:14
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	05:13:16
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Fantazy.sh4.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6460/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:75446bz5z9u

/run/systemd/journal/streams/.#9:76063rkCQzw

/run/systemd/journal/streams/.#9:76461862awv

/run/systemd/journal/streams/.#9:76466j4yLxt

/run/systemd/journal/streams/.#9:76591F8Aozs

/run/systemd/journal/streams/.#9:76741M8gJot

/run/systemd/journal/streams/.#9:77057lxOVcw

/run/systemd/journal/streams/.#9:77076FGGdDu

/run/systemd/journal/streams/.#9:77083wJhPbt

/run/systemd/journal/streams/.#9:770899t5Tvs

/run/systemd/journal/streams/.#9:77099fKqG2s

/run/systemd/journal/streams/.#9:77602mMdSOv

/run/systemd/journal/streams/.#9:77726xnTeJv

/run/systemd/journal/streams/.#9:77793o5jPfu

/run/systemd/journal/streams/.#9:77794aHTROv

/run/systemd/journal/streams/.#9:778131G0Apv

/run/systemd/journal/streams/.#9:77814K3Qbuw

/run/systemd/journal/streams/.#9:78152x3ZvVw

/run/systemd/journal/streams/.#9:78158ldwect

/run/systemd/journal/streams/.#9:78331u8jxIt

/run/systemd/journal/streams/.#9:79699pLjbTt

/run/systemd/seats/.#seat0UY3d7l

/run/systemd/seats/.#seat0XOryeo

/run/systemd/users/.#1277QPHdo

/run/systemd/users/.#1278vNdin

/run/systemd/users/.#127NLgnRn

Linux Analysis Report
Fantazy.sh4.elf

Start time (UTC):	05:13:26
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	05:13:27
Start date (UTC):	04/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	05:13:28
Start date (UTC):	04/01/2025
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	05:13:29
Start date (UTC):	04/01/2025
Path:	/usr/lib/gdm3/gdm-wayland-session
Arguments:	-
File size:	76368 bytes
MD5 hash:	d3def63cf1e83f7fb8a0f13b1744ff7c

Start time (UTC):	05:13:30
Start date (UTC):	04/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	05:13:51
Start date (UTC):	04/01/2025
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Start time (UTC):	05:15:21
Start date (UTC):	04/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre