Edit tour

Linux Analysis Report
Fantazy.x86.elf

Overview

General Information

Sample name:	Fantazy.x86.elf
Analysis ID:	1584492
MD5:	9a58836855e1d012ddbdc736fd9684e9
SHA1:	8883a0b923f9f78b9ee2f04bfb762ddb5b91c703
SHA256:	bb902ee8a178297ef2163cf647e4ba180bac25ea5a1021ee90add0db08736511
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584492
Start date and time:	2025-01-05 17:22:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Fantazy.x86.elf
Detection:	MAL
Classification:	mal80.spre.troj.linELF@0/42@3/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing network information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/Fantazy.x86.elf
PID:	6222
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	VegaSec-KATANA001
Standard Error:

Process Tree

system is lnxubuntu20

Fantazy.x86.elf (PID: 6222, Parent: 6135, MD5: 9a58836855e1d012ddbdc736fd9684e9) Arguments: /tmp/Fantazy.x86.elf

Fantazy.x86.elf New Fork (PID: 6223, Parent: 6222)

Fantazy.x86.elf New Fork (PID: 6224, Parent: 6222)

Fantazy.x86.elf New Fork (PID: 6225, Parent: 6224)

Fantazy.x86.elf New Fork (PID: 6226, Parent: 6224)

Fantazy.x86.elf New Fork (PID: 6227, Parent: 6224)

systemd New Fork (PID: 6231, Parent: 1)

journalctl (PID: 6231, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6250, Parent: 1)

systemd-journald (PID: 6250, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6251, Parent: 1)

journalctl (PID: 6251, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6303, Parent: 1)

dbus-daemon (PID: 6303, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6309, Parent: 1860)

pulseaudio (PID: 6309, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6312, Parent: 1)

rtkit-daemon (PID: 6312, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6315, Parent: 1)

systemd-logind (PID: 6315, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6377, Parent: 1)

polkitd (PID: 6377, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6382, Parent: 1)

agetty (PID: 6382, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 6383, Parent: 1320)

Default (PID: 6383, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6384, Parent: 1320)

Default (PID: 6384, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6385, Parent: 1320)

Default (PID: 6385, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6388, Parent: 1)

gpu-manager (PID: 6388, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6389, Parent: 6388)

sh (PID: 6389, Parent: 6388, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6390, Parent: 6389)

grep (PID: 6390, Parent: 6389, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6392, Parent: 6388)

sh (PID: 6392, Parent: 6388, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6393, Parent: 6392)

grep (PID: 6393, Parent: 6392, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6395, Parent: 6388)

sh (PID: 6395, Parent: 6388, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6399, Parent: 6395)

grep (PID: 6399, Parent: 6395, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6400, Parent: 6388)

sh (PID: 6400, Parent: 6388, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6401, Parent: 6400)

grep (PID: 6401, Parent: 6400, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6402, Parent: 6388)

sh (PID: 6402, Parent: 6388, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6403, Parent: 6402)

grep (PID: 6403, Parent: 6402, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6405, Parent: 6388)

sh (PID: 6405, Parent: 6388, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6406, Parent: 6405)

grep (PID: 6406, Parent: 6405, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6407, Parent: 6388)

sh (PID: 6407, Parent: 6388, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6408, Parent: 6407)

grep (PID: 6408, Parent: 6407, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6410, Parent: 6388)

sh (PID: 6410, Parent: 6388, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6411, Parent: 6410)

grep (PID: 6411, Parent: 6410, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6391, Parent: 1)

rsyslogd (PID: 6391, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6412, Parent: 1)

generate-config (PID: 6412, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6413, Parent: 6412)

pkill (PID: 6413, Parent: 6412, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6416, Parent: 1)

gdm-wait-for-drm (PID: 6416, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6421, Parent: 1)

gdm3 (PID: 6421, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6426, Parent: 6421)

plymouth (PID: 6426, Parent: 6421, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6443, Parent: 6421)

gdm-session-worker (PID: 6443, Parent: 6421, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6447, Parent: 6443)

gdm-wayland-session (PID: 6447, Parent: 6443, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6449, Parent: 6447)

dbus-daemon (PID: 6449, Parent: 6447, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6451, Parent: 6449)

dbus-daemon New Fork (PID: 6452, Parent: 6451)

false (PID: 6452, Parent: 6451, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6453, Parent: 6447)

dbus-run-session (PID: 6453, Parent: 6447, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6454, Parent: 6453)

dbus-daemon (PID: 6454, Parent: 6453, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6455, Parent: 6421)

Default (PID: 6455, Parent: 6421, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6456, Parent: 6421)

Default (PID: 6456, Parent: 6421, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6427, Parent: 1)

accounts-daemon (PID: 6427, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6438, Parent: 6427)

language-validate (PID: 6438, Parent: 6427, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6439, Parent: 6438)

language-options (PID: 6439, Parent: 6438, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6440, Parent: 6439)

sh (PID: 6440, Parent: 6439, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6441, Parent: 6440)

locale (PID: 6441, Parent: 6440, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6442, Parent: 6440)

grep (PID: 6442, Parent: 6440, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

gvfsd-fuse New Fork (PID: 6470, Parent: 2038)

fusermount (PID: 6470, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6511, Parent: 1860)

dbus-daemon (PID: 6511, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Fantazy.x86.elf	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x46a:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
Fantazy.x86.elf	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5830:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
Fantazy.x86.elf	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x4f3:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
Fantazy.x86.elf	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0x39b:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
Fantazy.x86.elf	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x1142:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1222:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x12f7:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x15a2:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1a35:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
Fantazy.x86.elf	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0xf788:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
Fantazy.x86.elf	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x2b3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
Fantazy.x86.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xc882:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
Fantazy.x86.elf	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x23a2:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
Fantazy.x86.elf	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xe796:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
Fantazy.x86.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xd2bd:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
Fantazy.x86.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xc852:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 7 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6223.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x46a:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
6223.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5830:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6223.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x4f3:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
6223.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0x39b:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
6223.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x1142:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1222:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x12f7:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x15a2:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1a35:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
6223.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0xf788:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
6223.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x2b3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
6223.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xc882:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6223.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x23a2:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6223.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xe796:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6223.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xd2bd:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6223.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xc852:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6226.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x46a:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
6226.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5830:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6226.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x4f3:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
6226.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0x39b:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
6226.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x1142:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1222:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x12f7:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x15a2:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1a35:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
6226.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0xf788:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
6226.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x2b3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
6226.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xc882:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6226.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x23a2:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6226.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xe796:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6226.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xd2bd:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6226.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xc852:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6222.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x46a:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
6222.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5830:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6222.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x4f3:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
6222.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0x39b:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
6222.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x1142:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1222:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x12f7:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x15a2:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1a35:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
6222.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0xf788:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
6222.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x2b3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
6222.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xc882:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6222.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x23a2:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6222.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xe796:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6222.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xd2bd:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6222.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xc852:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6225.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x46a:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
6225.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5830:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6225.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x4f3:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
6225.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0x39b:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
6225.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x1142:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1222:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x12f7:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x15a2:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1a35:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
6225.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0xf788:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
6225.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x2b3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
6225.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xc882:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6225.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x23a2:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6225.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xe796:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6225.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xd2bd:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6225.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xc852:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6224.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x46a:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
6224.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x5830:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6224.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x4f3:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
6224.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0x39b:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
6224.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x1142:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1222:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x12f7:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x15a2:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1a35:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
6224.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0xf788:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
6224.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0x2b3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
6224.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xc882:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6224.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x23a2:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6224.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xe796:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6224.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xd2bd:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6224.1.0000000008048000.0000000008059000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0xc852:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 55 entries

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6391)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6250)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6421)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6449)	Socket: unknown address family	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 85.142.43.49
Source: unknown	TCP traffic detected without corresponding DNS query: 103.74.114.223
Source: unknown	TCP traffic detected without corresponding DNS query: 40.122.153.49
Source: unknown	TCP traffic detected without corresponding DNS query: 189.6.95.49
Source: unknown	TCP traffic detected without corresponding DNS query: 76.218.236.255
Source: unknown	TCP traffic detected without corresponding DNS query: 48.70.52.155
Source: unknown	TCP traffic detected without corresponding DNS query: 39.137.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 31.58.11.201
Source: unknown	TCP traffic detected without corresponding DNS query: 190.107.158.62
Source: unknown	TCP traffic detected without corresponding DNS query: 201.84.112.49
Source: unknown	TCP traffic detected without corresponding DNS query: 20.163.70.209
Source: unknown	TCP traffic detected without corresponding DNS query: 2.241.171.225
Source: unknown	TCP traffic detected without corresponding DNS query: 204.113.95.216
Source: unknown	TCP traffic detected without corresponding DNS query: 179.114.161.54
Source: unknown	TCP traffic detected without corresponding DNS query: 183.152.99.144
Source: unknown	TCP traffic detected without corresponding DNS query: 86.102.186.184
Source: unknown	TCP traffic detected without corresponding DNS query: 108.136.72.13
Source: unknown	TCP traffic detected without corresponding DNS query: 201.49.114.77
Source: unknown	TCP traffic detected without corresponding DNS query: 8.250.2.203
Source: unknown	TCP traffic detected without corresponding DNS query: 43.3.108.60
Source: unknown	TCP traffic detected without corresponding DNS query: 78.69.25.147
Source: unknown	TCP traffic detected without corresponding DNS query: 35.65.1.181
Source: unknown	TCP traffic detected without corresponding DNS query: 126.39.155.109
Source: unknown	TCP traffic detected without corresponding DNS query: 145.39.77.197
Source: unknown	TCP traffic detected without corresponding DNS query: 88.204.221.228
Source: unknown	TCP traffic detected without corresponding DNS query: 17.96.122.216
Source: unknown	TCP traffic detected without corresponding DNS query: 96.25.105.105
Source: unknown	TCP traffic detected without corresponding DNS query: 103.200.115.43
Source: unknown	TCP traffic detected without corresponding DNS query: 66.83.152.140
Source: unknown	TCP traffic detected without corresponding DNS query: 189.205.217.11
Source: unknown	TCP traffic detected without corresponding DNS query: 19.47.66.53
Source: unknown	TCP traffic detected without corresponding DNS query: 73.72.16.55
Source: unknown	TCP traffic detected without corresponding DNS query: 169.3.157.199
Source: unknown	TCP traffic detected without corresponding DNS query: 162.239.102.237
Source: unknown	TCP traffic detected without corresponding DNS query: 70.159.7.124
Source: unknown	TCP traffic detected without corresponding DNS query: 43.164.36.18
Source: unknown	TCP traffic detected without corresponding DNS query: 39.104.14.11
Source: unknown	TCP traffic detected without corresponding DNS query: 120.87.223.119
Source: unknown	TCP traffic detected without corresponding DNS query: 211.180.32.68
Source: unknown	TCP traffic detected without corresponding DNS query: 92.242.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 206.151.8.125
Source: unknown	TCP traffic detected without corresponding DNS query: 102.211.171.189
Source: unknown	TCP traffic detected without corresponding DNS query: 192.188.132.126
Source: unknown	TCP traffic detected without corresponding DNS query: 173.54.17.27
Source: unknown	TCP traffic detected without corresponding DNS query: 106.112.37.232
Source: unknown	TCP traffic detected without corresponding DNS query: 153.63.239.127
Source: unknown	TCP traffic detected without corresponding DNS query: 203.17.42.49
Source: unknown	TCP traffic detected without corresponding DNS query: 111.23.186.123
Source: unknown	TCP traffic detected without corresponding DNS query: 184.138.130.166

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.51.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53718
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6223.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 6223.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6223.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 6223.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 6223.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 6223.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Source: 6223.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 6223.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6223.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6223.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6223.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6223.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6222.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 6222.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6222.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 6222.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 6222.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 6222.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Source: 6222.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 6222.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6222.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6222.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6222.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6222.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 6046, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 6198, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 6199, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 6224, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 6226, result: unknown	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 6046, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 6198, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 6199, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 6224, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86.elf (PID: 6226)	SIGKILL sent: pid: 6226, result: unknown	Jump to behavior

Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: Fantazy.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6223.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 6223.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6223.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 6223.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 6223.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 6223.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Source: 6223.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 6223.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6223.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6223.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6223.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6223.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6226.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6222.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6222.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6222.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6222.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6225.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6224.1.0000000008048000.0000000008059000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26

Source: classification engine

Classification label: mal80.spre.troj.linELF@0/42@3/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6303)	File: /proc/6303/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6449)	File: /proc/6449/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6454)	File: /proc/6454/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6470)	File: /proc/6470/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6511)	File: /proc/6511/mounts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:75441iHysJO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:75442fzbMxM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:768501bUMvM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:76154yh6FUO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:76163LaaIAO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:76242ATRqRL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:76244CeQcQL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:77139Pq51uN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:77277GN58pO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:77368adS99L	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:77466YhWmrP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:77467Hz8MnL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:77468YNnenM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:7758604mwLO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:77613qruZNO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:776146Vij2M	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:776300jFJUN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:77631W5beOO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File: /run/systemd/journal/streams/.#9:77741Kshh8N	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6315)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6315)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6315)	File: /run/systemd/seats/.#seat09MMvuI	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6315)	File: /run/systemd/users/.#127NY2TEG	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6315)	File: /run/systemd/users/.#1273d7SGH	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6315)	File: /run/systemd/seats/.#seat05pqhtJ	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6315)	File: /run/systemd/users/.#127UcaFII	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6315)	File: /run/systemd/users/.#127bAjBuH	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6315)	File: /run/systemd/users/.#127yDWKWF	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6315)	File: /run/systemd/users/.#127Qae6xH	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6377)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6447)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6427)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6427)	Directory: /root/.cache	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6511/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6511/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6511/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6511/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6511/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6511/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6511/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6312/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6312/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6312/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6312/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6312/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6312/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6312/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6312/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6312/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6312/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6312/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6312/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6312/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6312/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2078/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2078/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2078/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2078/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2078/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2078/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2078/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2077/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2077/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2077/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2077/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2077/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2077/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2077/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2033/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2033/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2033/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2033/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2033/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2033/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2033/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2074/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2074/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2074/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2074/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2074/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2074/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2074/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6391/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6391/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6391/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6391/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6391/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6391/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/6391/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1532/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1532/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1532/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1532/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1532/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1532/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1532/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1576/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1576/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1576/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1576/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1576/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1576/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1334/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6250)	File opened: /proc/1334/cgroup	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6389)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6392)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6395)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6400)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6402)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6405)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6407)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6410)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6440)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Source: /bin/sh (PID: 6390)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6393)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6399)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6401)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6403)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6406)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6408)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6411)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6442)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6413)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6250)

Reads from proc file: /proc/meminfo

Jump to behavior

Source: /sbin/agetty (PID: 6382)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6421)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6421)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6427)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6427)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6388)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6391)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6391)	Log file created: /var/log/auth.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 6388)

Truncated file: /var/log/gpu-manager.log

Jump to behavior

Source: /usr/bin/pulseaudio (PID: 6309)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pkill (PID: 6413)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6250)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6309)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6382)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6388)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6391)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6443)	Queries kernel information via 'uname':	Jump to behavior

Source: syslog.51.dr	Binary or memory string: Jan 5 10:23:26 galassia kernel: [ 452.915918] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: syslog.51.dr	Binary or memory string: Jan 5 10:23:26 galassia kernel: [ 452.915901] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6427)

Logged in records file read: /var/log/wtmp

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
Fantazy.x86.elf	71%	ReversingLabs	Linux.Trojan.Mirai
Fantazy.x86.elf	100%	Avira	EXP/ELF.Gafgyt.Z.A
Fantazy.x86.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.51.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.248.61.231	unknown	Canada	7794	EXECULINKCA	false
223.143.50.20	unknown	Taiwan; Republic of China (ROC)	17421	EMOME-NETMobileBusinessGroupTW	false
78.224.99.170	unknown	France	12322	PROXADFR	false
124.4.144.128	unknown	India	18302	SKG_NW-AS-KRSKTelecomKR	false
199.107.165.229	unknown	United States	11045	STERLINGUS	false
120.155.18.152	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
112.229.90.8	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
200.138.159.75	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
160.95.61.224	unknown	United States	217	UMN-SYSTEMUS	false
218.78.243.136	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
141.186.179.41	unknown	United States	197921	HBTFJO	false
170.253.200.162	unknown	United States	46687	MAXXSOUTH-BROADBANDUS	false
79.127.58.235	unknown	Iran (ISLAMIC Republic Of)	43754	ASIATECHIR	false
48.216.105.46	unknown	United States	2686	ATGS-MMD-ASUS	false
14.95.182.56	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
133.29.42.176	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
145.109.132.147	unknown	Netherlands	1124	UVA-NLUniversiteitvanAmsterdamEU	false
95.247.94.70	unknown	Italy	3269	ASN-IBSNAZIT	false
69.35.158.7	unknown	United States	6621	HNS-DIRECPCUS	false
23.44.181.15	unknown	United States	16625	AKAMAI-ASUS	false
203.248.36.103	unknown	Korea Republic of	9848	SEJONGTELECOM-AS-KRSejongTelecomKR	false
104.203.151.99	unknown	United States	18978	ENZUINC-US	false
147.111.209.208	unknown	Norway	199791	EMBRIQ-NO	false
47.26.86.96	unknown	United States	20115	CHARTER-20115US	false
188.0.85.70	unknown	Ukraine	3326	DATAGROUPDatagroupPJSCUA	false
218.172.118.63	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
222.195.208.131	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
165.203.182.154	unknown	United States	17759	CLPPOWER-AS-APCLPPowerHongKongLimitedHK	false
126.57.177.213	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
185.238.3.197	unknown	Netherlands	200313	INTERNET-ITNL	false
57.152.198.155	unknown	Belgium	2686	ATGS-MMD-ASUS	false
222.26.252.163	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
134.254.15.119	unknown	United States	3562	SNLL-NET-ASUS	false
174.105.253.160	unknown	United States	10796	TWC-10796-MIDWESTUS	false
89.107.189.216	unknown	Germany	12843	TELEMAXXDE	false
197.233.228.68	unknown	Namibia	36999	TELECOM-NAMIBIANA	false
43.201.20.41	unknown	Japan	4249	LILLY-ASUS	false
164.249.142.8	unknown	United States	5972	DNIC-ASBLK-05800-06055US	false
164.151.152.186	unknown	South Africa	37130	SITA-ASZA	false
14.225.246.58	unknown	Viet Nam	135905	VNPT-AS-VNVIETNAMPOSTSANDTELECOMMUNICATIONSGROUPVN	false
117.162.68.66	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
119.68.28.242	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
160.67.104.104	unknown	Norway	21293	ASN-NRKNRKAutonomousSystemNO	false
39.64.200.127	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
118.231.60.23	unknown	Taiwan; Republic of China (ROC)	9674	FET-TWFarEastToneTelecommunicationCoLtdTW	false
203.125.222.162	unknown	Singapore	9255	CONNECTPLUS-ASSingaporeTelecomSG	false
41.76.243.176	unknown	Botswana	14988	BTC-GATE1BW	false
142.13.30.102	unknown	Canada	16796	MERLIN-NETCA	false
193.50.97.242	unknown	France	2200	FR-RENATERReseauNationaldetelecommunicationspourlaTec	false
200.197.22.77	unknown	Brazil	10733	DCMATRIXINTERNETSABR	false
72.154.201.87	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
209.133.106.123	unknown	United States	18970	XNPDUS	false
66.109.17.9	unknown	United States	22418	COLOGUS	false
66.78.155.16	unknown	United States	18474	AENEAS-CWUS	false
44.189.222.73	unknown	United States	7377	UCSDUS	false
94.144.179.77	unknown	Denmark	9158	TELENOR_DANMARK_ASDK	false
74.71.181.108	unknown	United States	12271	TWC-12271-NYCUS	false
53.176.87.32	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
196.251.2.123	unknown	South Africa	37417	SONIC-WirelessZA	false
109.188.39.151	unknown	Russian Federation	47395	SCARTEL-ASRU	false
76.242.246.223	unknown	United States	7018	ATT-INTERNET4US	false
204.142.90.157	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
202.254.46.130	unknown	Japan	18143	DCSNETMitsubishiResearchInstituteDCSCoLtdJP	false
43.131.43.87	unknown	Japan	4249	LILLY-ASUS	false
165.14.113.84	unknown	Japan	18271	EVONETSojitzSystemsCorporationJP	false
32.167.24.91	unknown	United States	2686	ATGS-MMD-ASUS	false
97.54.159.89	unknown	United States	22394	CELLCOUS	false
113.155.45.159	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
162.76.45.88	unknown	United States	7155	VIASAT-SP-BACKBONEUS	false
180.32.145.35	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
177.212.185.124	unknown	Brazil	26599	TELEFONICABRASILSABR	false
201.109.106.22	unknown	Mexico	8151	UninetSAdeCVMX	false
89.49.174.210	unknown	Germany	5430	FREENETDEfreenetDatenkommunikationsGmbHDE	false
210.134.143.159	unknown	Japan	4719	ONKYOOnkyoCorporationJP	false
68.92.37.13	unknown	United States	7018	ATT-INTERNET4US	false
83.239.145.207	unknown	Russian Federation	33934	VOLGOGRADEC-ASRU	false
136.85.207.247	unknown	United States	60311	ONEFMCH	false
53.176.87.48	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
174.195.101.235	unknown	United States	22394	CELLCOUS	false
102.171.159.177	unknown	Tunisia	37693	TUNISIANATN	false
217.191.96.192	unknown	Germany	6805	TDDE-ASN1DE	false
181.183.255.112	unknown	Venezuela	6306	TELEFONICAVENEZOLANACAVE	false
152.72.195.105	unknown	United States	21558	SC-JOHNSONUS	false
173.140.11.80	unknown	United States	10507	SPCSUS	false
85.156.116.34	unknown	Finland	719	ELISA-ASHelsinkiFinlandEU	false
178.244.8.76	unknown	Turkey	16135	TURKCELL-ASTurkcellASTR	false
216.107.183.34	unknown	United States	32765	SENTCOUS	false
69.54.214.169	unknown	United States	27553	TELNETUS	false
89.142.83.164	unknown	Slovenia	5603	SIOL-NETTelekomSlovenijeddSI	false
178.218.146.78	unknown	United Kingdom	30475	WEHOSTWEBSITES-COMUS	false
109.241.19.167	unknown	Poland	29314	VECTRANET-ASAlZwyciestwa25381-525GdyniaPolandPL	false
149.88.225.249	unknown	United States	188	SAIC-ASUS	false
140.221.89.133	unknown	United States	683	ARGONNE-ASUS	false
90.209.130.56	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
165.213.216.148	unknown	Korea Republic of	6619	SAMSUNGSDS-AS-KRSamsungSDSIncKR	false
103.40.31.107	unknown	China	63612	XIAONIAOYUNShenzhenQianhaibirdcloudcomputingCoLtd	false
126.204.131.16	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
78.151.138.22	unknown	United Kingdom	13285	OPALTELECOM-ASTalkTalkCommunicationsLimitedGB	false
95.124.177.94	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
92.48.55.51	unknown	Saudi Arabia	35819	MOBILY-ASEtihadEtisalatCompanyMobilySA	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
14.95.182.56	hwUWc6cDPF.elf	Get hash	malicious	Mirai	Browse
23.248.61.231	sora.x86	Get hash	malicious	Mirai	Browse
23.248.61.231	G1uMem2Msx	Get hash	malicious	Mirai	Browse
120.155.18.152	72rFyevgyP	Get hash	malicious	Mirai	Browse
160.95.61.224	yXTRZQmYdr	Get hash	malicious	Unknown	Browse
23.44.181.15	ceTv2SnPn9.elf	Get hash	malicious	Mirai	Browse
203.248.36.103	botx.sh4.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	Fantazy.arm5.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	103.6.170.65-boatnet.m68k-2025-01-05T14_12_44.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	Fantazy.sh4.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Fantazy.i486.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	momo.arm5.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	momo.x86_64.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	unix.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	z0r0.arm.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	z0r0.ppc.elf	Get hash	malicious	Unknown	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
EMOME-NETMobileBusinessGroupTW	momo.arm7.elf	Get hash	malicious	Mirai	Browse	223.137.35.213
	2.elf	Get hash	malicious	Unknown	Browse	42.66.128.85
	armv6l.elf	Get hash	malicious	Unknown	Browse	42.67.225.250
	Fantazy.i686.elf	Get hash	malicious	Unknown	Browse	42.70.98.119
	Fantazy.arm4.elf	Get hash	malicious	Unknown	Browse	223.136.108.156
	db0fa4b8db0333367e9bda3ab68b8042.i686.elf	Get hash	malicious	Mirai, Gafgyt	Browse	42.67.207.210
	db0fa4b8db0333367e9bda3ab68b8042.m68k.elf	Get hash	malicious	Mirai, Gafgyt	Browse	42.75.76.223
	armv5l.elf	Get hash	malicious	Mirai	Browse	42.75.134.232
	jklm68k.elf	Get hash	malicious	Unknown	Browse	223.137.83.127
	nklmips.elf	Get hash	malicious	Unknown	Browse	42.70.51.171
PROXADFR	momo.mips.elf	Get hash	malicious	Mirai	Browse	88.180.232.176
	momo.arm.elf	Get hash	malicious	Mirai	Browse	78.234.76.85
	momo.arm7.elf	Get hash	malicious	Mirai	Browse	88.165.176.186
	armv4l.elf	Get hash	malicious	Unknown	Browse	91.174.92.37
	1.elf	Get hash	malicious	Unknown	Browse	78.225.31.198
	armv6l.elf	Get hash	malicious	Unknown	Browse	78.201.21.165
	armv4l.elf	Get hash	malicious	Unknown	Browse	78.212.91.174
	4.elf	Get hash	malicious	Unknown	Browse	83.214.14.250
	fuckunix.sh4.elf	Get hash	malicious	Mirai	Browse	78.246.60.94
	fuckunix.x86.elf	Get hash	malicious	Mirai	Browse	83.154.51.183
EXECULINKCA	1.elf	Get hash	malicious	Unknown	Browse	23.252.11.1
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse	209.204.200.233
	jew.arm7.elf	Get hash	malicious	Mirai	Browse	104.194.43.252
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	66.203.179.104
	yakuza.ppc.elf	Get hash	malicious	Unknown	Browse	209.204.200.210
	na.elf	Get hash	malicious	Mirai	Browse	23.248.61.234
	na.elf	Get hash	malicious	Mirai	Browse	23.248.61.235
	arm.elf	Get hash	malicious	Mirai	Browse	23.252.11.17
	eyKGju2MU8.elf	Get hash	malicious	Mirai	Browse	23.252.11.15
	XeWgeH74wX.elf	Get hash	malicious	Mirai	Browse	64.39.160.2

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/6452/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Q:Q
MD5:	0734600370BC0448511F337472936A4E
SHA1:	CF281B1FD7081B1A967361A9333C6EDB5E0A6CAE
SHA-256:	B84AF58736A4B032136A9DD2856F8718D7356F9AF3FE5EFBB0BE5833820760D7
SHA-512:	7DCF4FBB85FDC32F2B22BA38F1904EBACBF5E8D8EA79484C189F6A3ECC6C2C32CA71DA2B18FB39EE3A204CBF372837491CB334F9199C46962D98C9E57C61FE62
Malicious:	false
Reputation:	low
Preview:	6421.

/run/systemd/journal/streams/.#9:75441iHysJO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.524308236157954
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M08XGv7ROfa0Zji4s:qgFq6g10+f+Mj2vYtjs
MD5:	24131453CCB7BBBADAE022F37982E2B2
SHA1:	9B68946E717C32E10EBD982412728B0DC36E969D
SHA-256:	8C8C441BE10C2BD0E2024A371BD8D945BB5657FD6D1E72FA44495C6C2CD14FB2
SHA-512:	B3DC566089C08A0FA68BF8D700EC0D022172577CBC432490C866CE656876B76EEF79C984954DEB68D650AD79E32979BE18C11C7FAD17E06B2CA61E8BA1CDD293
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a751b925646e409fa74255a662343070.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:75442fzbMxM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.521026622185492
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+4StRBg3XSgVTB3Ml:SbFuFyLVIg1BG+f+M+4SCThMqji4s
MD5:	B85453F71F8212940337DF5CC1954272
SHA1:	248CDB9C6F6831549DB2FB71364576C665589AE2
SHA-256:	BBE3B092FE610460BB2A15C4935344152DD6805F1045D514B64F792E323AEF03
SHA-512:	D41144BA8845B141C6962F0F5C359634DD182C6A4E43663850CEE3219188D8351044F756DE767E78B84DF6B3FC1D722743AD756B08EA02D95E996437BA1D099A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=40aee7fbe8304d5cb144b2717d306d25.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76154yh6FUO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.4027061071098865
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5mSgXUyqjvFrxsjst:SbFuFyLVIg1BG+f+MNUMvFrqjdCLKzK
MD5:	F88C3A84586B1C95E59E6BFABB89116D
SHA1:	D043DDE0E4A4CDE3BD7AFAEFFA2FBE4E63A2C3A0
SHA-256:	FB3B6710727A5530ABDD66B6B8B5A1B52006412267AAC2079D379777D6651017
SHA-512:	7AA3A53B8B4917921E089A0B80E9186CBEFA98CE062DF9F7C075FDAD01AA7C7BB40335342CBB2D971DD4F5E86AFE3F3F1E0AA95366763CC512F33D269C376A94
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3966624475974801917813d06d9ce5f1.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:76163LaaIAO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.306604139369825
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoG63RXEiz1sjshQJT:SbFuFyLVIg1BG+f+MoFpEqmjtWL0
MD5:	1A1E479DC6E9C379A939E6F00DD5A91C
SHA1:	755B3ADA82BD3C80ECFB02315BDC1A45362B9DC3
SHA-256:	859B2E95C08DD328CEC9FAF29633036A8165D992BCBD30474ADA62DACDBB87E5
SHA-512:	991FF1E5057A406FD0C8372FCC54D51430471CBA1AFBDAECC17E5979756625075F7E6232E611AF1FDC4FB7842D2D24572EAFA4EF280FE5AF4E37DEDE1120D3BD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bc9c4a0a30c34767baeeaf6ee4cb8140.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:76242ATRqRL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.424950030371169
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9UTULMzy2GDrqjsjF:SbFuFyLVIg1BG+f+MCYL+DGajNE
MD5:	C2F5CCBB04510BB8EA275BDF41E3E5B2
SHA1:	8B43CE0DF8A05D0D2455FF6A69066529313002CF
SHA-256:	03CE2E41ADECB82EC695B058E50CFC31C7E0B2A25CE2CA65E2B3830DF3A60512
SHA-512:	9E028185911F863F85510C05542BAA0B7224174CADE24CF9F31EF60CA3B5B9BC5A20913279DDB7EB8893F3575C280E8F2A7BF5AE19D7309EE748A8E1C4F167AB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=77112f1790794d0290243527d445ca16.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:76244CeQcQL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.486889967766641
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M4TGV6ZWBv0jZcHcljX+:qgFq6g10+f+M4TWJdimAu
MD5:	BC25D252280EE4D555E34C2F3F418CB8
SHA1:	AD15425487D0030135C805C3A4009AC6D183ECE1
SHA-256:	47A4FE9F8A43084F91857033600CF6781D2B54D46286E8727E029CB117C7377B
SHA-512:	C09521CF58CCFE178ED4DC23D6263E65823878B95DDD537EB3E7D1B443E4A2733AF47363C9E5658F61F949E36E106A87632367144D650607A95AF6937C2BEC78
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=293e2cee23264bf49572f0b92c5d76dc.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:768501bUMvM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.386414188813865
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+8+pwdDhDglsjs1Ha:SbFuFyLVIg1BG+f+M+8+pwBxg2josQu
MD5:	60CDD86E7EF709DEE85F46418FDB1E74
SHA1:	E5B4BF78430811731E8DB4FB64B206C21C2DC0CF
SHA-256:	436C91AF3D51E4F9AE34E27A2FD6F83858EC79108DE7CE571AA6E9A4540503FF
SHA-512:	C5AB4246FE30AF8C445B45A846146C1A6999B29CF2BE635FAE81C539AD6EBB7A7DA4D34A38302160ED48FCC7A9B21A8B8C0F460DE7670982F5D7471BC13B27C9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=40bfd9029d0f492c9d36afc4626e30fb.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:77139Pq51uN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.4240952969498695
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm++nVztnRUGYuxsjs1:SbFuFyLVIg1BG+f+M++nVJlYuqjbVC
MD5:	B45E52A59F68FEFEAC0F24D832CA744C
SHA1:	581C6904768E2E91DDCA0DD902285DD4AF1A012E
SHA-256:	DEC9D3F4030240C0C0C9B020155C469D2013B1EE9D95EF79178B48AA7C2BE8EF
SHA-512:	F11424FD6EE7ED1112743904C860C6183F75F878C15A190851A4972AD363DBE007DC08BBD94109AA137EEBD4F1F0042783AC5BF72769D212BAD0B76006822B4E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4d18f8ee375d45d2beacb24562f4171c.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:77277GN58pO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.376898099637527
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpCW/5eMxsjswkClr+:SbFuFyLVIg1BG+f+MIExqjLkGq
MD5:	44A7C1AA72A558F8295DCF923D9F60F3
SHA1:	FAF34FE8E13435DD816A76E1BBE10FA50A151C48
SHA-256:	3B5EDE3B8229DA21AF132EE9D603BCD75C8FB9A73F0DB8E74D8A1372F1402B51
SHA-512:	B5CD4074F733AB2E5A9A097F3BD9CF0224914C5ECFB05940478576B666FCAC7E6EE8792FD1B8659CC86554F377ABABA20F4B47388EBCECC0A14B97C23EB3ED6F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cc032a84bca74b8ab21d76eae451061c.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:77368adS99L

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.431568890223059
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Mw71KVR/8jdCt/rRMtq:qgFq6g10+f+MwZKVR2CDL
MD5:	3B1532EEE38277BA350A84BF7CBDAF9F
SHA1:	E344D9F8EB452B51ED9EB7C3DE9CA7D938A33C12
SHA-256:	257D71E3F370D1B63B014D803610CAEFF691B1059438E19659335661AA020ECD
SHA-512:	45B2F0B0FB9FFAD858AEEEED81B5D9A2D6CB87B190090F455EAFA57B6D8DC495335191F37C73BE8A6604B4E599E6C37469EC5E9086A0894C5BB660D5E0DE6402
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c7ffc7c910b74a3ea43ffbe548ace8e6.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:77466YhWmrP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4227758153034245
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm48AUBZ/Dnjs2ALAXaGS:SbFuFyLVIg1BAf+M4RgLjNALyAZD
MD5:	EAD2EC1F93FA502B230EDE3CA03A68B1
SHA1:	07306F85E2251400D9C6DEE76BDD5E633F14A84C
SHA-256:	D89EC275F6861E26428FFF63B934D05443DFB15244055F8B2D0088734B40D753
SHA-512:	7B30BB2FAEB490EBBDB97526B301EF57EEC6E4B2350790C3E700480E606C4486C7D623AAB7422E59B2163E072A6855803F23E98DAA5409C999C038CAEED92BD5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2332dfee1712460c81bf797e2dc91817.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77467Hz8MnL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.422723627294767
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmrDQBRAK6K0hgrxsjs2y:SbFuFyLVIg1BAf+MwBRn0huqjNdQIeXD
MD5:	93F6865C0FDF0BF13B376CC24EF85D70
SHA1:	BCB9934981268505253C24FFFB30B92388EE5755
SHA-256:	2965CB498A511767F35345B1DDC3E59EEEADA7E32FAD424EF3740F7E26F0CFF8
SHA-512:	B33C23BC6991F6DC2F0716C5518F5FF2EFBAC9A7E0855DC3373723F3466180E1667D129C2F5F728E47CDFE227D44B62959BFB64EB2775CE9F2D149DE1CB579D4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a3aa5ca4078f440589e1515db3005c13.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77468YNnenM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.409817567402849
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm4FD2gaR1/GMqjs2BZZD:SbFuFyLVIg1BAf+M4g/GZjNTZD
MD5:	98027629374EC736C263FED123D48226
SHA1:	2A98EFEA44F11850571ED84BD838F7DB7E1FBA23
SHA-256:	693941766753F4996C469226C34AE250365458BE1B06238ED38B9BD4E94DEFF8
SHA-512:	4EBE4238C028600526F14F7E05FC6744F0175FB8D5CE0FFF27889D8BB47A61AE8BFA1F42511BE74C423CC4A678F717123B207E87075480093330AF510B15E0AF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=220fe7cbe9e944df86ffe1cd85a8aa36.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:7758604mwLO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.408038848858422
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Moi9RUyVtZ0jLTTIWTIL:qgFq6g10+f+MoiRPZUEWEL
MD5:	216B8264CF06AD06C14F44F46EE9524C
SHA1:	79B37F6BA61CB3680CCB197C63859DD0E26657AD
SHA-256:	9B031D454AA43647CD384EF7C77405E0A6B2FC2D24E244DDE75647038E4ED2F1
SHA-512:	BA1D9003015E54EBE081AF05AA30C585B543E9759929AF010C5C600DB547877EBA5078B650BBDC078BC2C401E2D0D410499F6B355387CC8AA66C97273526ADD6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b2a81a00241743bfa23900bebe45bbd3.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:77613qruZNO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.399231432037295
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm5wNBBrkc7UsRvAs:SbFuFyLVK6g7/+BG+f+MKTBrVN8jNq
MD5:	536AF53C178D066A24BAE17C88D21E16
SHA1:	FEFECA01D9A164C324DF5F40A4E0F7A5206DF7C1
SHA-256:	7B6FAF2F2D4E16453C2C958BA43D5334923E81B7E4E926B20C548E6C2E281D19
SHA-512:	406FE9AFC9106E2DA7FE277B1007AEE9BAC580E4AAF66A61642AAE7F2D4AA0F44CAEEBF8E0407D223709643B4FFCE7CCB6EB3B232AB684F84DB8AC191AE21043
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3e07cffdda184e1ba9041d95a5ffd7f4.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:776146Vij2M

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.423615470509928
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm/BSRHQXX3VQ7hgF:SbFuFyLVI6g7/+BG+f+MMelQ1jNq
MD5:	AC3128C3D765915660F6A41A7D433D2C
SHA1:	AB361D0AC3848288C1038CF2B50952C21379C466
SHA-256:	5771BF693B3DC1F1D4C20303BE65DADB0C22259389F8B2E8689CB53F03375FD6
SHA-512:	2B247CD998432709A8E8D633C02BFA729D3F622D61E72FA0479D9295A5DBB677E4F74188104DA8B98C6463782A64E15EDFD086F57DE4536DC29531F53A97D082
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=561bfe1dc7ca46bcb22437302ac7f05a.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:776300jFJUN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.5074167800176665
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+Mq9JWH0jFQMzKaBu:qgFqo6g7/+0+f+MHeTmh
MD5:	5F7259E1B7A469823899A3BBAC0A849D
SHA1:	71D71B8B93EFEB40732E0F2165BAD3183B5E42E1
SHA-256:	8F43E56EA9F95446EA9099370E0DC404EB61FE54BF31FC2B0B9A7969B6318913
SHA-512:	D5762362A44F7B46428A257AD0BD150C015F75B13A3F8FF1DA03B6CAC16E2AAAC92574EF768015B6E094566A82446742A273EBC741BE9D583841F2C3BA5F6B06
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1155400e5a0742e3a1176d4df9b720c2.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:77631W5beOO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.513944444383902
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MXmCZjFQMzKaBu:qgFqdg7/+0+f+MXmCvTmh
MD5:	B9526C0F7C991B6CE7294D2662D1A03D
SHA1:	0CB730E9A254CCCAF9AEB568346A745B39118B64
SHA-256:	EC845A3485F3B0652C7168D40978EB48F2B1F4B13664AA45FB9DD659D8807D87
SHA-512:	AF54B679AC811EDACF518DD75E81F8E45EA788C8AD5274F43A842D99EF6375E60478BF65638A7E699D03FD155CE991B3CF82135C585E4C3DEF17DDC6FA009CE2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=34fcbaf81a2244a59124f17531e20c42.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:77741Kshh8N

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.34257105943122
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpxEEIPEhD10xpk5q9:SbFuFyLVIg1BG+f+ML+YGx7joa
MD5:	008B8D40BB33F3316D1019720FCD22F4
SHA1:	AD6EFFCC2AA546BA852E079486C89A2390F04D6B
SHA-256:	1CC9002DF766AF58A067CE7B4E1CE5D524E8264554DF72C0F6F6A4E551A58E4E
SHA-512:	6E012E61617EC344666A17D92710EF0CAB51A4D6DD7D317BB98BD29F84B77FDBAB68F41518E29C6DF6035E8365CA47C3319D71E092ABBA1CDE3D7AEEFB3BB0D3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c4ef49baac914f6a951ade5b142aebc6.IDENTIFIER=dbus-daemon.

/run/systemd/seats/.#seat05pqhtJ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat09MMvuI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/users/.#1273d7SGH

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.296245846767312
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gD8D9GnQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+gD82thQHtPYq9M
MD5:	7A207F702C0294EF88267982F1FBBC16
SHA1:	3B37282267862C23BEF6E204263CEC0CFAFD930E
SHA-256:	21DE2BA61BE263BFDE49580C0176229A86CF98A2D0CD06B3AE3BF121DD695977
SHA-512:	1CE109F5E7F7E1399DEBA2C3E06AE065CD8EFAFE1A1D06CFDCB6C4A8CCA264E82EB18963C98756FF83E3B2284B29F419607D52CC0983407AE355FB290B93C131
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1736094205326787.MONOTONIC=452131151.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127NY2TEG

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127Qae6xH

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.446793696975809
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6lgTgD8D9a5t6hn:qgFq30dABibB3TgD8U5Ihn
MD5:	5C781B48AA55BCF499EA77C73B5FD06B
SHA1:	36BA0113299E3AA1AB20733CAB6BE96B6089F40A
SHA-256:	0064A584FC63164F259A30B86084065A54FE51F5A479033BF3E602DDDB6D1FE7
SHA-512:	E40FF007705319065E96B782070A8BCB785C375E99A95733A0AF7F2961E40CA65A926E01C699E45B72E30D8AA8360121A89B1DDADB895FDC36B64B0EA45BDDFD
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12412.REALTIME=1736094205326787.MONOTONIC=452131151.LAST_SESSION_TIMESTAMP=452217220.

/run/systemd/users/.#127UcaFII

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.296245846767312
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gD8D9GnQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+gD82thQHtPYq9M
MD5:	7A207F702C0294EF88267982F1FBBC16
SHA1:	3B37282267862C23BEF6E204263CEC0CFAFD930E
SHA-256:	21DE2BA61BE263BFDE49580C0176229A86CF98A2D0CD06B3AE3BF121DD695977
SHA-512:	1CE109F5E7F7E1399DEBA2C3E06AE065CD8EFAFE1A1D06CFDCB6C4A8CCA264E82EB18963C98756FF83E3B2284B29F419607D52CC0983407AE355FB290B93C131
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1736094205326787.MONOTONIC=452131151.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127bAjBuH

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.306571066844348
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgD2tDuSfrK4CWUgk9H206qodVl:SbFuFyL3BVgdL87iesnAiRJgD8D9a5tA
MD5:	C01D6C77748F333472ADD2E124074D9C
SHA1:	37F66E9869A37490D3EA322FDEAD3BF09D002032
SHA-256:	F75E6518D63943AD8E4FE0154A510221671799E18D636D3D5E8323B4C84E0765
SHA-512:	BECE33A29EAA44E761F3C8485157CB2F4BD6B89A60F81B4F294F5BEF653826626AC7FEF3322C9969AB95B1969D93C19F3B496D6F26E1BE3A03530E6D6227F890
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1736094205326787.MONOTONIC=452131151.LAST_SESSION_TIMESTAMP=452217220.

/run/systemd/users/.#127yDWKWF

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.446793696975809
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6lgTgD8D9a5t6hn:qgFq30dABibB3TgD8U5Ihn
MD5:	5C781B48AA55BCF499EA77C73B5FD06B
SHA1:	36BA0113299E3AA1AB20733CAB6BE96B6089F40A
SHA-256:	0064A584FC63164F259A30B86084065A54FE51F5A479033BF3E602DDDB6D1FE7
SHA-512:	E40FF007705319065E96B782070A8BCB785C375E99A95733A0AF7F2961E40CA65A926E01C699E45B72E30D8AA8360121A89B1DDADB895FDC36B64B0EA45BDDFD
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12412.REALTIME=1736094205326787.MONOTONIC=452131151.LAST_SESSION_TIMESTAMP=452217220.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:een:ee
MD5:	54DB4D14A20E4870C03AD1F1FDFC58A5
SHA1:	4AF5E8A7E9C7BAD71AD1051E80A0293AFC6D756D
SHA-256:	334DA6E0D2103D6DA2A2248E217A3F5C43F6817057497C7BDD0B5D6E7E22E3CB
SHA-512:	CE753080D45D351D93F4F0F359B9F0225E0ECA10F884653769D86DE23C9A3A37F49C420FD7EC6CB7419DB1442D65C2F175DCB3D0FF75F5240C656BB5CFA96B4B
Malicious:	false
Preview:	6309.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351417
Encrypted:	false
SSDEEP:	3:h0sXlXEWtl/iGCQzll/:P+ylKGTzll
MD5:	37EDDEAC1AD73D4C7B9CC851841C8060
SHA1:	969AF7266C0C5C46282E8FA6CC27A62C9BBD29BA
SHA-256:	DB6D90DA77C1B6375F3366882F53BB3C4E8F6CBDC246959EB8FA2E4415019F89
SHA-512:	550EFD6C6922411DCA320CFBA78AB0FD5CB1A556418C8B8F3D816D53B4BFDC579897042828ABA1074A83156AFC0D38316E95F38275EAFDF6F05E8F7F8F8437F1
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN....................................................................................................................................................................................................................................................................................................zg........................................

/var/lib/AccountsService/users/gdm.D74VZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	678
Entropy (8bit):	4.772144014741469
Encrypted:	false
SSDEEP:	12:SUokF0hLadHUokFxT4p1Wr49UokF0nCLGaWr49UqF0hLajOmURFXg/DzfbZUQU:+0e0pYr4JVJr4NDrCQU
MD5:	3BDD3ECF9194842F4C7C82460DE65793
SHA1:	536CCBF1327BD1B16B8637D942A91CC56E1A3C72
SHA-256:	C675715BC657C6DB10961D52C69EA46AC1812D36036BDA47C83211EFB8952FDD
SHA-512:	2310E05EC6F2A57938C60C6E6ED936B43DD253D3477F6A3E1282C5310277C9FA754DFDD08F3B394A435B516339D30B4CF1D967B02CC4FDED0A6885922EE27B64
Malicious:	false
Preview:	Jan 5 10:23:25 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Jan 5 10:23:25 galassia systemd-logind[6315]: Failed to start session scope session-c1.scope: Unit session-c1.scope already exists..Jan 5 10:23:25 galassia gdm-launch-environment]: pam_systemd(gdm-launch-environment:session): Failed to create session: Unit session-c1.scope already exists..Jan 5 10:23:26 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session closed for user gdm.Jan 5 10:23:34 galassia dbus-daemon[6303]: [system] Failed to activate service 'org.bluez': timed out (service_start_timeout=25000ms).

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4313806548581445
Encrypted:	false
SSDEEP:	3:F31HlnFoayXvlpFoayXd/:F3XFUlpFM/
MD5:	942739D62D44CDDA9632020F9D3AB8EB
SHA1:	CF383469409C89F848435CA9D698E2188345D3A9
SHA-256:	3B3E8D33AD4A6804B4BE6FA99F869CC0D80D7B5100B9DA522BEB3070A66851FD
SHA-512:	32BBAD0E0BAB21B648A33CFDA59C9F3433E2C4A01C24797753208970032E30F9898E64D03B6E781C086897D71701A761D5951BA7807AC50C3CC2D71180458BC9
Malicious:	false
Preview:	LPKSHHRH...................." M..2.2......................................." M..2.2...........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4428593527838254
Encrypted:	false
SSDEEP:	3:F31Hl1M8u2OlXHM8u2OP:F3iTlXsT
MD5:	1E315ADF3A19C16C952E407872816C22
SHA1:	FF2596196A3D45C5EA9E9B3ABC8C346F92998207
SHA-256:	2BAAF665E12C58BB4D3A37AEC32ED226DEA5A66F7B671881C475495E954CF073
SHA-512:	765094671E40AFA87E4D9DD9AC7FB33A8B4E452F65F16A2C667F31DAD9A4D470903F485C18BA5888BBBB96906DD6CCB21AE8B5F93D49F1D11C5335F9B2061AD8
Malicious:	false
Preview:	LPKSHHRH.................f.,g(NM.O....gi.................................f.,g(NM.O....gi........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	CSV text
Category:	dropped
Size (bytes):	10566
Entropy (8bit):	4.97342852629601
Encrypted:	false
SSDEEP:	96:qOFb6PgvPwoWB3mSA+WOr8MBOr7YrexiA0/jfjQJAdSjqXH23WFyc9CsXN6V:DFeO4B3fLr8JM7QidWqXWmNi
MD5:	63657593564079035E9BAD668DE9AD77
SHA1:	85C4EC0CC23D5423F07B09D30B30AF3D8F20C97B
SHA-256:	0710241AD7CA317B8B16B638CE0AE5F201F12989FB53A086FEDB43178E266EC1
SHA-512:	97FEBA1C7F0146E7A431ABE4AE4E3CC55F2F515BCF2D869AEB5D265F4B945DB34E82DEF5A91BA0DB9C82EF749B46692487DBD33D4760760069CA5ED99E4690F5
Malicious:	false
Preview:	Jan 5 10:23:09 galassia kernel: [ 435.365780] New task spawned: old: (tgid 6389, tid 6389), new (tgid: 6390, tid: 6390).Jan 5 10:23:09 galassia kernel: [ 435.646580] New task spawned: old: (tgid 6388, tid 6388), new (tgid: 6392, tid: 6392).Jan 5 10:23:09 galassia kernel: [ 435.700737] New task spawned: old: (tgid 6392, tid 6392), new (tgid: 6393, tid: 6393).Jan 5 10:23:09 galassia kernel: [ 435.823823] New task spawned: old: (tgid 6309, tid 6309), new (tgid: 6309, tid: 6394).Jan 5 10:23:09 galassia kernel: [ 435.948112] New task spawned: old: (tgid 6388, tid 6388), new (tgid: 6395, tid: 6395).Jan 5 10:23:09 galassia kernel: [ 435.993944] New task spawned: old: (tgid 6391, tid 6391), new (tgid: 6391, tid: 6396).Jan 5 10:23:09 galassia kernel: [ 435.994562] New task spawned: old: (tgid 6391, tid 6391), new (tgid: 6391, tid: 6397).Jan 5 10:23:09 galassia kernel: [ 435.999326] New task spawned: old: (tgid 6391, tid 6396), new (tgid: 6391, tid: 6398).Jan 5 10:23:09 galassia

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	30677
Entropy (8bit):	5.037120625667086
Encrypted:	false
SSDEEP:	768:E6m86TPzpVjvRB2fQwyWaEb0wiiCBF3zFZH9wsyMWKoD9jf9WUIKjhdfFDnZT2S1:4m1ZT
MD5:	55498F1C2622A4190CC79861DF5D21BC
SHA1:	5E8469368AC576BF76FEA1339CD0AF9407C5C37D
SHA-256:	6D5D588AE1F7DD47EAE8943173AC816F8DA1987A34F797E279E08ECAD3E304E8
SHA-512:	8EA1FEF9D0E4BA5F96AD9BEBA3BA39F0FB3D68970BE936EA611775E2C894EF01A7476CB607B4CDEE6429039D62FD3E7248B1F9326A6368C62EEEB7B3231A9D1B
Malicious:	false
Preview:	Jan 5 10:23:08 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Jan 5 10:23:08 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Jan 5 10:23:09 galassia dbus-daemon[6303]: [system] Activating via systemd: service name='org.bluez' unit='dbus-org.bluez.service' requested by ':1.9' (uid=1000 pid=6309 comm="/usr/bin/pulseaudio --daemonize=no --log-target=jo" label="unconfined").Jan 5 10:23:09 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 1..Jan 5 10:23:09 galassia systemd[1]: Condition check resulted in Bluetooth service being skipped..Jan 5 10:23:09 galassia systemd[1]: Stopped System Logging Service..Jan 5 10:23:09 galassia systemd[1]: Starting System Logging Service....Jan 5 10:23:09 galassia rtkit-daemon[6312]: Supervising 1 threads of 1 processes of 1 users..Jan 5 10:23:09 galassia kernel: [ 435.365780] New task spawned: old: (tgid 6389, tid 6389), new (tgid: 6390, tid: 6390).Jan 5 10

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351417
Encrypted:	false
SSDEEP:	3:h0sXlXEWtl/iGCQzll/:P+ylKGTzll
MD5:	37EDDEAC1AD73D4C7B9CC851841C8060
SHA1:	969AF7266C0C5C46282E8FA6CC27A62C9BBD29BA
SHA-256:	DB6D90DA77C1B6375F3366882F53BB3C4E8F6CBDC246959EB8FA2E4415019F89
SHA-512:	550EFD6C6922411DCA320CFBA78AB0FD5CB1A556418C8B8F3D816D53B4BFDC579897042828ABA1074A83156AFC0D38316E95F38275EAFDF6F05E8F7F8F8437F1
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN....................................................................................................................................................................................................................................................................................................zg........................................

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.424979386324767
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	Fantazy.x86.elf
File size:	70'416 bytes
MD5:	9a58836855e1d012ddbdc736fd9684e9
SHA1:	8883a0b923f9f78b9ee2f04bfb762ddb5b91c703
SHA256:	bb902ee8a178297ef2163cf647e4ba180bac25ea5a1021ee90add0db08736511
SHA512:	f77c9d0b1ef6b2cc18a1cfdfb2ed1778450a5a0f3961a0ea62469306f1a1f5648aece9c9e45f8a7bf611054b8c92295d6af6abf451b944e28d354ef400901555
SSDEEP:	1536:mOhjXtM7ayXRulHeEqPZTS0LDi8eKcJ37w0hwX84:mkXO7ayUJeEmZTSSD9eKcFMQwX8
TLSH:	57634BC8A4C3F9F0DC150A3D747AAB725A77F13B2139ED9FD7A81966A802302D40239D
File Content Preview:	.ELF....................d...4...........4. ...(.....................`...`...........................@... ...........Q.td............................U..S.......w....h........[]...$.............U......=@....t..5....$......$.......u........t....h`...........

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	70016
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0xf4b6	0x0	0x6	AX	16
.fini	PROGBITS	0x8057566	0xf566	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x8057580	0xf580	0x13e0	0x0	0x2	A	32
.ctors	PROGBITS	0x8059000	0x11000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x8059008	0x11008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x8059020	0x11020	0x120	0x0	0x3	WA	32
.bss	NOBITS	0x8059140	0x11140	0x8e0	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x11140	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x10960	0x10960	6.5349	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x11000	0x8059000	0x8059000	0x140	0xa20	4.5767	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 5, 2025 17:23:07.759702921 CET	192.168.2.23	8.8.8.8	0x77c2	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 5, 2025 17:23:07.759702921 CET	192.168.2.23	8.8.8.8	0x9278	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Jan 5, 2025 17:23:08.089092970 CET	192.168.2.23	8.8.8.8	0xba48	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 5, 2025 17:23:07.767282963 CET	8.8.8.8	192.168.2.23	0x77c2	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Jan 5, 2025 17:23:07.767282963 CET	8.8.8.8	192.168.2.23	0x77c2	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2025-01-05 16:23:10 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2025-01-05 16:23:11 UTC	25	IN	HTTP/1.1 100 Continue
2025-01-05 16:23:11 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2025-01-05 16:23:11 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2025-01-05 16:23:11 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2025-01-05 16:23:11 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2025-01-05 16:23:11 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2025-01-05 16:23:11 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2025-01-05 16:23:11 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2025-01-05 16:23:11 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2025-01-05 16:23:11 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2025-01-05 16:23:11 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2025-01-05 16:23:11 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Sun, 05 Jan 2025 16:23:11 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	16:22:38
Start date (UTC):	05/01/2025
Path:	/tmp/Fantazy.x86.elf
Arguments:	/tmp/Fantazy.x86.elf
File size:	70416 bytes
MD5 hash:	9a58836855e1d012ddbdc736fd9684e9

Start time (UTC):	16:22:45
Start date (UTC):	05/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:22:46
Start date (UTC):	05/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:23:04
Start date (UTC):	05/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:23:05
Start date (UTC):	05/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:23:06
Start date (UTC):	05/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:23:07
Start date (UTC):	05/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:23:08
Start date (UTC):	05/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:23:09
Start date (UTC):	05/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	16:23:10
Start date (UTC):	05/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	16:23:11
Start date (UTC):	05/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:23:12
Start date (UTC):	05/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:23:23
Start date (UTC):	05/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Fantazy.x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6452/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:75441iHysJO

/run/systemd/journal/streams/.#9:75442fzbMxM

/run/systemd/journal/streams/.#9:76154yh6FUO

/run/systemd/journal/streams/.#9:76163LaaIAO

/run/systemd/journal/streams/.#9:76242ATRqRL

/run/systemd/journal/streams/.#9:76244CeQcQL

/run/systemd/journal/streams/.#9:768501bUMvM

/run/systemd/journal/streams/.#9:77139Pq51uN

/run/systemd/journal/streams/.#9:77277GN58pO

/run/systemd/journal/streams/.#9:77368adS99L

/run/systemd/journal/streams/.#9:77466YhWmrP

/run/systemd/journal/streams/.#9:77467Hz8MnL

/run/systemd/journal/streams/.#9:77468YNnenM

/run/systemd/journal/streams/.#9:7758604mwLO

/run/systemd/journal/streams/.#9:77613qruZNO

/run/systemd/journal/streams/.#9:776146Vij2M

/run/systemd/journal/streams/.#9:776300jFJUN

/run/systemd/journal/streams/.#9:77631W5beOO

/run/systemd/journal/streams/.#9:77741Kshh8N

/run/systemd/seats/.#seat05pqhtJ

/run/systemd/seats/.#seat09MMvuI

/run/systemd/users/.#1273d7SGH

/run/systemd/users/.#127NY2TEG

/run/systemd/users/.#127Qae6xH

Linux Analysis Report
Fantazy.x86.elf

Start time (UTC):	16:23:24
Start date (UTC):	05/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	16:23:25
Start date (UTC):	05/01/2025
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	16:23:26
Start date (UTC):	05/01/2025
Path:	/usr/lib/gdm3/gdm-wayland-session
Arguments:	-
File size:	76368 bytes
MD5 hash:	d3def63cf1e83f7fb8a0f13b1744ff7c

Start time (UTC):	16:23:47
Start date (UTC):	05/01/2025
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Start time (UTC):	16:25:18
Start date (UTC):	05/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre