Edit tour

Linux Analysis Report
gnjqwpc.elf

Overview

General Information

Sample name:	gnjqwpc.elf
Analysis ID:	1584999
MD5:	4a392432e26bda1422b98ce8b776906b
SHA1:	970765353b055bb5a15dbecd33133994a8827fce
SHA256:	f3e4bfe8cc9b9e40f44f478f0c46d82d668515b4e99abb7376f4d24df0d63fb8
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false

Signatures

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Sleeps for long times indicative of sandbox evasion

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584999
Start date and time:	2025-01-07 00:27:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	gnjqwpc.elf
Detection:	MAL
Classification:	mal60.spre.troj.evad.linELF@0/50@1551/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: gnjqwpc.elf

Runtime Messages

Command:	/tmp/gnjqwpc.elf
PID:	6239
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

gnjqwpc.elf (PID: 6239, Parent: 6162, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/gnjqwpc.elf

gnjqwpc.elf New Fork (PID: 6241, Parent: 6239)

gnjqwpc.elf New Fork (PID: 6243, Parent: 6241)

gnome-session-binary New Fork (PID: 6245, Parent: 1477)

sh (PID: 6245, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6245, Parent: 1477, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 6283, Parent: 1)

dbus-daemon (PID: 6283, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gvfsd-fuse New Fork (PID: 6284, Parent: 2038)

fusermount (PID: 6284, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6285, Parent: 1860)

pulseaudio (PID: 6285, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6286, Parent: 1)

rsyslogd (PID: 6286, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6287, Parent: 1)

dbus-daemon (PID: 6287, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6292, Parent: 1)

rsyslogd (PID: 6292, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6302, Parent: 1)

systemd-logind (PID: 6302, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6363, Parent: 1)

agetty (PID: 6363, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 6364, Parent: 1320)

Default (PID: 6364, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6365, Parent: 1320)

Default (PID: 6365, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6366, Parent: 1320)

Default (PID: 6366, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6367, Parent: 1)

agetty (PID: 6367, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6368, Parent: 1)

gpu-manager (PID: 6368, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6371, Parent: 6368)

sh (PID: 6371, Parent: 6368, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6372, Parent: 6371)

grep (PID: 6372, Parent: 6371, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6373, Parent: 6368)

sh (PID: 6373, Parent: 6368, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6374, Parent: 6373)

grep (PID: 6374, Parent: 6373, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6380, Parent: 6368)

sh (PID: 6380, Parent: 6368, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6381, Parent: 6380)

grep (PID: 6381, Parent: 6380, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6382, Parent: 6368)

sh (PID: 6382, Parent: 6368, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6383, Parent: 6382)

grep (PID: 6383, Parent: 6382, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6384, Parent: 6368)

sh (PID: 6384, Parent: 6368, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6385, Parent: 6384)

grep (PID: 6385, Parent: 6384, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6386, Parent: 6368)

sh (PID: 6386, Parent: 6368, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6387, Parent: 6386)

grep (PID: 6387, Parent: 6386, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6452, Parent: 6368)

sh (PID: 6452, Parent: 6368, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6453, Parent: 6452)

grep (PID: 6453, Parent: 6452, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6454, Parent: 6368)

sh (PID: 6454, Parent: 6368, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6455, Parent: 6454)

grep (PID: 6455, Parent: 6454, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6369, Parent: 1)

rsyslogd (PID: 6369, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6379, Parent: 1)

dbus-daemon (PID: 6379, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6388, Parent: 1)

journalctl (PID: 6388, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6391, Parent: 1)

systemd-logind (PID: 6391, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6424, Parent: 1)

systemd-journald (PID: 6424, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6433, Parent: 1)

dbus-daemon (PID: 6433, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6434, Parent: 1)

rsyslogd (PID: 6434, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6465, Parent: 1)

generate-config (PID: 6465, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6466, Parent: 6465)

pkill (PID: 6466, Parent: 6465, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6468, Parent: 1)

gdm-wait-for-drm (PID: 6468, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6469, Parent: 1)

journalctl (PID: 6469, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6476, Parent: 1)

gdm3 (PID: 6476, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6481, Parent: 6476)

plymouth (PID: 6481, Parent: 6476, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6495, Parent: 6476)

gdm-session-worker (PID: 6495, Parent: 6476, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6499, Parent: 6495)

gdm-wayland-session (PID: 6499, Parent: 6495, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6501, Parent: 6499)

dbus-daemon (PID: 6501, Parent: 6499, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6503, Parent: 6501)

dbus-daemon New Fork (PID: 6504, Parent: 6503)

false (PID: 6504, Parent: 6503, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6505, Parent: 6499)

dbus-run-session (PID: 6505, Parent: 6499, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6506, Parent: 6505)

dbus-daemon (PID: 6506, Parent: 6505, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6507, Parent: 6476)

Default (PID: 6507, Parent: 6476, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6508, Parent: 6476)

Default (PID: 6508, Parent: 6476, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6482, Parent: 1)

accounts-daemon (PID: 6482, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6486, Parent: 6482)

language-validate (PID: 6486, Parent: 6482, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6487, Parent: 6486)

language-options (PID: 6487, Parent: 6486, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6488, Parent: 6487)

sh (PID: 6488, Parent: 6487, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6489, Parent: 6488)

locale (PID: 6489, Parent: 6488, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6490, Parent: 6488)

grep (PID: 6490, Parent: 6488, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6491, Parent: 1)

polkitd (PID: 6491, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6536, Parent: 1860)

dbus-daemon (PID: 6536, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6537, Parent: 1860)

pulseaudio (PID: 6537, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6538, Parent: 1)

rtkit-daemon (PID: 6538, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

cleanup

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6292)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6369)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6434)	Reads hosts file: /etc/hosts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6424)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6476)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6501)	Socket: unknown address family	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: fingwi.cardiacpure.ru
Source: global traffic	DNS traffic detected: DNS query: fingwi.cardiacpure.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.51.dr, syslog.87.dr, syslog.33.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 53322 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53322
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53132
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53132 -> 443

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6245, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 1476, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6222, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6225, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6282, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6283, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6285, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6286, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6287, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6291, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6292, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6363, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6068, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6261, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6302, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6369, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6370, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6379, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6245, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 1476, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6222, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6225, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6282, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6283, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6285, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6286, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6287, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6291, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6292, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6363, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6068, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6261, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6302, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6369, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6370, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	SIGKILL sent: pid: 6379, result: successful	Jump to behavior

Source: classification engine

Classification label: mal60.spre.troj.evad.linELF@0/50@1551/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6283)	File: /proc/6283/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6284)	File: /proc/6284/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6287)	File: /proc/6287/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6379)	File: /proc/6379/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6433)	File: /proc/6433/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6501)	File: /proc/6501/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6506)	File: /proc/6506/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6536)	File: /proc/6536/mounts	Jump to behavior

Source: /lib/systemd/systemd-logind (PID: 6302)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6302)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6302)	File: /run/systemd/seats/.#seat0pvC5ZH	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6391)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6391)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6391)	File: /run/systemd/seats/.#seat0YEe48s	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6391)	File: /run/systemd/users/.#127FiVg3t	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6391)	File: /run/systemd/users/.#1276BqD7q	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6391)	File: /run/systemd/seats/.#seat0YQtldq	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6391)	File: /run/systemd/users/.#127sRVnPq	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6391)	File: /run/systemd/users/.#1277mMCXq	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6391)	File: /run/systemd/users/.#127kf3agu	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6391)	File: /run/systemd/users/.#127lfJYpr	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6424)	File: /run/systemd/journal/streams/.#9:77607GStKXX	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6424)	File: /run/systemd/journal/streams/.#9:776141miioZ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6424)	File: /run/systemd/journal/streams/.#9:77615tm8w3V	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6424)	File: /run/systemd/journal/streams/.#9:77628gF0RyW	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6424)	File: /run/systemd/journal/streams/.#9:77629IoG5cY	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6424)	File: /run/systemd/journal/streams/.#9:776302rZDbW	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6424)	File: /run/systemd/journal/streams/.#9:77643CGRmcZ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6424)	File: /run/systemd/journal/streams/.#9:77651VqjL3Y	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6424)	File: /run/systemd/journal/streams/.#9:78907dZD7OX	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6424)	File: /run/systemd/journal/streams/.#9:78992eY5J2W	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6424)	File: /run/systemd/journal/streams/.#9:79019qNYs0V	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6424)	File: /run/systemd/journal/streams/.#9:790619vJL9X	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6424)	File: /run/systemd/journal/streams/.#9:79063Stk7dW	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6424)	File: /run/systemd/journal/streams/.#9:79102ARV7HX	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6424)	File: /run/systemd/journal/streams/.#9:79103f3HOLY	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6424)	File: /run/systemd/journal/streams/.#9:79328aQW8FX	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6424)	File: /run/systemd/journal/streams/.#9:79338X8WJPU	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6424)	File: /run/systemd/journal/streams/.#9:79343sEgxTY	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6499)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6482)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6482)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6491)	Directory: /root/.cache	Jump to behavior

Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/1335/fd	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/1334/fd	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/2307/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6243)	File opened: /proc/2307/stat	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6371)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6373)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6380)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6382)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6384)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6386)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6452)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6454)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6488)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Source: /bin/sh (PID: 6372)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6374)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6381)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6383)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6385)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6387)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6453)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6455)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6490)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6466)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6424)

Reads from proc file: /proc/meminfo

Jump to behavior

Source: /sbin/agetty (PID: 6363)	Reads version info: /etc/issue			Jump to behavior
Source: /sbin/agetty (PID: 6367)	Reads version info: /etc/issue			Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6476)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6476)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6482)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6482)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6292)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6292)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6368)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6369)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6434)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6434)	Log file created: /var/log/auth.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/gnjqwpc.elf (PID: 6241)

File: /tmp/gnjqwpc.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6368)

Truncated file: /var/log/gpu-manager.log

Jump to behavior

Source: /usr/bin/pkill (PID: 6466)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6537)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /tmp/gnjqwpc.elf (PID: 6243)

Sleeps longer then 60s: 300.0s

Jump to behavior

Source: /tmp/gnjqwpc.elf (PID: 6239)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6292)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6363)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6367)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6368)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6369)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6424)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6434)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6495)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6537)	Queries kernel information via 'uname':	Jump to behavior

Source: gnjqwpc.elf, 6239.1.00005640282ce000.000056402837e000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: gnjqwpc.elf, 6239.1.00007ffc9f40a000.00007ffc9f42b000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.uVmNxX
Source: gnjqwpc.elf, 6239.1.00005640282ce000.000056402837e000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: gnjqwpc.elf, 6239.1.00007ffc9f40a000.00007ffc9f42b000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: gnjqwpc.elf, 6239.1.00007ffc9f40a000.00007ffc9f42b000.rw-.sdmp	Binary or memory string: %s/qemu-op
Source: gnjqwpc.elf, 6239.1.00007ffc9f40a000.00007ffc9f42b000.rw-.sdmp	Binary or memory string: 1$@V/tmp/qemu-open.uVmNxX\$
Source: gnjqwpc.elf, 6239.1.00007ffc9f40a000.00007ffc9f42b000.rw-.sdmp	Binary or memory string: Nx86_64/usr/bin/qemu-ppc/tmp/gnjqwpc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/gnjqwpc.elf
Source: gnjqwpc.elf, 6239.1.00007ffc9f40a000.00007ffc9f42b000.rw-.sdmp	Binary or memory string: MPDIR%s/qemu-op

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6482)

Logged in records file read: /var/log/wtmp

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 Virtualization/Sandbox Evasion	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File and Directory Permissions Modification	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	1 System Owner/User Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Hidden Files and Directories	NTDS	11 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Indicator Removal	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://www.rsyslog.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
daisy.ubuntu.com	162.213.35.24	true	false	high
fingwi.cardiacpure.ru	178.215.238.112	true	false	high
fingwi.cardiacpure.ru. [malformed]	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.51.dr, syslog.87.dr, syslog.33.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.213.35.25	unknown	United States	41231	CANONICAL-ASGB	false
178.215.238.112	fingwi.cardiacpure.ru	Germany	10753	LVLT-10753US	false
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.213.35.25	jefne64.elf	Get hash	malicious	Mirai	Browse
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse
	Aqua.i686.elf	Get hash	malicious	Unknown	Browse
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse
	Aqua.sh4.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm5.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm5.elf	Get hash	malicious	Unknown	Browse
178.215.238.112	arm7.elf	Get hash	malicious	Mirai	Browse
	arm.elf	Get hash	malicious	Mirai	Browse
	jefne64.elf	Get hash	malicious	Mirai	Browse
	fqkjei686.elf	Get hash	malicious	Mirai	Browse
	vevhea4.elf	Get hash	malicious	Mirai	Browse
	debvps.elf	Get hash	malicious	Mirai	Browse
	wlw68k.elf	Get hash	malicious	Mirai	Browse
	ngwa5.elf	Get hash	malicious	Mirai	Browse
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	jefne64.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse
	fqkjei686.elf	Get hash	malicious	Mirai	Browse
	vevhea4.elf	Get hash	malicious	Mirai	Browse
	debvps.elf	Get hash	malicious	Mirai	Browse
	wlw68k.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	mpsl.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	arm7.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	sh4.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	root.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	94.156.227.153-x86-2025-01-06T15_02_30.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	94.156.227.153-mips-2025-01-06T15_02_30.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	94.156.227.153-arm-2025-01-06T14_32_11.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	hidakibest.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
fingwi.cardiacpure.ru	debvps.elf	Get hash	malicious	Mirai	Browse	178.215.238.112

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	jefne64.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	fqkjei686.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	vevhea4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	debvps.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wlw68k.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
LVLT-10753US	arm7.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	arm.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	jefne64.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	fqkjei686.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	vevhea4.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	debvps.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	wlw68k.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	ngwa5.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	178.215.238.112
INIT7CH	na.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Aqua.sh4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	res.x86.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	main_arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_mips.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_ppc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	debug.dbg.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	ppc.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	spc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	covid.arm.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
CANONICAL-ASGB	na.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Aqua.sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	res.x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	main_arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_mpsl.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	main_ppc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	debug.dbg.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	ppc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	spc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/6504/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:4:4
MD5:	7BD7E3D81C95A160799B7E3CAE676852
SHA1:	E1342BD75C04A1A9AFB30D46E82D4D846A9A5D0B
SHA-256:	7CD975C2C3438E94B5CBEF1F1DDCB3BC1AF8D0973DE22296687855CF764C0623
SHA-512:	9E79DB2521768E1A24FAF2AF91BCFAEE7D33C1FA83780AD2669E8C17040635039B3546D7B83EC9DB8A1BDD7FD6AF21C94220EF5AB3B67502B0C7BDFDF7F367C0
Malicious:	false
Reputation:	low
Preview:	6476.

/run/systemd/journal/streams/.#9:77607GStKXX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.496942274576033
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/krGSUEKVn2tAv8jq:SbFuFyLVIg1BG+f+MMrGSJBtK8ji4s
MD5:	B63578357A6C626AC78EC6B54286F7ED
SHA1:	8D5736525C0F5CF9120D4807892143775DDD73FE
SHA-256:	B8356B100CB5CC90057075DECF3DB21A4279282D5CC0742C31C7C3CED310207A
SHA-512:	462D9226160BB19F3A8BFB8C70ABBB91190380734807E86A61CC92CEC542F94EF76CD98766CB339C851A5B40FC014ED1FA9A56F07A0DBEE03D8A86C452B88EC7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=590d59c7cbd540f58768fed04dd10aae.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:776141miioZ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.492168419851779
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Ms/F50g8jZcHcljX+:qgFq6g10+f+Ms/9qmAu
MD5:	17DEDB638B105B9883F8CC80D194A0AC
SHA1:	9C08C2A430A10F79A8D28824E42FD13B0D501067
SHA-256:	0625086E1F2097AABD00E1128E913A9BBEFE05795790BDCBA374C8C853E606F8
SHA-512:	230CE5EC8C25C9E54427523B5D67C231AE865773CF41C4259296B3EDDF12D696DF92D6661B0ED9A61CB71044B39F884988C7417EF715184BF1CFFEF1A4E2F861
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fc8a83b813c84fdc916f3f2a219bcc78.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:77615tm8w3V

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.402809826993641
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5HBGSB2/DWsjs1Ha7:SbFuFyLVIg1BG+f+MZBGSB2HjosQu
MD5:	46F2FE37EE71782E95E6788769C4B30C
SHA1:	4457271C1AF2E63C23ECFA9F1DF40188249C2AF3
SHA-256:	DF2FB73C07666F7DA970401A828C7B27496B705C2E473537AAF71836BCF65C9D
SHA-512:	135019870BCED95609A5152990286599E7B1B6C4B9A43E8DB521B9D6525B9FF00B38706C3C0F2FB5BDA955F2E71DCA32D6243BDFE4BFF5A78C2166D76C1BCBCB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3d68f88a30d1431895ae4f34e355119c.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:77628gF0RyW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.394843260843541
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6QNX1VWu1y6xTjsmM:SbFuFyLVIg1BG+f+M6Q/y6JjdCLKzK
MD5:	7533A1E9EDADAD8D012EA42BC0876FEB
SHA1:	DB70EE9BD3C90E03FC5430F5B6448A004E83475F
SHA-256:	46A0820240AC3E060C817497AB4B8A0797DA0AEB7A59BBF8862D45108A67853A
SHA-512:	71198A2492E9FA8B5D0B6B2AE6115CBEDED856C45C61B5C5DD02EEAE926EEFEF4CFC60A4C3BDF1DB64165AD8BACAE16747F4401D29E022A064CF2E49C2E220B3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=032f42b0373548209470785b59f2622e.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:77629IoG5cY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.447553284436139
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+Mi6Xlz/o+XEjNALyAZD:qgFq6g1af+M3lT9GIZD
MD5:	84776B297A819F0B623E91A9B969FC7D
SHA1:	0583972DF409E1A09A3A518560ABC49FE5AA43D2
SHA-256:	117C56CCEC8D076AE57BC40533DCAFA63C1CF93A48D8B879664D50CA2643C075
SHA-512:	15A6E08E275B660D23120F99AFFD9CE5FDF5DF85EB18E2EDC323B9F4F7D723902AE4C6C1BDA08C939748B121FB15765DD99E44E1D5D67FC50DE43C80E1DCC2E5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5168f1f1924f4039822d6f5a21b81bdd.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:776302rZDbW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.467671226609287
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MulwrC6JAF8jNdQIeXD:qgFq6g1af+MBOsa+2D
MD5:	502DAAC9B347872CC39D1AFB9CACE807
SHA1:	9C152B92F4FAE49B98BCF61C4098EAC4883F7EFF
SHA-256:	72F2016082C5E5FA3DEED45E6145F9EBFCE5736BFD12B3395981C6327F3C8C0E
SHA-512:	71DEB90B304FEA68857C808548A81DC677DC1784FC49F353DDE551F69F3B34428898CE99A51BA563863DF2F70F5B46EC3803299ADFD0661C91BDDF92EA4BC525
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=de75baf75ba1430d8ea477f72cc986e0.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77643CGRmcZ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.547005070187643
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8Kz2BEXng2js7LbgS:SbFuFyLVIg1BG+f+M8KSBEXnTji4s
MD5:	4074A09E432DD59B582F772B6888F2FB
SHA1:	577FE5599702CBF946B763678216B6D0AF857CED
SHA-256:	6CB07F8E91FE51D9D2B55F634DC487C9103122ECBFC2B2A552D2235B69D76056
SHA-512:	F5A7EA9829DE1DA80AE644EFB82353759CE79F7F2D36DFEB45443AB6F892DE23940823EEAA0F74221AAB7369329D6C4F679B9EBA49F4C349E5ED36CE511AC475
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6167ef97708042119d142b46f7e58bef.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:77651VqjL3Y

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.459636705488145
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M8DAW62Aj8jdCt/rRMtq:qgFq6g10+f+M8DAhduCDL
MD5:	9EB10E5C664C6D46DFCC3C4A251AC5C8
SHA1:	F8FE379E43968FAD78B1F3D8E0388EAE4A2E536B
SHA-256:	9C1AF75E39B38E7231E8D98F839BC2218C908F21C05E84EE52EA7CE2DF2808AC
SHA-512:	1D1CA977EE90DBF56CCCABAFAFC4655C7AFFC4E9BE31EAD8016CF75B5B8D05E34CAEBBCED179B76C662FC2F795E5B8CA4D22784B897A9219105FB4415D3E16C2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6e144a5e72e0499b87a23b66bcf02a56.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:78907dZD7OX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.387755459234192
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm7yOWHJ/DUeQddN2js2R:SbFuFyLVIg1BAf+Mu5p/DVIdN2jNTZD
MD5:	4FDB5158E7EB4B991ADE68628E181CDC
SHA1:	5A9F77A2E4757357988F068B3738C8AD9DBD3125
SHA-256:	521D35E4A3753BE36C9FF4889B028F964EC7FE49D6882B7227B557E2FEB5363D
SHA-512:	B18D9AA311F9166D888BAFDDBB74ECA909C6590E43886E397DBBC81A5D28122CB4FD614B585068446136EF55A28FA9205E0983E59799A869B746F3B9501C918C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1c3aa4f3b5b949f9b96af11a61c1b588.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78992eY5J2W

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.389948702772822
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpnRVQuGD7uqjswxJm:SbFuFyLVIg1BG+f+MlhGD7TjLTTIWTIL
MD5:	AF13C3395D6611CBB5C70CA53C16BE99
SHA1:	3E72C8E43CB6A4A5E9D15803C4D9E5294EE715D9
SHA-256:	BB7D5A8B6B23B42546AEA46C5703EFECE4CFED32EA1636BEC116019CFDFE68D7
SHA-512:	C7FC50CAD82DADC19831340BEC33511EFB5A4E33594ADEB4B3F41693C90A40D331B4D7D082264386741C49899B98675E676BDB73C2F36C27155B65AE1B7D8BCF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c3d037832bec402eabab0356ff0b0ba6.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:79019qNYs0V

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.4241734063694
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8HWSkmBdaHDS22js1:SbFuFyLVIg1BG+f+M82SdiS22jbVC
MD5:	32E6B3B83F69592ED4D3F9F334A73FCA
SHA1:	5A47A8DC1E4D3A2E6F3696DEE97943D997FA6304
SHA-256:	3DC6AECD8C81EC23E543B69B34579EE11ABE575CEF6CA9B9B1F9936827792471
SHA-512:	932FAFC6E4C615860CCA1B470DF77D062481B91E2B84F68BF32232F7A0713FC9E23E5BE2DF528E8C61EA7F96791C5BF00D93B2B1F0AB0F0852FE6FE626CCD043
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=62353dd7f25b4b5f89385b2fdda1d4fd.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:790619vJL9X

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.361432408873657
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmuxDeBEyrvAg2jsz:SbFuFyLVK6g7/+BG+f+MuNTyrvAg2jNq
MD5:	42ADB33A5E631A30012C7EEA318D9F86
SHA1:	2D8EB03209510F186DCC320177CFDCE0692CABE6
SHA-256:	B9C7FC1FEA283A5A4523290FE33FFA07F178A55D26E80ACCCC1F805ECDF1853F
SHA-512:	CF0605A0C83B39002E67072E29CD99D2816A55D357744D15A6621B0300BAEB598683A17653F8A1BBFA3B412B3D07F6EAF072AF384FBA3695019C62B9027C651E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d9d925f85ee44dcdaf50bdb90a81a00d.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:79063Stk7dW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.372415534258664
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmzwAF1AcTBjvl+sQ:SbFuFyLVI6g7/+BG+f+MUGbTjNq
MD5:	BB858791EB3F96D8EC66218EAEC6CB36
SHA1:	5D69D5D78E474050C91BB1FF76CA4E864A6838BD
SHA-256:	B564C7FCDB929F2A9F6F76725CBDF23DE70E2B8FC86537E7872A4CA70D3F8662
SHA-512:	4C7C39A74CCE266A6ED735190ECD74E642B2801FB9F17035D27CF6641365BB0B3A412EC77B59A65DB0770D86A8EFD83F7F64470123353976B75C3F695014AC86
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9b36a0beec2b4b92b5550ba068fd0aca.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:79102ARV7HX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.518323894567445
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MGHudevRqjFQMzKaBu:qgFqo6g7/+0+f+M2Oe+Tmh
MD5:	AA8B42A911FB82476CA2D983DBF7BB9F
SHA1:	B23D24856C83FC637EC2588B2A28E0B61A9B87E6
SHA-256:	B4C5E48638FB5B4AA160E4E74B6516C3D35BE00CA35C9FA754AEF4D6092F12AA
SHA-512:	9330D474DC51A06AAED1BEF0A485DE62EEE695570423FA374AB288FF02D8074B010C708725ECC0E5D15AE00E1B0C94461C0AD1EE5D53C5211577920FAED0FEB8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=95bbbc99e6134ade80a568526668f8f1.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:79103f3HOLY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.56368557320794
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MJAGuTT8RbjFQMzKaBu:qgFqdg7/+0+f+MJMTaTmh
MD5:	7C03D7D22F2B9C77D4C0D92DAB443A8B
SHA1:	8E9056AEF8917EF0FDAE4651C0BD257B4474597A
SHA-256:	910469C568046CEE37C1F034F8C7AB5CDA8E1F4CAD2F1782167C407A8D277D49
SHA-512:	FBFA2342049F95927C861739C1A6F3BFBBDB6E4B9A3D99352E0584318FDE360F8DB0D4A94A7E9E0517E64A5EFD621EACD4F5A8672BD25E303186CDCAF578900F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cff755d95d244f918b662367dcca8f16.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:79328aQW8FX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.37076664428277
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/sgDLUwVSdThuxsjx:SbFuFyLVIg1BG+f+MUQ4dtTjoa
MD5:	F835A97E715DC706FD3DA754E0F99150
SHA1:	450BFA5A2082F2AC8F2CED10FEDBA29EC281F29D
SHA-256:	43E7FD7EEB89863AABE6502C45EF4F90CE61DCE41DF397D5B2020EC3CDD06DEE
SHA-512:	504B8373628B8BB8A80D8761105F5187010CA533E9421A3211D7CFF4FB46A86193DFDB5DA712F855FB191995D039F05A620D99A46E1FD513183CCD2B24877885
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=50baa5e893094cfda9643575dac78052.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:79338X8WJPU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.363502362838018
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8i6MRFuAb/dE59jsO:SbFuFyLVIg1BG+f+M8ipFuwu59jtWL0
MD5:	19DB83B12F850991CED39440EB7DCFD1
SHA1:	44C4628C159D492AACA3F4738C0E7C5A9E135FC1
SHA-256:	84D49AEE0BCF606719FF09F196286542DF311BC0B0BE7512842D6C195490876F
SHA-512:	B1BF7EE9FE6D7A32835C588E1D305FF473BD17EDD99E1647AA711DD28A2F71F11D3AC9E6BA63FCE51A77371B8F522F915F5213EEBAA6655DD2548B6980FFA537
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6748df7dbb634c7abe392bc0e68ab1e9.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:79343sEgxTY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.384504978942923
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuTPdd1dE5AP8jsjOA:SbFuFyLVIg1BG+f+Mu/1zP8jNE
MD5:	00C029B5246E97FFBA5C7BFC72AF8CC1
SHA1:	E7D3210B39CA202C37F55CB65C177ABEC5CAB309
SHA-256:	7612E8BA81550F9C397F11382091809317336BE1E2ADFC8295541D6C0503FC20
SHA-512:	6EB31EFA565F798D0EB932A9C06B1DD648B2385BFB42D7119B8BFB1383D00A468AC094F9A0D5B0E9A2D24BDAAB43140D5009581952C6C35466C2A9A52A4A1FD7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d83d165511864e529aa52604ea2cecde.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/seats/.#seat0YEe48s

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0YQtldq

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0pvC5ZH

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/users/.#1276BqD7q

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.290708832220316
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6EgCgDpcTt2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBHgDpcTEthQHtPYq9M
MD5:	F21596179165F64AB158DE0099FF5130
SHA1:	70DDF041A45F4508A4DD2D77671833B8B937361E
SHA-256:	23F20C4F53E39B760BECD6E04EFA1ED8517AAEE8BFF54FD325D320F49EC6D01D
SHA-512:	1B082A074E3DBEE4A57EFB1543F89125FD8F0A7079729AD741F4DFFB4EA8E65FB535EBA1A3322D34CF91D4097E11380EF5783338221E7F2F6242036D5B36228F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12892.REALTIME=1736206104763644.MONOTONIC=441849447.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#1277mMCXq

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.2588561364966635
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgDpQf3vbqx4bg206qodFM1jn:SbFuFyL3BVgdL87iesnAiRJgDpcyt6rG
MD5:	10137CDEF7938C2E41AB6F3782E53517
SHA1:	4F593BD20D45F29D2C57227F4CA84AFF21394D10
SHA-256:	062B2031D7A22262D2C9D5DB0BA1FB7F723760B73DEB3C84BB397D3A59FD869D
SHA-512:	625B47B710F8AEAE98D18E404CEFBECD6FC48978F76EE3DB0EBF3CCDB59056FA2C6E08197AB048353027714D04218904F48756024CB505FEB8C4087158F3BC41
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1736206104763644.MONOTONIC=441849447.LAST_SESSION_TIMESTAMP=441913466.

/run/systemd/users/.#127FiVg3t

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127kf3agu

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.441251050594821
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6nxJgDpcyt6rMRn:qgFq30dABibB0gDpcyIrMR
MD5:	CDEBCB2313C0FCD29AE34D939F19169C
SHA1:	B3C20E6EEBA2E1718E2178BF5112F3D8BDE38009
SHA-256:	CDB9F6CE57401E3C23821A631AA51A9A8A5F19C93688F8FB751B7AD6E7A795CD
SHA-512:	65A9749DEABC723CF84E851D1E83629B4BA8BB8A688981040F6820BEBF45A5FF4124CBE4506EA427E01060689979A43D9F598E6F73630D04CBD3737DE68B4E74
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12954.REALTIME=1736206104763644.MONOTONIC=441849447.LAST_SESSION_TIMESTAMP=441913466.

/run/systemd/users/.#127lfJYpr

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.441251050594821
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6nxJgDpcyt6rMRn:qgFq30dABibB0gDpcyIrMR
MD5:	CDEBCB2313C0FCD29AE34D939F19169C
SHA1:	B3C20E6EEBA2E1718E2178BF5112F3D8BDE38009
SHA-256:	CDB9F6CE57401E3C23821A631AA51A9A8A5F19C93688F8FB751B7AD6E7A795CD
SHA-512:	65A9749DEABC723CF84E851D1E83629B4BA8BB8A688981040F6820BEBF45A5FF4124CBE4506EA427E01060689979A43D9F598E6F73630D04CBD3737DE68B4E74
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12954.REALTIME=1736206104763644.MONOTONIC=441849447.LAST_SESSION_TIMESTAMP=441913466.

/run/systemd/users/.#127sRVnPq

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.290708832220316
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6EgCgDpcTt2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBHgDpcTEthQHtPYq9M
MD5:	F21596179165F64AB158DE0099FF5130
SHA1:	70DDF041A45F4508A4DD2D77671833B8B937361E
SHA-256:	23F20C4F53E39B760BECD6E04EFA1ED8517AAEE8BFF54FD325D320F49EC6D01D
SHA-512:	1B082A074E3DBEE4A57EFB1543F89125FD8F0A7079729AD741F4DFFB4EA8E65FB535EBA1A3322D34CF91D4097E11380EF5783338221E7F2F6242036D5B36228F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12892.REALTIME=1736206104763644.MONOTONIC=441849447.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:nSvn:c
MD5:	1D7DD528834D5E64D74B81D5312EEEEB
SHA1:	C734E0958B94C65CE74E77DE378EAD3D49BA2E0D
SHA-256:	AB5E89712CABEAD8BBACB0D890946F8D1EFD4EF711FF2EE17A88E31FE9797B2D
SHA-512:	FAE538E89CDDCA777EB0415B31F5C106EB4814856553E0879B820F1622F42B1E4A4AA5C359BCCF9C6D8CAE20F3BFF17A1DC50C4095DEF7E04DBBDBE9EB9B5FD8
Malicious:	false
Preview:	6537.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.667086846768475
Encrypted:	false
SSDEEP:	3:g0sXlXEWtl/Lah/:m+ylja
MD5:	013C3ABF771999DB31398FC2AF28FBFF
SHA1:	81BDEF636F1D7A9DC03C5AE5CCDC549BE34E7777
SHA-256:	65FBFC080B64899CA22DD8DAB89EC6219DADCBDB52C20E130C75F6372FED2C1E
SHA-512:	08CD5DCFAEC34701B3CFA1F447CFA399406324EA530D25A27147162812B109AC5A3A02AF8770D1900F0FFED1DA5986893DFAB51CB86B512955612B200A2095B3
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN....................................................................................................................................................................................................................................................................................................g\|g........................................

/tmp/qemu-open.uVmNxX (deleted)

Download File

Process:	/tmp/gnjqwpc.elf
File Type:	data
Category:	dropped
Size (bytes):	27
Entropy (8bit):	4.060262039120377
Encrypted:	false
SSDEEP:	3:TgIPhGxHJN:TgIaJN
MD5:	3CE6233A37CCF121B6A88BAD88E621BD
SHA1:	FE7EE8DFE57D8373882D61547998F23FCDCF0FFC
SHA-256:	E973BB6847117AA9ECB410974531A12FC2E2964299896EE25C25591A57204D2B
SHA-512:	5BB96EA9706354E8E1A8DA1E286C3B52BB1FF9A5DFA04CCD87CD6328804DDD853F84DC21C455739C3AE11F7A649635EC0D84AF0C6D938EE31C9FC0866BC42726
Malicious:	false
Preview:	/tmp/gnjqwpc.elf.nwlrbbmqbh

/var/lib/AccountsService/users/gdm.G7EYZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1614
Entropy (8bit):	4.890994083624681
Encrypted:	false
SSDEEP:	48:6IvjgjG25J25H2B2+vm2+fVA2zwZYr4Xnr4XYrCn:7Sz5M5W0+vT+f/oYsXs/
MD5:	504615EEDFCB0F9AD89FE9F1E4C698CE
SHA1:	BE198D8528035C9BB28C40191D4CBE3DD11C9846
SHA-256:	31C788859C7DF138460AC8B7851BB67A80137D0C45048B79AE4A03A6D2C71F34
SHA-512:	597C29CD4C8B69BD710D69903B0FF5ECCCB7A15A9192E221F50BDD948C38775E904159D7BC22AC774B37FE34FC338EA71051584603CFE372278C700A9D320478
Malicious:	false
Preview:	Jan 6 17:28:11 galassia systemd-logind[6391]: Failed to add user by file name 127, ignoring: Invalid argument.Jan 6 17:28:11 galassia systemd-logind[6391]: Failed to add user by file name 1000, ignoring: Invalid argument.Jan 6 17:28:11 galassia systemd-logind[6391]: User enumeration failed: Invalid argument.Jan 6 17:28:11 galassia systemd-logind[6391]: User of session c2 not known..Jan 6 17:28:12 galassia systemd-logind[6391]: User of session 2 not known..Jan 6 17:28:12 galassia systemd-logind[6391]: User of session c1 not known..Jan 6 17:28:12 galassia systemd-logind[6391]: Session enumeration failed: No such file or directory.Jan 6 17:28:12 galassia systemd-logind[6391]: Watching system buttons on /dev/input/event0 (Power Button).Jan 6 17:28:12 galassia systemd-logind[6391]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Jan 6 17:28:12 galassia systemd-logind[6391]: New seat seat0..Jan 6 17:28:24 galassia gdm-launch-environment]: pam_unix(gdm-l

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4428593527838256
Encrypted:	false
SSDEEP:	3:F31HlfFAGJvbC//lJFAGJvbCdt:F3NAGJTC//lTAGJTC
MD5:	72AE567775079367E0BED121C91E613B
SHA1:	7F4A16677F3D4F1C5427839A496ABAEBB3BB3774
SHA-256:	7D6F648AD2B562C3949859A4BF8A28EBC8A3E605F84826061B99577A49E502F2
SHA-512:	EF54B36C279E1DF268E33909D4919169B46F10866B763625AE29755D5C1BB4CC56EB57D43C1526EE2C634BE444DFFF0AB5D5B1BF9FB9C0B868C0F7EB0F8A2AE3
Malicious:	false
Preview:	LPKSHHRH..................._B%.$........................................_B%.$.............................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.448047321524811
Encrypted:	false
SSDEEP:	3:F31HliYl4jEfsel/taYl4jEfseV/:F3Spj2s6/8pj2sK/
MD5:	2DE9B5D161CCCECF2F30DEB0384AFD28
SHA1:	9AEB81FE386084723AE3F1345066DE5D21FF8B88
SHA-256:	541F630C236BE9C8AD0D9B6B6A905CFE829952C2DCCC89E035458A18F1137F1C
SHA-512:	41E5A74EC65E1ABA55DA281EA1FC84EA077ECB900F7F6EEF62A17851F2A4C88751BEF03D778B34EDAB3F7146DD1C1C3C1B493A4B3FAA8DC2F7FFC7DF5375913A
Malicious:	false
Preview:	LPKSHHRH................_...WF...K:.] ................................._...WF...K:.] .........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	6857
Entropy (8bit):	4.710861265862967
Encrypted:	false
SSDEEP:	192:+lk8UiqCbe6SzZdPqvc6y2aVpu+RyN5xTgtYMHfkNo:onFxTgtYMHz
MD5:	B12650153C62DEEBF00951921238AEFF
SHA1:	46ACD13690B724A885393F77D35EF2E3E1A465E2
SHA-256:	E80483FDFDCFB2C71BCBD5415D00B3CB0226321CECD8D6CDB68C226C18AA9403
SHA-512:	C1821984AE8EA892ED6853D2546FA3189F53DECD6DC9875E53BDE75FDFF19D1B83846EE9E49D79EED414AB45D867E390DB87CAE815B5CF87576495A8D755AF52
Malicious:	false
Preview:	Jan 6 17:28:06 galassia kernel: [ 422.150987] blocking signal 19: 6243 -> 2048.Jan 6 17:28:06 galassia kernel: [ 422.374268] New task spawned: old: (tgid 6368, tid 6368), new (tgid: 6386, tid: 6386).Jan 6 17:28:06 galassia kernel: [ 422.410557] New task spawned: old: (tgid 6386, tid 6386), new (tgid: 6387, tid: 6387).Jan 6 17:28:06 galassia kernel: [ 422.439517] blocking signal 9: 6243 -> 658.Jan 6 17:28:06 galassia kernel: [ 422.454389] blocking signal 9: 6243 -> 720.Jan 6 17:28:06 galassia kernel: [ 422.469464] blocking signal 9: 6243 -> 759.Jan 6 17:28:06 galassia kernel: [ 422.485470] blocking signal 9: 6243 -> 761.Jan 6 17:28:06 galassia kernel: [ 422.500288] blocking signal 9: 6243 -> 772.Jan 6 17:28:06 galassia kernel: [ 422.518886] blocking signal 9: 6243 -> 936.Jan 6 17:28:06 galassia kernel: [ 422.534933] blocking signal 9: 6243 -> 1334.Jan 6 17:28:06 galassia kernel: [ 422.550367] blocking signal 9: 6243 -> 1335.Jan 6 17:28:06 galassia kernel: [ 422.5

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (317)
Category:	dropped
Size (bytes):	33349
Entropy (8bit):	5.013995395126823
Encrypted:	false
SSDEEP:	768:QDabGaQ8GaQV8h9XVDHp8xTgA0VscD6MHrEAuq8w6Ob3dXZFTQeiUAq2MHNRroaF:hOVxTgA0VscD6MH6wUKsW
MD5:	0BC8371EEE4D3AF4D0060A893A56DF4C
SHA1:	1E139620391D22F8E7FD12C0EB5E444AFC549C22
SHA-256:	05E4CC95AFC0E1F6C797C3945D9C4AA9FBAEF5E949CD10FBD53DE49727C341C4
SHA-512:	F0D35C3DE46C895552FF36104D588562A55E05F556193739229DB61EE841DA0D03731BBFFC64DB830AD2F63B0C87B550133EB8DDEDC21EC0E0A276EF7917E914
Malicious:	false
Preview:	Jan 6 17:28:06 galassia kernel: [ 422.150987] blocking signal 19: 6243 -> 2048.Jan 6 17:28:06 galassia kernel: [ 422.374268] New task spawned: old: (tgid 6368, tid 6368), new (tgid: 6386, tid: 6386).Jan 6 17:28:06 galassia kernel: [ 422.410557] New task spawned: old: (tgid 6386, tid 6386), new (tgid: 6387, tid: 6387).Jan 6 17:28:06 galassia kernel: [ 422.421562] systemd[1]: systemd-journald.service: Scheduled restart job, restart counter is at 1..Jan 6 17:28:06 galassia kernel: [ 422.422004] systemd[1]: Stopping Flush Journal to Persistent Storage....Jan 6 17:28:06 galassia kernel: [ 422.439517] blocking signal 9: 6243 -> 658.Jan 6 17:28:06 galassia kernel: [ 422.454389] blocking signal 9: 6243 -> 720.Jan 6 17:28:06 galassia kernel: [ 422.469464] blocking signal 9: 6243 -> 759.Jan 6 17:28:06 galassia kernel: [ 422.485470] blocking signal 9: 6243 -> 761.Jan 6 17:28:06 galassia kernel: [ 422.500288] blocking signal 9: 6243 -> 772.Jan 6 17:28:06 galassia kernel: [ 42

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.667086846768475
Encrypted:	false
SSDEEP:	3:g0sXlXEWtl/Lah/:m+ylja
MD5:	013C3ABF771999DB31398FC2AF28FBFF
SHA1:	81BDEF636F1D7A9DC03C5AE5CCDC549BE34E7777
SHA-256:	65FBFC080B64899CA22DD8DAB89EC6219DADCBDB52C20E130C75F6372FED2C1E
SHA-512:	08CD5DCFAEC34701B3CFA1F447CFA399406324EA530D25A27147162812B109AC5A3A02AF8770D1900F0FFED1DA5986893DFAB51CB86B512955612B200A2095B3
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN....................................................................................................................................................................................................................................................................................................g\|g........................................

Source: global traffic	TCP traffic: 192.168.2.23:33506 -> 178.215.238.112:33966
Source: global traffic	TCP traffic: 192.168.2.23:50018 -> 89.190.156.145:7733

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.642866812351372
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	gnjqwpc.elf
File size:	150'472 bytes
MD5:	4a392432e26bda1422b98ce8b776906b
SHA1:	970765353b055bb5a15dbecd33133994a8827fce
SHA256:	f3e4bfe8cc9b9e40f44f478f0c46d82d668515b4e99abb7376f4d24df0d63fb8
SHA512:	462b5488ab7857d97fc75dce227fdfc5e0bff4a4c1f8816bd62a10712cc978ccfcecaeb87603d4e0f908a43666c05ac795e76e4382582f8fb577a6048ddd7304
SSDEEP:	1536:/Qi3gjkqHX9AhpiJxqAjvBL9gEB4Xf1dNF36lfzesJ+vA5zKGnSNawsAmqXhqlJk:/5y3tJxhZL1KvnNwl7J35B/7m
TLSH:	E6E33B42730C0A47D1632DF03F3B27E193EFA98125E4F644655FAB8A9271E32558AECD
File Content Preview:	.ELF...........................4..I......4. ...(.......................$...$..........................Il............dt.Q.............................!..\|......$H...H......$8!. \|...N.. .!..\|.......?.........Jp..../...@..\?......D.+../...A..$8...}).....DN..

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x100001f0
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	149952
Section Header Size:	40
Number of Section Headers:	13
Header String Table Index:	12

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10000094	0x94	0x24	0x0	0x6	AX	4
.text	PROGBITS	0x100000b8	0xb8	0x1c834	0x0	0x6	AX	4
.fini	PROGBITS	0x1001c8ec	0x1c8ec	0x20	0x0	0x6	AX	4
.rodata	PROGBITS	0x1001c910	0x1c910	0x2e14	0x0	0x2	A	8
.ctors	PROGBITS	0x10020000	0x20000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x1002000c	0x2000c	0x8	0x0	0x3	WA	4
.got2	PROGBITS	0x10020018	0x20018	0xc	0x0	0x3	WA	1
.data	PROGBITS	0x10020040	0x20040	0x48a0	0x0	0x3	WA	32
.sdata	PROGBITS	0x100248e0	0x248e0	0x8c	0x0	0x3	WA	4
.sbss	NOBITS	0x1002496c	0x2496c	0x104	0x0	0x3	WA	4
.bss	NOBITS	0x10024a70	0x2496c	0x4480	0x0	0x3	WA	8
.shstrtab	STRTAB	0x0	0x2496c	0x51	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0x1f724	0x1f724	6.2157	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x20000	0x10020000	0x10020000	0x496c	0x8ef0	0.4671	0x6	RW	0x10000	.ctors .dtors .got2 .data .sdata .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 7, 2025 00:28:08.476167917 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Jan 7, 2025 00:29:28.486479044 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 7, 2025 00:27:58.437947989 CET	8.8.8.8	192.168.2.23	0xfee	No error (0)	fingwi.cardiacpure.ru	178.215.238.112	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:28:02.023369074 CET	1.1.1.1	192.168.2.23	0xa7ca	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Jan 7, 2025 00:28:02.023369074 CET	1.1.1.1	192.168.2.23	0xa7ca	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2025-01-06 23:28:12 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2025-01-06 23:28:12 UTC	25	IN	HTTP/1.1 100 Continue
2025-01-06 23:28:12 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2025-01-06 23:28:12 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2025-01-06 23:28:12 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2025-01-06 23:28:12 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2025-01-06 23:28:12 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2025-01-06 23:28:12 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2025-01-06 23:28:12 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2025-01-06 23:28:12 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2025-01-06 23:28:12 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2025-01-06 23:28:12 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2025-01-06 23:28:12 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Mon, 06 Jan 2025 23:28:12 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	23:27:57
Start date (UTC):	06/01/2025
Path:	/tmp/gnjqwpc.elf
Arguments:	/tmp/gnjqwpc.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	23:27:58
Start date (UTC):	06/01/2025
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	23:27:59
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	23:28:01
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	23:28:02
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	23:28:03
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	23:28:04
Start date (UTC):	06/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	23:28:05
Start date (UTC):	06/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	23:28:06
Start date (UTC):	06/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	23:28:08
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	23:28:11
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	23:28:21
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report gnjqwpc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6504/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:77607GStKXX

/run/systemd/journal/streams/.#9:776141miioZ

/run/systemd/journal/streams/.#9:77615tm8w3V

/run/systemd/journal/streams/.#9:77628gF0RyW

/run/systemd/journal/streams/.#9:77629IoG5cY

/run/systemd/journal/streams/.#9:776302rZDbW

/run/systemd/journal/streams/.#9:77643CGRmcZ

/run/systemd/journal/streams/.#9:77651VqjL3Y

/run/systemd/journal/streams/.#9:78907dZD7OX

/run/systemd/journal/streams/.#9:78992eY5J2W

/run/systemd/journal/streams/.#9:79019qNYs0V

/run/systemd/journal/streams/.#9:790619vJL9X

/run/systemd/journal/streams/.#9:79063Stk7dW

/run/systemd/journal/streams/.#9:79102ARV7HX

/run/systemd/journal/streams/.#9:79103f3HOLY

/run/systemd/journal/streams/.#9:79328aQW8FX

/run/systemd/journal/streams/.#9:79338X8WJPU

/run/systemd/journal/streams/.#9:79343sEgxTY

/run/systemd/seats/.#seat0YEe48s

/run/systemd/seats/.#seat0YQtldq

/run/systemd/seats/.#seat0pvC5ZH

/run/systemd/users/.#1276BqD7q

/run/systemd/users/.#1277mMCXq

/run/systemd/users/.#127FiVg3t

/run/systemd/users/.#127kf3agu

/run/systemd/users/.#127lfJYpr

/run/systemd/users/.#127sRVnPq

Linux Analysis Report
gnjqwpc.elf

Start time (UTC):	23:28:22
Start date (UTC):	06/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	23:28:23
Start date (UTC):	06/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	23:28:24
Start date (UTC):	06/01/2025
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	23:28:25
Start date (UTC):	06/01/2025
Path:	/usr/lib/gdm3/gdm-wayland-session
Arguments:	-
File size:	76368 bytes
MD5 hash:	d3def63cf1e83f7fb8a0f13b1744ff7c

Start time (UTC):	23:29:29
Start date (UTC):	06/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre