Edit tour

Linux Analysis Report
Fantazy.spc.elf

Overview

General Information

Sample name:	Fantazy.spc.elf
Analysis ID:	1586850
MD5:	05384cc06243dbf631c6053f05231f98
SHA1:	a583e47f07ddd5407d2d36cc7777af17a13ec7f8
SHA256:	7a55e92aa4e32797f50100c28d18501d5c4c85166d7ebdc7c2a6f921e4ce362e
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "rm" command used to delete files or directories

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1586850
Start date and time:	2025-01-09 17:22:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Fantazy.spc.elf
Detection:	MAL
Classification:	mal56.spre.troj.linELF@0/5@3/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Fantazy.spc.elf

Runtime Messages

Command:	/tmp/Fantazy.spc.elf
PID:	6271
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	VegaSec-KATANA001
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6240, Parent: 4331)

rm (PID: 6240, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.BIfEaSaW3y /tmp/tmp.sEyQtUBQDv /tmp/tmp.4ZsFziwp1B

dash New Fork (PID: 6241, Parent: 4331)

rm (PID: 6241, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.BIfEaSaW3y /tmp/tmp.sEyQtUBQDv /tmp/tmp.4ZsFziwp1B

Fantazy.spc.elf (PID: 6271, Parent: 6172, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/Fantazy.spc.elf

Fantazy.spc.elf New Fork (PID: 6273, Parent: 6271)

Fantazy.spc.elf New Fork (PID: 6274, Parent: 6271)

Fantazy.spc.elf New Fork (PID: 6277, Parent: 6274)

Fantazy.spc.elf New Fork (PID: 6279, Parent: 6274)

Fantazy.spc.elf New Fork (PID: 6281, Parent: 6274)

systemd New Fork (PID: 6284, Parent: 1)

journalctl (PID: 6284, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6306, Parent: 1)

dbus-daemon (PID: 6306, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6318, Parent: 1)

systemd-journald (PID: 6318, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6319, Parent: 1860)

pulseaudio (PID: 6319, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6320, Parent: 1)

rsyslogd (PID: 6320, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

gvfsd-fuse New Fork (PID: 6321, Parent: 2038)

fusermount (PID: 6321, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6331, Parent: 1)

dbus-daemon (PID: 6331, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6332, Parent: 1)

systemd-journald (PID: 6332, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6334, Parent: 1)

rsyslogd (PID: 6334, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6335, Parent: 1)

dbus-daemon (PID: 6335, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6336, Parent: 1)

systemd-journald (PID: 6336, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6338, Parent: 1)

dbus-daemon (PID: 6338, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6339, Parent: 1)

rsyslogd (PID: 6339, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6340, Parent: 1)

systemd-journald (PID: 6340, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6341, Parent: 1)

dbus-daemon (PID: 6341, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6343, Parent: 1)

systemd-journald (PID: 6343, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6344, Parent: 1)

rsyslogd (PID: 6344, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

gdm3 New Fork (PID: 6345, Parent: 1320)

Default (PID: 6345, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6347, Parent: 1320)

Default (PID: 6347, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6348, Parent: 1320)

Default (PID: 6348, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6349, Parent: 1)

rsyslogd (PID: 6349, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6355, Parent: 1)

gpu-manager (PID: 6355, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

systemd New Fork (PID: 6356, Parent: 1)

generate-config (PID: 6356, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

systemd New Fork (PID: 6358, Parent: 1)

gpu-manager (PID: 6358, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

systemd New Fork (PID: 6359, Parent: 1)

generate-config (PID: 6359, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

systemd New Fork (PID: 6360, Parent: 1)

gpu-manager (PID: 6360, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

systemd New Fork (PID: 6361, Parent: 1)

generate-config (PID: 6361, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

systemd New Fork (PID: 6363, Parent: 1)

gpu-manager (PID: 6363, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6364, Parent: 6363)

sh (PID: 6364, Parent: 6363, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

gpu-manager New Fork (PID: 6365, Parent: 6363)

sh (PID: 6365, Parent: 6363, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

gpu-manager New Fork (PID: 6366, Parent: 6363)

sh (PID: 6366, Parent: 6363, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

gpu-manager New Fork (PID: 6367, Parent: 6363)

sh (PID: 6367, Parent: 6363, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

gpu-manager New Fork (PID: 6368, Parent: 6363)

sh (PID: 6368, Parent: 6363, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

gpu-manager New Fork (PID: 6369, Parent: 6363)

sh (PID: 6369, Parent: 6363, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

gpu-manager New Fork (PID: 6370, Parent: 6363)

sh (PID: 6370, Parent: 6363, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

gpu-manager New Fork (PID: 6371, Parent: 6363)

sh (PID: 6371, Parent: 6363, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

systemd New Fork (PID: 6372, Parent: 1)

generate-config (PID: 6372, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6373, Parent: 6372)

pkill (PID: 6373, Parent: 6372, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6374, Parent: 1)

gdm-wait-for-drm (PID: 6374, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6379, Parent: 1)

generate-config (PID: 6379, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

systemd New Fork (PID: 6380, Parent: 1)

gpu-manager (PID: 6380, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

systemd New Fork (PID: 6381, Parent: 1)

generate-config (PID: 6381, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6382, Parent: 6381)

pkill (PID: 6382, Parent: 6381, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6383, Parent: 1)

systemd New Fork (PID: 6384, Parent: 1)

systemd New Fork (PID: 6385, Parent: 1)

generate-config (PID: 6385, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

cleanup

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6320)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /tmp/Fantazy.spc.elf (PID: 6271)

Socket: 127.0.0.1:59025

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 87.16.97.193
Source: unknown	TCP traffic detected without corresponding DNS query: 123.200.249.193
Source: unknown	TCP traffic detected without corresponding DNS query: 169.108.114.81
Source: unknown	TCP traffic detected without corresponding DNS query: 12.250.142.154
Source: unknown	TCP traffic detected without corresponding DNS query: 114.89.96.23
Source: unknown	TCP traffic detected without corresponding DNS query: 60.6.116.87
Source: unknown	TCP traffic detected without corresponding DNS query: 219.125.20.71
Source: unknown	TCP traffic detected without corresponding DNS query: 36.183.2.187
Source: unknown	TCP traffic detected without corresponding DNS query: 187.117.120.88
Source: unknown	TCP traffic detected without corresponding DNS query: 64.231.199.21
Source: unknown	TCP traffic detected without corresponding DNS query: 162.161.151.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.13.58.213
Source: unknown	TCP traffic detected without corresponding DNS query: 70.202.235.4
Source: unknown	TCP traffic detected without corresponding DNS query: 27.26.2.172
Source: unknown	TCP traffic detected without corresponding DNS query: 18.205.97.124
Source: unknown	TCP traffic detected without corresponding DNS query: 68.174.78.168
Source: unknown	TCP traffic detected without corresponding DNS query: 85.139.117.48
Source: unknown	TCP traffic detected without corresponding DNS query: 19.228.225.0
Source: unknown	TCP traffic detected without corresponding DNS query: 90.238.173.64
Source: unknown	TCP traffic detected without corresponding DNS query: 190.156.149.175
Source: unknown	TCP traffic detected without corresponding DNS query: 63.229.53.140
Source: unknown	TCP traffic detected without corresponding DNS query: 9.51.175.86
Source: unknown	TCP traffic detected without corresponding DNS query: 151.87.104.86
Source: unknown	TCP traffic detected without corresponding DNS query: 125.6.63.234
Source: unknown	TCP traffic detected without corresponding DNS query: 192.62.242.83
Source: unknown	TCP traffic detected without corresponding DNS query: 133.201.221.7
Source: unknown	TCP traffic detected without corresponding DNS query: 206.51.223.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.36.125.88
Source: unknown	TCP traffic detected without corresponding DNS query: 181.97.196.114
Source: unknown	TCP traffic detected without corresponding DNS query: 212.253.141.130
Source: unknown	TCP traffic detected without corresponding DNS query: 73.30.0.170
Source: unknown	TCP traffic detected without corresponding DNS query: 116.172.168.3
Source: unknown	TCP traffic detected without corresponding DNS query: 42.70.215.16
Source: unknown	TCP traffic detected without corresponding DNS query: 169.111.196.162
Source: unknown	TCP traffic detected without corresponding DNS query: 147.107.246.129
Source: unknown	TCP traffic detected without corresponding DNS query: 123.190.229.105
Source: unknown	TCP traffic detected without corresponding DNS query: 172.42.40.103
Source: unknown	TCP traffic detected without corresponding DNS query: 192.218.201.14
Source: unknown	TCP traffic detected without corresponding DNS query: 102.114.196.12
Source: unknown	TCP traffic detected without corresponding DNS query: 74.253.95.63
Source: unknown	TCP traffic detected without corresponding DNS query: 35.126.87.28
Source: unknown	TCP traffic detected without corresponding DNS query: 118.249.166.27
Source: unknown	TCP traffic detected without corresponding DNS query: 133.65.142.79
Source: unknown	TCP traffic detected without corresponding DNS query: 45.9.171.244
Source: unknown	TCP traffic detected without corresponding DNS query: 114.130.92.251
Source: unknown	TCP traffic detected without corresponding DNS query: 157.190.209.66
Source: unknown	TCP traffic detected without corresponding DNS query: 37.127.202.209

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53450
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53450 -> 443

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 1389, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 1476, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 1809, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 4508, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6076, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6232, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6235, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6274, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6281, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6306, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6315, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6318, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6319, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6320, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6331, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6332, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6333, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6334, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6335, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6336, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6337, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6338, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6339, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6340, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6341, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6342, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6343, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6344, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6347, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6348, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6349, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6355, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6356, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6358, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6359, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6360, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6361, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6362, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6364, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6365, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6366, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6367, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6368, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6369, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6370, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6371, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6375, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6376, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6377, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6378, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6379, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6380, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6382, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6383, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6384, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6385, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6386, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6387, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6388, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6390, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 1389, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 1476, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 1809, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 4508, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6076, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6232, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6235, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6274, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6281, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6306, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6315, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6318, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6319, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6320, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6331, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6332, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6333, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6334, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6335, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6336, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6337, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6338, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6339, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6340, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6341, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6342, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6343, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6344, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6347, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6348, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6349, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6355, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6356, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6358, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6359, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6360, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6361, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6362, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6364, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6365, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6366, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6367, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6368, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6369, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6370, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6371, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6375, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6376, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6377, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6378, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6379, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6380, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6382, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6383, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6384, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6385, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6386, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6387, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6388, result: successful	Jump to behavior
Source: /tmp/Fantazy.spc.elf (PID: 6279)	SIGKILL sent: pid: 6390, result: successful	Jump to behavior

Source: classification engine

Classification label: mal56.spre.troj.linELF@0/5@3/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6306)	File: /proc/6306/mounts			Jump to behavior
Source: /bin/fusermount (PID: 6321)	File: /proc/6321/mounts			Jump to behavior

Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/6232/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/6232/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/6235/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/6235/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/3088/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/230/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/230/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/231/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/231/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/232/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/232/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/233/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/233/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/234/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/234/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/1335/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/1334/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/2302/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/236/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/236/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/237/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/237/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/910/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/910/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/13/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/14/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/14/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/15/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/15/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/16/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/16/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/17/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/17/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/18/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/18/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/120/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/120/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/121/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/121/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/1/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/122/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/122/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/243/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/243/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/123/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/123/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/2/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/2/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/124/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/124/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/3/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/3/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/4/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/4/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/125/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/125/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/126/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/126/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/248/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/248/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/6/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/6/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/127/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/127/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/128/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/128/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/249/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/249/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/9/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/9/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/6118/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6373)	File opened: /proc/6118/cmdline	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6364)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6365)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6366)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6367)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6368)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6369)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6370)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6371)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6373)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service			Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6382)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service			Jump to behavior

Source: /usr/bin/dash (PID: 6240)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.BIfEaSaW3y /tmp/tmp.sEyQtUBQDv /tmp/tmp.4ZsFziwp1B			Jump to behavior
Source: /usr/bin/dash (PID: 6241)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.BIfEaSaW3y /tmp/tmp.sEyQtUBQDv /tmp/tmp.4ZsFziwp1B			Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6320)	Log file created: /var/log/kern.log			Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 6363)	Log file created: /var/log/gpu-manager.log			Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 6363)

Truncated file: /var/log/gpu-manager.log

Jump to behavior

Source: /usr/bin/pkill (PID: 6373)

Reads CPU info from /sys: /sys/devices/system/cpu/online

Jump to behavior

Source: /tmp/Fantazy.spc.elf (PID: 6271)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6320)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6363)	Queries kernel information via 'uname':	Jump to behavior

Source: Fantazy.spc.elf, 6271.1.00005644f8a48000.00005644f8aad000.rw-.sdmp, Fantazy.spc.elf, 6273.1.00005644f8a48000.00005644f8aad000.rw-.sdmp, Fantazy.spc.elf, 6274.1.00005644f8a48000.00005644f8aad000.rw-.sdmp, Fantazy.spc.elf, 6277.1.00005644f8a48000.00005644f8aad000.rw-.sdmp, Fantazy.spc.elf, 6281.1.00005644f8a48000.00005644f8aad000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: syslog.33.dr	Binary or memory string: Jan 9 10:23:01 galassia kernel: [ 421.984160] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: Fantazy.spc.elf, 6271.1.00007fff8904f000.00007fff89070000.rw-.sdmp, Fantazy.spc.elf, 6273.1.00007fff8904f000.00007fff89070000.rw-.sdmp, Fantazy.spc.elf, 6274.1.00007fff8904f000.00007fff89070000.rw-.sdmp, Fantazy.spc.elf, 6277.1.00007fff8904f000.00007fff89070000.rw-.sdmp, Fantazy.spc.elf, 6281.1.00007fff8904f000.00007fff89070000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/Fantazy.spc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Fantazy.spc.elf
Source: Fantazy.spc.elf, 6271.1.00005644f8a48000.00005644f8aad000.rw-.sdmp, Fantazy.spc.elf, 6273.1.00005644f8a48000.00005644f8aad000.rw-.sdmp, Fantazy.spc.elf, 6274.1.00005644f8a48000.00005644f8aad000.rw-.sdmp, Fantazy.spc.elf, 6277.1.00005644f8a48000.00005644f8aad000.rw-.sdmp, Fantazy.spc.elf, 6281.1.00005644f8a48000.00005644f8aad000.rw-.sdmp	Binary or memory string: DV!/etc/qemu-binfmt/sparc
Source: syslog.33.dr	Binary or memory string: Jan 9 10:23:01 galassia kernel: [ 421.984124] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: Fantazy.spc.elf, 6271.1.00007fff8904f000.00007fff89070000.rw-.sdmp, Fantazy.spc.elf, 6273.1.00007fff8904f000.00007fff89070000.rw-.sdmp, Fantazy.spc.elf, 6274.1.00007fff8904f000.00007fff89070000.rw-.sdmp, Fantazy.spc.elf, 6277.1.00007fff8904f000.00007fff89070000.rw-.sdmp, Fantazy.spc.elf, 6281.1.00007fff8904f000.00007fff89070000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Disable or Modify Tools	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Indicator Removal	LSASS Memory	11 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Fantazy.spc.elf	100%	Avira	EXP/ELF.Gafgyt.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
176.244.144.33	unknown	Italy	30722	VODAFONE-IT-ASNIT	false
85.195.212.32	unknown	Switzerland	13030	INIT7CH	false
74.90.141.126	unknown	United States	6128	CABLE-NET-1US	false
17.141.185.26	unknown	United States	714	APPLE-ENGINEERINGUS	false
181.92.117.26	unknown	Argentina	7303	TelecomArgentinaSAAR	false
170.233.137.213	unknown	Brazil	265079	DCHIDEROLIMEBR	false
71.190.242.136	unknown	United States	701	UUNETUS	false
106.76.184.237	unknown	India	45271	ICLNET-AS-APIdeaCellularLimitedIN	false
145.255.234.226	unknown	Russian Federation	8492	OBIT-ASOBITLtdRU	false
209.192.236.41	unknown	United States	7979	SERVERS-COMUS	false
184.105.162.30	unknown	United States	54288	SOLIDTOOLSINCUS	false
17.13.46.35	unknown	United States	714	APPLE-ENGINEERINGUS	false
171.98.35.250	unknown	Thailand	17552	TRUE-AS-APTrueInternetCoLtdTH	false
223.205.164.187	unknown	Thailand	45758	TRIPLETNET-AS-APTripleTInternetTripleTBroadbandTH	false
169.146.106.158	unknown	United States	32895	MILLIKEN-COMPANY-ASN1US	false
196.105.88.222	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
37.81.26.164	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
201.108.193.178	unknown	Mexico	8151	UninetSAdeCVMX	false
176.181.100.54	unknown	France	5410	BOUYGTEL-ISPFR	false
123.200.249.193	unknown	Australia	9723	ISEEK-AS-APiseekCommunicationsPtyLtdAU	false
203.247.60.19	unknown	Korea Republic of	9775	HANNAM-ASHannamUniversityKR	false
124.172.19.10	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
118.249.166.27	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
125.30.223.26	unknown	Japan	2497	IIJInternetInitiativeJapanIncJP	false
96.84.35.60	unknown	United States	7922	COMCAST-7922US	false
96.147.147.7	unknown	United States	7922	COMCAST-7922US	false
181.244.37.87	unknown	Colombia	26611	COMCELSACO	false
175.174.185.212	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
31.197.249.222	unknown	Italy	3269	ASN-IBSNAZIT	false
82.186.26.55	unknown	Italy	3269	ASN-IBSNAZIT	false
98.238.108.22	unknown	United States	7922	COMCAST-7922US	false
83.255.159.42	unknown	Sweden	39651	COMHEM-SWEDENSE	false
187.117.120.88	unknown	Brazil	26599	TELEFONICABRASILSABR	false
63.229.53.140	unknown	United States	22904	WSITSUS	false
200.7.92.46	unknown	Trinidad and Tobago	27800	DigicelTrinidadandTobagoLtdTT	false
84.111.137.144	unknown	Israel	8551	BEZEQ-INTERNATIONAL-ASBezeqintInternetBackboneIL	false
18.205.97.124	unknown	United States	14618	AMAZON-AESUS	false
175.169.12.89	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
20.2.198.143	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
41.220.242.18	unknown	Mauritius	30844	LIQUID-ASGB	false
69.200.18.97	unknown	United States	11351	TWC-11351-NORTHEASTUS	false
5.35.98.69	unknown	Russian Federation	31514	INF-NET-ASRU	false
59.176.100.84	unknown	India	17813	MTNL-APMahanagarTelephoneNigamLimitedIN	false
130.233.36.230	unknown	Finland	15496	AaltoUniversityFI	false
173.205.231.67	unknown	United States	32953	MHCV-AS1US	false
159.129.143.179	unknown	United States	25019	SAUDINETSTC-ASSA	false
5.243.183.147	unknown	Sweden	1257	TELE2EU	false
9.227.170.27	unknown	United States	3356	LEVEL3US	false
40.2.1.32	unknown	United States	4249	LILLY-ASUS	false
186.32.36.230	unknown	Costa Rica	262197	MILLICOMCABLECOSTARICASACR	false
64.15.138.203	unknown	Canada	32613	IWEB-ASCA	false
223.96.38.145	unknown	China	24444	CMNET-V4SHANDONG-AS-APShandongMobileCommunicationCompany	false
112.234.250.92	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
112.35.67.236	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
35.37.42.19	unknown	United States	36375	UMICH-AS-5US	false
35.126.87.28	unknown	United States	237	MERIT-AS-14US	false
136.22.6.30	unknown	United States	394699	GOOGLE-ACCESS-NYCUS	false
70.135.232.1	unknown	United States	7018	ATT-INTERNET4US	false
17.34.91.208	unknown	United States	714	APPLE-ENGINEERINGUS	false
27.253.46.109	unknown	Australia	4804	MPX-ASMicroplexPTYLTDAU	false
63.159.139.209	unknown	United States	32996	AGRIBANK-STPAULUS	false
86.137.60.17	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
67.142.39.190	unknown	United States	6621	HNS-DIRECPCUS	false
27.144.44.27	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
212.60.249.120	unknown	Germany	20676	PLUSNETDE	false
162.33.209.59	unknown	United States	35893	ACPCA	false
195.210.36.154	unknown	Sweden	8473	BAHNHOFhttpwwwbahnhofnetSE	false
38.91.148.95	unknown	United States	174	COGENT-174US	false
84.41.225.205	unknown	Netherlands	8608	QINIPEspritTelecomBVNL	false
204.102.13.99	unknown	United States	2920	LACOEUS	false
114.88.15.193	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
70.202.235.4	unknown	United States	22394	CELLCOUS	false
73.106.17.236	unknown	United States	7922	COMCAST-7922US	false
82.242.157.224	unknown	France	12322	PROXADFR	false
37.50.70.255	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
222.11.126.246	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
146.207.200.196	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
62.145.206.52	unknown	Netherlands	33915	TNF-ASNL	false
195.65.98.98	unknown	Switzerland	199642	AS_ADUNO_2CH	false
150.254.155.123	unknown	Poland	9112	POZMANPOZMAN-EDUPL	false
119.14.239.252	unknown	Taiwan; Republic of China (ROC)	9416	MULTIMEDIA-AS-APHoshinMultimediaCenterIncTW	false
204.158.77.174	unknown	United States	3354	THENET-AS-3354US	false
8.167.197.133	unknown	Singapore	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
125.151.13.55	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
101.164.72.236	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
111.191.116.33	unknown	Japan	37903	EMOBILEYmobileCorporationJP	false
74.196.177.134	unknown	United States	19108	SUDDENLINK-COMMUNICATIONSUS	false
208.49.46.19	unknown	United States	19643	NETSYNUS	false
172.42.40.103	unknown	United States	21928	T-MOBILE-AS21928US	false
157.237.92.143	unknown	Norway	2119	TELENOR-NEXTELTelenorNorgeASNO	false
36.183.2.187	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
65.138.7.167	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
192.62.242.83	unknown	United States	unknown	unknown	false
161.163.3.233	unknown	United States	45101	CNNIC-WAL-MART-APWal-martChinaInvestmentCoLtdCN	false
169.108.114.81	unknown	United States	37611	AfrihostZA	false
207.196.225.17	unknown	United States	13476	MSU-BOZEMANUS	false
86.120.29.188	unknown	Romania	8708	RCS-RDS73-75DrStaicoviciRO	false
118.212.28.183	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
75.59.236.226	unknown	United States	7018	ATT-INTERNET4US	false
180.109.105.114	unknown	China	137702	CHINATELECOM-JIANGSU-NANJING-IDCNanjingJiangsuProvince	false

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	sora.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	sora.m68k.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	sora.ppc.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	sora.mips.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	sora.arm7.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	sora.x86.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	arc.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	ssi.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	sse.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INIT7CH	i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	main_arm.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_x86.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	2.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	arm5.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	x864433.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	sst.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	ssx.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	sss.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	12.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
VODAFONE-IT-ASNIT	sora.sh4.elf	Get hash	malicious	Unknown	Browse	109.119.90.189
	spc.elf	Get hash	malicious	Mirai	Browse	5.94.208.42
	6.elf	Get hash	malicious	Unknown	Browse	2.32.103.206
	3.elf	Get hash	malicious	Unknown	Browse	188.216.208.139
	miori.arm.elf	Get hash	malicious	Unknown	Browse	188.216.208.166
	miori.spc.elf	Get hash	malicious	Unknown	Browse	93.66.156.240
	momo.mips.elf	Get hash	malicious	Mirai	Browse	2.36.96.204
	z0r0.sh4.elf	Get hash	malicious	Mirai	Browse	47.53.226.117
	armv6l.elf	Get hash	malicious	Unknown	Browse	83.225.169.67
	fuckunix.x86.elf	Get hash	malicious	Mirai	Browse	91.80.53.112
CABLE-NET-1US	sora.arm7.elf	Get hash	malicious	Unknown	Browse	47.20.117.42
	sora.x86.elf	Get hash	malicious	Unknown	Browse	68.194.142.59
	miori.arm.elf	Get hash	malicious	Unknown	Browse	68.199.187.135
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	63.143.204.172
	sora.mips.elf	Get hash	malicious	Mirai	Browse	173.220.208.249
	miori.arm.elf	Get hash	malicious	Unknown	Browse	47.18.44.22
	1.elf	Get hash	malicious	Unknown	Browse	24.45.94.82
	1.elf	Get hash	malicious	Unknown	Browse	24.45.94.82
	4.elf	Get hash	malicious	Unknown	Browse	24.45.94.82
	2.elf	Get hash	malicious	Unknown	Browse	24.45.94.82
TelecomArgentinaSAAR	sora.ppc.elf	Get hash	malicious	Unknown	Browse	190.231.96.85
	3.elf	Get hash	malicious	Unknown	Browse	181.10.53.185
	miori.x86.elf	Get hash	malicious	Unknown	Browse	181.30.100.194
	miori.sh4.elf	Get hash	malicious	Unknown	Browse	181.166.21.139
	sora.ppc.elf	Get hash	malicious	Unknown	Browse	181.99.32.244
	sora.mpsl.elf	Get hash	malicious	Mirai	Browse	190.136.108.223
	m68k.elf	Get hash	malicious	Mirai	Browse	152.169.247.2
	1.elf	Get hash	malicious	Unknown	Browse	181.166.21.157
	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	200.122.108.148
	Fantazy.i686.elf	Get hash	malicious	Unknown	Browse	181.81.220.46

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.jkdjPY (deleted)

Download File

Process:	/tmp/Fantazy.spc.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	312
Entropy (8bit):	3.5567200370478314
Encrypted:	false
SSDEEP:	6:M0DF6EEcsl10Y/VUS/FYDF6EEcsq0/VBVWPj/VfKoO/VNfiY/VH:MMNIluS/FQNIR/l
MD5:	B7A45E6E5336C769A54C375EF3F1D6D3
SHA1:	3261113831C1FA502D0C836EBA6B217167CD526A
SHA-256:	E3A4391A056F742B7A5B6BBF83388FEE74A90E4861D35D903DF6105412538C54
SHA-512:	6E3C1ED2A6C23A695C5D0090FA66CB7EDF31CADBE4B041BD722C92B98F7ECE2137F953761E814FC8D9FF79144C7A869A788D0E17F7E2C4CC6F34A9F95922D4FA
Malicious:	false
Reputation:	low
Preview:	10000-24000 r-xp 00000000 fd:00 531606 /tmp/Fantazy.spc.elf.33000-34000 rw-p 00013000 fd:00 531606 /tmp/Fantazy.spc.elf.34000-35000 rw-p 00000000 00:00 0 .35000-37000 rw-p 00000000 00:00 0 .ff7fe000-ff7ff000 ---p 00000000 00:00 0 .ff7ff000-fffff000 rw-p 00000000 00:00 0 [stack].

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	5672
Entropy (8bit):	4.987280818404703
Encrypted:	false
SSDEEP:	96:DZnhexsYNKgnVmC/jkXeWOr8MarpYiEiiHGrjzJdSKc1MkrcFECJY:DZheSOKgnV7jker8lNddL0
MD5:	1485948C3CF476BE62B91A6F489E8402
SHA1:	34D9A48A3DBE1EF7D4CEC12D3EC811B4C378F5DC
SHA-256:	6F5EECD7AD65894536FBF0CE3BE46ED6D40AB190F92773F09521F6112D08E283
SHA-512:	A9BF9A10B2667AD47CE73C063BC7773086EF526AE1F323150864F0E96C9945FA1E65F69D021317803D802DEF91F67597C0FE56A350E7AB47CD3C8744E46F2D40
Malicious:	false
Reputation:	low
Preview:	Jan 9 10:23:00 galassia kernel: [ 419.329521] blocking signal 9: 6279 -> 797.Jan 9 10:23:00 galassia kernel: [ 419.710031] blocking signal 9: 6279 -> 936.Jan 9 10:23:00 galassia kernel: [ 419.747594] blocking signal 9: 6279 -> 1320.Jan 9 10:23:00 galassia kernel: [ 419.804572] blocking signal 9: 6279 -> 1334.Jan 9 10:23:00 galassia kernel: [ 419.825680] blocking signal 9: 6279 -> 1335.Jan 9 10:23:00 galassia kernel: [ 419.879422] blocking signal 9: 6279 -> 1389.Jan 9 10:23:00 galassia kernel: [ 420.087350] blocking signal 9: 6279 -> 1601.Jan 9 10:23:00 galassia kernel: [ 420.144561] blocking signal 9: 6279 -> 1809.Jan 9 10:23:00 galassia kernel: [ 420.159691] blocking signal 9: 6279 -> 1860.Jan 9 10:23:00 galassia kernel: [ 420.191546] blocking signal 9: 6279 -> 1872.Jan 9 10:23:00 galassia kernel: [ 420.264566] blocking signal 9: 6279 -> 1983.Jan 9 10:23:00 galassia kernel: [ 420.409820] blocking signal 9: 6279 -> 2048.Jan 9 10:23:00 galassia kernel: [ 420.70

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	9111
Entropy (8bit):	5.0746248407298085
Encrypted:	false
SSDEEP:	96:0ZKGRHhexsYNKgnVmC/jkceWOr8MarpYiEiiHGrjzJdSKc1MkrcFECJ3JoEuUo:0ZB/eSOKgnV7jkrr8lNddL4
MD5:	A85FD301AB800DB070770C5174A72AE7
SHA1:	C0BABEE59B5135930DFE33CD6BEFDD0CB1D9C9DA
SHA-256:	0940C0827795A30A5C1C5102C4527238D641FA3449EE69AD0305169DA9BDD799
SHA-512:	4DB98A2FE34894E88DB47457630615B2FC660007463210541772EAFA50E4577A5E2D558435410157B34A645F13B24066342D343CE92D7601BCECD07F81767630
Malicious:	false
Reputation:	low
Preview:	Jan 9 10:23:00 galassia kernel: [ 419.311387] systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Jan 9 10:23:00 galassia kernel: [ 419.311457] systemd[1]: rsyslog.service: Failed with result 'signal'..Jan 9 10:23:00 galassia kernel: [ 419.329521] blocking signal 9: 6279 -> 797.Jan 9 10:23:00 galassia kernel: [ 419.384778] systemd[1]: systemd-journal-flush.service: Succeeded..Jan 9 10:23:00 galassia kernel: [ 419.385047] systemd[1]: Stopped Flush Journal to Persistent Storage..Jan 9 10:23:00 galassia kernel: [ 419.385166] systemd[1]: Stopped Journal Service..Jan 9 10:23:00 galassia kernel: [ 419.386219] systemd[1]: Starting Journal Service....Jan 9 10:23:00 galassia kernel: [ 419.659097] systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 1..Jan 9 10:23:00 galassia kernel: [ 419.659122] systemd[1]: Stopped System Logging Service..Jan 9 10:23:00 galassia kernel: [ 419.660064] systemd[1]: Starting System Logging Service..

Source: global traffic	TCP traffic: 192.168.2.23:49184 -> 41.216.189.127:63645
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 87.16.97.193:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 162.161.151.28:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 190.156.149.175:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 169.111.196.162:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 35.126.87.28:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 106.76.184.237:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 201.133.152.27:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 201.94.172.21:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 217.52.191.72:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 69.200.18.97:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 184.31.82.46:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 73.95.72.162:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 109.184.82.173:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 46.199.114.253:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 121.211.68.194:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 73.50.58.110:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 136.98.85.15:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 207.196.225.17:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 120.120.215.147:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 204.67.54.221:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 223.205.164.187:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 118.212.28.183:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 69.140.233.249:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 135.174.140.191:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 222.11.126.246:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 175.174.185.212:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 95.255.198.104:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 157.39.10.2:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 63.141.165.33:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 120.33.29.106:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 188.162.48.219:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 149.29.114.236:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 216.6.122.132:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 174.62.219.142:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 120.110.126.95:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 59.87.221.88:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 179.146.13.6:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 119.160.172.197:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 47.240.144.221:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 169.115.20.247:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 125.30.223.26:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 24.184.27.26:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 5.252.245.100:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 40.171.100.92:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 101.164.87.24:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 75.59.236.226:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 79.144.19.76:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 169.232.168.192:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 71.190.242.136:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 24.90.118.11:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 105.98.25.81:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 20.151.229.116:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 124.172.19.10:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 86.120.29.188:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 37.50.70.255:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 138.9.147.183:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 161.35.181.150:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 151.211.12.22:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 118.197.135.124:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 185.242.164.253:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 154.54.255.100:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 117.240.101.116:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 100.19.117.114:2323
Source: global traffic	TCP traffic: 192.168.2.23:9998 -> 196.105.88.222:2323

File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.133924986974971
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Fantazy.spc.elf
File size:	79'640 bytes
MD5:	05384cc06243dbf631c6053f05231f98
SHA1:	a583e47f07ddd5407d2d36cc7777af17a13ec7f8
SHA256:	7a55e92aa4e32797f50100c28d18501d5c4c85166d7ebdc7c2a6f921e4ce362e
SHA512:	398a05508a63dfe1ac73af4b61a21041b0d610a3b9ea651169a771cdc0c38b13053e7030dbaf0f9a187540fdb11c57e3c9b1ef6b698835776c019f6696eb3ef2
SSDEEP:	1536:jeHRbSR2YQTaL6lJfSF6ZoIk4ct9c8weleYPkAVFDB4wz:MReR7LM6RjcfoPnB4wz
TLSH:	8D732814E97D2E2BC0D8A27E12F7CA16F2E5360E10B0862D7D350F8EFB54790A5467B6
File Content Preview:	.ELF...........................4..5......4. ...(......................3...3...............3...3...3....4............dt.Q................................@..(....@.G.................#.....aH..`.....!.....#,..@.....".........`......$#,..#,..@...........`....

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	Sparc
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x101a4
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	79240
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10094	0x94	0x1c	0x0	0x6	AX	4
.text	PROGBITS	0x100b0	0xb0	0x11e74	0x0	0x6	AX	4
.fini	PROGBITS	0x21f24	0x11f24	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x21f38	0x11f38	0x13d8	0x0	0x2	A	8
.ctors	PROGBITS	0x33314	0x13314	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x3331c	0x1331c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x33328	0x13328	0x220	0x0	0x3	WA	8
.bss	NOBITS	0x33548	0x13548	0x558	0x0	0x3	WA	8
.shstrtab	STRTAB	0x0	0x13548	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0x13310	0x13310	6.1534	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x13314	0x33314	0x33314	0x234	0x78c	2.9495	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 17:23:04.747884035 CET	36741	53	192.168.2.23	1.1.1.1
Jan 9, 2025 17:23:04.747932911 CET	51321	53	192.168.2.23	1.1.1.1
Jan 9, 2025 17:23:04.754678965 CET	53	51321	1.1.1.1	192.168.2.23
Jan 9, 2025 17:23:04.755439997 CET	53	36741	1.1.1.1	192.168.2.23
Jan 9, 2025 17:23:05.223081112 CET	41902	53	192.168.2.23	1.1.1.1
Jan 9, 2025 17:23:05.230521917 CET	53	41902	1.1.1.1	192.168.2.23

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 9, 2025 17:23:04.679259062 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Jan 9, 2025 17:24:24.695338011 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2025-01-09 16:23:07 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2025-01-09 16:23:07 UTC	25	IN	HTTP/1.1 100 Continue
2025-01-09 16:23:07 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2025-01-09 16:23:07 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2025-01-09 16:23:07 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2025-01-09 16:23:07 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2025-01-09 16:23:07 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2025-01-09 16:23:07 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2025-01-09 16:23:07 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2025-01-09 16:23:07 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2025-01-09 16:23:07 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2025-01-09 16:23:07 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2025-01-09 16:23:08 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Thu, 09 Jan 2025 16:23:07 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	16:22:52
Start date (UTC):	09/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	16:22:57
Start date (UTC):	09/01/2025
Path:	/tmp/Fantazy.spc.elf
Arguments:	/tmp/Fantazy.spc.elf
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Start time (UTC):	16:22:58
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:22:59
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:23:01
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:23:02
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:23:03
Start date (UTC):	09/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	16:23:04
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:23:05
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:23:07
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:23:08
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:23:09
Start date (UTC):	09/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Fantazy.spc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.jkdjPY (deleted)

/var/lib/ubuntu-drivers-common/last_gfx_boot

/var/log/gpu-manager.log

/var/log/kern.log

/var/log/syslog

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

System Behavior

Analysis Process: dash PID: 6240, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6240, Parent PID: 4331

General

Chronological Activities

Analysis Process: dash PID: 6241, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6241, Parent PID: 4331

General

Chronological Activities

Analysis Process: Fantazy.spc.elf PID: 6271, Parent PID: 6172

Linux Analysis Report
Fantazy.spc.elf

Start time (UTC):	16:23:11
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:23:24
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:23:25
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:23:27
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre