Edit tour

Linux Analysis Report
Fantazy.mpsl.elf

Overview

General Information

Sample name:	Fantazy.mpsl.elf
Analysis ID:	1586859
MD5:	f6cadb9b9681f7d75b590b47bc3525c5
SHA1:	48cffb19556c98c26facdca3b2ad65d2fa080e35
SHA256:	2aa67052ab69866887e288d3d5c1b95cb7ff5cafd71a0ed91e38cdfdeb9ef55e
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1586859
Start date and time:	2025-01-09 17:32:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Fantazy.mpsl.elf
Detection:	MAL
Classification:	mal60.spre.troj.linELF@0/42@3/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing network information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Fantazy.mpsl.elf

Runtime Messages

Command:	/tmp/Fantazy.mpsl.elf
PID:	6223
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	VegaSec-KATANA001
Standard Error:

Process Tree

system is lnxubuntu20

Fantazy.mpsl.elf (PID: 6223, Parent: 6138, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/Fantazy.mpsl.elf

Fantazy.mpsl.elf New Fork (PID: 6225, Parent: 6223)

Fantazy.mpsl.elf New Fork (PID: 6226, Parent: 6223)

Fantazy.mpsl.elf New Fork (PID: 6229, Parent: 6226)

Fantazy.mpsl.elf New Fork (PID: 6230, Parent: 6226)

Fantazy.mpsl.elf New Fork (PID: 6231, Parent: 6226)

systemd New Fork (PID: 6241, Parent: 1)

journalctl (PID: 6241, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6256, Parent: 1)

systemd-journald (PID: 6256, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6258, Parent: 1)

journalctl (PID: 6258, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6325, Parent: 1)

dbus-daemon (PID: 6325, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6326, Parent: 1860)

pulseaudio (PID: 6326, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6329, Parent: 1)

rtkit-daemon (PID: 6329, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6332, Parent: 1)

systemd-logind (PID: 6332, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6394, Parent: 1)

polkitd (PID: 6394, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6399, Parent: 1)

agetty (PID: 6399, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 6400, Parent: 1320)

Default (PID: 6400, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6401, Parent: 1320)

Default (PID: 6401, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6402, Parent: 1320)

Default (PID: 6402, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6405, Parent: 1)

rsyslogd (PID: 6405, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6409, Parent: 1)

gpu-manager (PID: 6409, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6410, Parent: 6409)

sh (PID: 6410, Parent: 6409, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6411, Parent: 6410)

grep (PID: 6411, Parent: 6410, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6412, Parent: 6409)

sh (PID: 6412, Parent: 6409, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6413, Parent: 6412)

grep (PID: 6413, Parent: 6412, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6414, Parent: 6409)

sh (PID: 6414, Parent: 6409, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6415, Parent: 6414)

grep (PID: 6415, Parent: 6414, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6417, Parent: 6409)

sh (PID: 6417, Parent: 6409, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6418, Parent: 6417)

grep (PID: 6418, Parent: 6417, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6419, Parent: 6409)

sh (PID: 6419, Parent: 6409, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6420, Parent: 6419)

grep (PID: 6420, Parent: 6419, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6421, Parent: 6409)

sh (PID: 6421, Parent: 6409, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6422, Parent: 6421)

grep (PID: 6422, Parent: 6421, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6425, Parent: 6409)

sh (PID: 6425, Parent: 6409, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6426, Parent: 6425)

grep (PID: 6426, Parent: 6425, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6427, Parent: 6409)

sh (PID: 6427, Parent: 6409, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6428, Parent: 6427)

grep (PID: 6428, Parent: 6427, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6429, Parent: 1)

generate-config (PID: 6429, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6432, Parent: 6429)

pkill (PID: 6432, Parent: 6429, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6433, Parent: 1)

gdm-wait-for-drm (PID: 6433, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6438, Parent: 1)

gdm3 (PID: 6438, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6443, Parent: 6438)

plymouth (PID: 6443, Parent: 6438, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6462, Parent: 6438)

gdm-session-worker (PID: 6462, Parent: 6438, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6466, Parent: 6462)

gdm-wayland-session (PID: 6466, Parent: 6462, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6468, Parent: 6466)

dbus-daemon (PID: 6468, Parent: 6466, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6470, Parent: 6468)

dbus-daemon New Fork (PID: 6471, Parent: 6470)

false (PID: 6471, Parent: 6470, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6472, Parent: 6466)

dbus-run-session (PID: 6472, Parent: 6466, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6473, Parent: 6472)

dbus-daemon (PID: 6473, Parent: 6472, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6474, Parent: 6438)

Default (PID: 6474, Parent: 6438, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6475, Parent: 6438)

Default (PID: 6475, Parent: 6438, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6444, Parent: 1)

accounts-daemon (PID: 6444, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6455, Parent: 6444)

language-validate (PID: 6455, Parent: 6444, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6456, Parent: 6455)

language-options (PID: 6456, Parent: 6455, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6457, Parent: 6456)

sh (PID: 6457, Parent: 6456, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6458, Parent: 6457)

locale (PID: 6458, Parent: 6457, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6459, Parent: 6457)

grep (PID: 6459, Parent: 6457, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

gvfsd-fuse New Fork (PID: 6487, Parent: 2038)

fusermount (PID: 6487, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6529, Parent: 1860)

dbus-daemon (PID: 6529, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6405)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /tmp/Fantazy.mpsl.elf (PID: 6223)	Socket: 127.0.0.1:59025	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6438)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6468)	Socket: unknown address family	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 44.27.12.177
Source: unknown	TCP traffic detected without corresponding DNS query: 222.138.50.73
Source: unknown	TCP traffic detected without corresponding DNS query: 135.18.135.124
Source: unknown	TCP traffic detected without corresponding DNS query: 77.12.234.119
Source: unknown	TCP traffic detected without corresponding DNS query: 184.133.208.0
Source: unknown	TCP traffic detected without corresponding DNS query: 79.12.121.124
Source: unknown	TCP traffic detected without corresponding DNS query: 203.146.125.53
Source: unknown	TCP traffic detected without corresponding DNS query: 62.152.197.68
Source: unknown	TCP traffic detected without corresponding DNS query: 71.187.248.23
Source: unknown	TCP traffic detected without corresponding DNS query: 172.122.79.199
Source: unknown	TCP traffic detected without corresponding DNS query: 5.226.99.41
Source: unknown	TCP traffic detected without corresponding DNS query: 125.244.132.30
Source: unknown	TCP traffic detected without corresponding DNS query: 107.86.48.218
Source: unknown	TCP traffic detected without corresponding DNS query: 35.71.34.200
Source: unknown	TCP traffic detected without corresponding DNS query: 60.153.197.18
Source: unknown	TCP traffic detected without corresponding DNS query: 165.126.5.80
Source: unknown	TCP traffic detected without corresponding DNS query: 62.101.195.95
Source: unknown	TCP traffic detected without corresponding DNS query: 218.196.193.248
Source: unknown	TCP traffic detected without corresponding DNS query: 111.164.252.203
Source: unknown	TCP traffic detected without corresponding DNS query: 155.127.192.79
Source: unknown	TCP traffic detected without corresponding DNS query: 145.242.184.102
Source: unknown	TCP traffic detected without corresponding DNS query: 47.167.146.64
Source: unknown	TCP traffic detected without corresponding DNS query: 196.159.217.136
Source: unknown	TCP traffic detected without corresponding DNS query: 75.188.37.229
Source: unknown	TCP traffic detected without corresponding DNS query: 38.229.253.46
Source: unknown	TCP traffic detected without corresponding DNS query: 66.233.33.195
Source: unknown	TCP traffic detected without corresponding DNS query: 169.75.9.242
Source: unknown	TCP traffic detected without corresponding DNS query: 163.128.233.11
Source: unknown	TCP traffic detected without corresponding DNS query: 166.18.134.193
Source: unknown	TCP traffic detected without corresponding DNS query: 121.38.194.145
Source: unknown	TCP traffic detected without corresponding DNS query: 70.172.232.63
Source: unknown	TCP traffic detected without corresponding DNS query: 146.186.12.252
Source: unknown	TCP traffic detected without corresponding DNS query: 173.131.146.230
Source: unknown	TCP traffic detected without corresponding DNS query: 82.176.107.238
Source: unknown	TCP traffic detected without corresponding DNS query: 170.206.75.20
Source: unknown	TCP traffic detected without corresponding DNS query: 92.54.94.27
Source: unknown	TCP traffic detected without corresponding DNS query: 78.125.126.130
Source: unknown	TCP traffic detected without corresponding DNS query: 107.109.208.145
Source: unknown	TCP traffic detected without corresponding DNS query: 188.42.173.204
Source: unknown	TCP traffic detected without corresponding DNS query: 194.47.223.23
Source: unknown	TCP traffic detected without corresponding DNS query: 72.177.8.11
Source: unknown	TCP traffic detected without corresponding DNS query: 123.254.219.169
Source: unknown	TCP traffic detected without corresponding DNS query: 65.59.250.59
Source: unknown	TCP traffic detected without corresponding DNS query: 32.137.244.168
Source: unknown	TCP traffic detected without corresponding DNS query: 200.129.112.147
Source: unknown	TCP traffic detected without corresponding DNS query: 196.139.81.148

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.45.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53694
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53694 -> 443

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 6049, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 6199, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 6200, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 6226, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 6230, result: unknown	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 6049, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 6199, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 6200, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 6226, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	SIGKILL sent: pid: 6230, result: unknown	Jump to behavior

Source: classification engine

Classification label: mal60.spre.troj.linELF@0/42@3/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6325)	File: /proc/6325/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6468)	File: /proc/6468/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6473)	File: /proc/6473/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6487)	File: /proc/6487/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6529)	File: /proc/6529/mounts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:75683YF0TOg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:756846r4VTd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:77103evb6dg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:77115jMUKfh	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:77121mfYNDd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:76209zpQZ1d	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:76210eqkRAg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:77401TQaGih	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:77537X31nye	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:77704S2XyEh	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:77807ZqykTe	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:77810reIlDd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:789845GOzqg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:79100KfqV2g	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:79125QtDcHf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:79126ZLJalg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:79144yYHZtg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:79146c70pSf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:79741iLPVQe	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6332)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6332)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6332)	File: /run/systemd/seats/.#seat0np9HT0	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6332)	File: /run/systemd/users/.#127R1zmuZ	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6332)	File: /run/systemd/users/.#127mCtJyY	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6332)	File: /run/systemd/seats/.#seat0ZPJUEX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6332)	File: /run/systemd/users/.#127vdjxB1	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6332)	File: /run/systemd/users/.#127TCH5CX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6332)	File: /run/systemd/users/.#127xsk1jY	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6394)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6466)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6444)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6444)	Directory: /root/.cache	Jump to behavior

Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/6199/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/1582/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/2033/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/3088/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/1579/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/1335/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/1334/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/1576/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/2302/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/910/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/4444/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/4445/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/6226/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/912/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/4446/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/517/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/759/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/2307/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/918/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/1594/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/2285/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/2281/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/1349/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/761/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/884/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/2038/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/1344/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/1465/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/1586/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/1860/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/1463/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/800/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/801/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/4470/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/4476/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/3021/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/2294/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/491/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/772/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/1599/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/774/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/1477/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/654/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/896/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/1476/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/1872/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/2048/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/655/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/1475/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/2289/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/777/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/656/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/657/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/658/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/4467/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/419/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/936/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/2208/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/2180/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/1494/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/1886/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/420/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/1489/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/785/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/788/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/667/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/789/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/670/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/2746/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/793/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/674/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/1532/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/796/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/675/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/797/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/676/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/677/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/799/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/2749/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/6200/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/6049/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/6162/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/1389/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/840/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/720/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/721/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/847/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/6171/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/2009/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/2128/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/2761/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/2882/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/4443/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/1601/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/2018/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/2014/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/1320/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/904/maps	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6230)	File opened: /proc/1207/maps	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6394/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6394/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6394/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6394/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6394/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6394/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6394/cgroup	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6410)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6412)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6414)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6417)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6419)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6421)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6425)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6427)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6457)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Source: /bin/sh (PID: 6411)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6413)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6415)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6418)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6420)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6422)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6426)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6428)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6459)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6432)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6256)

Reads from proc file: /proc/meminfo

Jump to behavior

Source: /sbin/agetty (PID: 6399)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6438)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6438)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6444)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6444)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6405)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6405)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 6409)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 6409)

Truncated file: /var/log/gpu-manager.log

Jump to behavior

Source: /usr/bin/pulseaudio (PID: 6326)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /tmp/Fantazy.mpsl.elf (PID: 6223)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6326)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6399)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6405)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6409)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6462)	Queries kernel information via 'uname':	Jump to behavior

Source: syslog.45.dr	Binary or memory string: Jan 9 10:33:40 galassia kernel: [ 462.602290] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: Fantazy.mpsl.elf, 6223.1.00005624d195d000.00005624d19e4000.rw-.sdmp, Fantazy.mpsl.elf, 6225.1.00005624d195d000.00005624d19e4000.rw-.sdmp, Fantazy.mpsl.elf, 6226.1.00005624d195d000.00005624d19e4000.rw-.sdmp, Fantazy.mpsl.elf, 6229.1.00005624d195d000.00005624d19e4000.rw-.sdmp, Fantazy.mpsl.elf, 6230.1.00005624d195d000.00005624d19e4000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mipsel
Source: Fantazy.mpsl.elf, 6230.1.00007fff5fce2000.00007fff5fd03000.rw-.sdmp	Binary or memory string: $V/tmp/qemu-open.7mSfSg
Source: Fantazy.mpsl.elf, 6223.1.00005624d195d000.00005624d19e4000.rw-.sdmp, Fantazy.mpsl.elf, 6225.1.00005624d195d000.00005624d19e4000.rw-.sdmp, Fantazy.mpsl.elf, 6226.1.00005624d195d000.00005624d19e4000.rw-.sdmp, Fantazy.mpsl.elf, 6229.1.00005624d195d000.00005624d19e4000.rw-.sdmp, Fantazy.mpsl.elf, 6230.1.00005624d195d000.00005624d19e4000.rw-.sdmp	Binary or memory string: $V!/etc/qemu-binfmt/mipsel
Source: Fantazy.mpsl.elf, 6230.1.00007fff5fce2000.00007fff5fd03000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.7mSfSg
Source: Fantazy.mpsl.elf, 6223.1.00007fff5fce2000.00007fff5fd03000.rw-.sdmp, Fantazy.mpsl.elf, 6225.1.00007fff5fce2000.00007fff5fd03000.rw-.sdmp, Fantazy.mpsl.elf, 6226.1.00007fff5fce2000.00007fff5fd03000.rw-.sdmp, Fantazy.mpsl.elf, 6229.1.00007fff5fce2000.00007fff5fd03000.rw-.sdmp, Fantazy.mpsl.elf, 6230.1.00007fff5fce2000.00007fff5fd03000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mipsel
Source: Fantazy.mpsl.elf, 6223.1.00007fff5fce2000.00007fff5fd03000.rw-.sdmp, Fantazy.mpsl.elf, 6225.1.00007fff5fce2000.00007fff5fd03000.rw-.sdmp, Fantazy.mpsl.elf, 6226.1.00007fff5fce2000.00007fff5fd03000.rw-.sdmp, Fantazy.mpsl.elf, 6229.1.00007fff5fce2000.00007fff5fd03000.rw-.sdmp, Fantazy.mpsl.elf, 6230.1.00007fff5fce2000.00007fff5fd03000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/Fantazy.mpsl.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Fantazy.mpsl.elf
Source: syslog.45.dr	Binary or memory string: Jan 9 10:33:40 galassia kernel: [ 462.602318] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6444)

Logged in records file read: /var/log/wtmp

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Fantazy.mpsl.elf	100%	Avira	EXP/ELF.Gafgyt.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.45.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
114.69.8.69	unknown	Japan	2519	VECTANTARTERIANetworksCorporationJP	false
106.114.100.217	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
98.184.42.226	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
83.251.13.109	unknown	Sweden	39651	COMHEM-SWEDENSE	false
75.57.160.132	unknown	United States	7018	ATT-INTERNET4US	false
198.75.140.28	unknown	United States	35350	AS_SCHWARZ_PHARMA_AGAlfred-Nobel-Str10DE	false
164.82.197.132	unknown	United States	134984	NEXTGEN-AS-APNextGenNetPtyLtdAU	false
152.109.123.91	unknown	South Africa	30844	LIQUID-ASGB	false
40.47.32.103	unknown	United States	4249	LILLY-ASUS	false
4.7.189.25	unknown	United States	3356	LEVEL3US	false
91.17.47.68	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
91.45.165.246	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
133.241.188.95	unknown	Japan	7687	D-CRUISENETTOYOTADIGITALCRUISEINCORPORATEDJP	false
41.192.59.102	unknown	South Africa	29975	VODACOM-ZA	false
175.133.85.88	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
106.16.48.96	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
196.232.117.198	unknown	Tunisia	37492	ORANGE-TN	false
80.197.28.183	unknown	Denmark	3292	TDCTDCASDK	false
14.3.121.251	unknown	Japan	4685	ASAHI-NETAsahiNetJP	false
103.4.224.171	unknown	China	131342	TECHCOMBANK-AS-VNVietnamTechnologicalandCommercialJoint	false
204.152.185.9	unknown	United States	1280	ISC-AS-1280US	false
79.81.225.56	unknown	France	15557	LDCOMNETFR	false
160.65.124.48	unknown	United States	715	WOODYNET-2US	false
112.123.89.27	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
206.225.62.241	unknown	United States	7905	SOONER-ASUS	false
207.100.156.213	unknown	United States	6079	RCN-ASUS	false
89.207.139.93	unknown	United Kingdom	35670	IDE-GROUP-MANAGEGB	false
51.1.199.175	unknown	United Kingdom	2686	ATGS-MMD-ASUS	false
70.67.61.215	unknown	Canada	6327	SHAWCA	false
192.197.220.81	unknown	United States	40953	RCW-ASN-01US	false
208.112.105.226	unknown	United States	20021	LNH-INCUS	false
201.53.53.78	unknown	Brazil	28573	CLAROSABR	false
197.59.45.153	unknown	Egypt	8452	TE-ASTE-ASEG	false
12.89.103.172	unknown	United States	7018	ATT-INTERNET4US	false
87.206.152.96	unknown	Poland	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
4.187.145.128	unknown	United States	3356	LEVEL3US	false
83.109.164.174	unknown	Norway	2119	TELENOR-NEXTELTelenorNorgeASNO	false
86.156.138.130	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
182.54.69.185	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
164.148.134.186	unknown	South Africa	37130	SITA-ASZA	false
218.83.9.40	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
65.206.241.182	unknown	United States	46578	AS46578US	false
53.161.95.201	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
211.22.121.6	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
89.73.32.112	unknown	Poland	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
108.149.236.126	unknown	United States	16509	AMAZON-02US	false
157.112.100.92	unknown	Japan	58793	NIFCLOUD-NETFUJITSUCLOUDTECHNOLOGIESLIMITEDJP	false
155.177.236.117	unknown	United States	36590	EMERSON-ELECTRICUS	false
220.78.227.93	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
66.61.19.208	unknown	United States	10796	TWC-10796-MIDWESTUS	false
69.141.120.1	unknown	United States	7922	COMCAST-7922US	false
221.134.189.38	unknown	India	9583	SIFY-AS-INSifyLimitedIN	false
160.174.249.201	unknown	Morocco	6713	IAM-ASMA	false
112.203.56.216	unknown	Philippines	9299	IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH	false
114.249.9.31	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
199.93.3.128	unknown	United States	3356	LEVEL3US	false
89.27.111.213	unknown	Finland	16086	DNAFI	false
139.9.88.41	unknown	China	55990	HWCSNETHuaweiCloudServicedatacenterCN	false
142.123.9.213	unknown	Canada	577	BACOMCA	false
121.195.89.154	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
98.229.145.62	unknown	United States	7922	COMCAST-7922US	false
147.7.21.12	unknown	Hungary	9760	KTISKoreaTelecomKR	false
199.15.84.136	unknown	Canada	21775	AS-AFILIAS-REGISTRY-SERVICESCA	false
19.225.217.130	unknown	United States	3	MIT-GATEWAYSUS	false
97.88.151.56	unknown	United States	20115	CHARTER-20115US	false
75.34.143.25	unknown	United States	7018	ATT-INTERNET4US	false
196.142.113.132	unknown	Egypt	36935	Vodafone-EG	false
35.126.90.136	unknown	United States	237	MERIT-AS-14US	false
44.40.164.150	unknown	United States	20473	AS-CHOOPAUS	false
71.161.252.155	unknown	United States	701	UUNETUS	false
97.97.177.85	unknown	United States	33363	BHN-33363US	false
154.27.244.93	unknown	United States	32708	ROOTNETWORKSUS	false
146.217.84.169	unknown	United States	20478	GENMILLSUS	false
67.9.214.185	unknown	United States	33363	BHN-33363US	false
123.230.133.238	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
72.16.23.117	unknown	United States	7029	WINDSTREAMUS	false
188.110.169.89	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
59.13.113.213	unknown	Korea Republic of	23566	HUNGKUK-AS-KRHungKukLifeInsuranceKR	false
93.174.131.3	unknown	Russian Federation	47478	MSTN-ASRU	false
87.191.19.22	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
9.161.141.122	unknown	United States	3356	LEVEL3US	false
80.146.198.224	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
163.144.117.10	unknown	Japan	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
71.126.234.71	unknown	United States	701	UUNETUS	false
73.142.10.37	unknown	United States	7922	COMCAST-7922US	false
172.87.79.14	unknown	United States	393951	HORTONS-TVUS	false
87.89.142.125	unknown	France	5410	BOUYGTEL-ISPFR	false
90.69.0.186	unknown	France	12479	UNI2-ASES	false
73.123.188.204	unknown	United States	7922	COMCAST-7922US	false
155.255.155.158	unknown	unknown	394387	VUUUS	false
194.6.7.80	unknown	United Kingdom	1273	CWVodafoneGroupPLCEU	false
87.177.215.175	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
179.175.10.223	unknown	Brazil	27699	TELEFONICABRASILSABR	false
62.220.111.67	unknown	Iran (ISLAMIC Republic Of)	206862	MMRIR	false
43.33.111.205	unknown	Japan	4249	LILLY-ASUS	false
44.119.199.82	unknown	United States	7377	UCSDUS	false
62.17.3.119	unknown	Ireland	702	UUNETUS	false
174.31.204.179	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
95.97.134.215	unknown	Netherlands	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
117.180.222.96	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
80.197.28.183	LhypGRxeG7.elf	Get hash	malicious	Unknown	Browse
80.197.28.183	a4pGACml1g	Get hash	malicious	Mirai	Browse
89.207.139.93	wNsHQb6n2t	Get hash	malicious	Mirai	Browse
40.47.32.103	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse
	TetaNsnBQ2	Get hash	malicious	Mirai	Browse
	Gc6wTRb7ya	Get hash	malicious	Mirai	Browse
91.45.165.246	9WDxWYPBQq.elf	Get hash	malicious	Mirai	Browse
41.192.59.102	ieTcCSoItM.elf	Get hash	malicious	Mirai	Browse
41.192.59.102	sV2g7LdZ71	Get hash	malicious	Gafgyt Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Fantazy.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	sora.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	sora.m68k.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	sora.ppc.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	sora.mips.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	sora.arm7.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	sora.x86.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-CXA-ALL-CCI-22773-RDCUS	sora.mpsl.elf	Get hash	malicious	Unknown	Browse	72.218.57.225
	sora.m68k.elf	Get hash	malicious	Unknown	Browse	174.75.21.113
	4.elf	Get hash	malicious	Unknown	Browse	184.190.117.31
	5.elf	Get hash	malicious	Unknown	Browse	68.107.228.78
	4.elf	Get hash	malicious	Unknown	Browse	98.189.185.18
	miori.arm.elf	Get hash	malicious	Unknown	Browse	72.215.113.60
	miori.arm5.elf	Get hash	malicious	Unknown	Browse	68.225.124.40
	sora.ppc.elf	Get hash	malicious	Unknown	Browse	184.183.128.17
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	174.66.243.163
	miori.sh4.elf	Get hash	malicious	Unknown	Browse	70.189.44.92
VECTANTARTERIANetworksCorporationJP	sora.ppc.elf	Get hash	malicious	Unknown	Browse	36.2.53.46
	3.elf	Get hash	malicious	Unknown	Browse	157.250.82.1
	5.elf	Get hash	malicious	Unknown	Browse	27.121.163.236
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	220.158.26.99
	6.elf	Get hash	malicious	Unknown	Browse	157.250.121.33
	6.elf	Get hash	malicious	Unknown	Browse	157.14.200.99
	1.elf	Get hash	malicious	Unknown	Browse	157.14.236.68
	4.elf	Get hash	malicious	Unknown	Browse	157.14.200.93
	1.elf	Get hash	malicious	Unknown	Browse	157.250.133.21
	fuckunix.mpsl.elf	Get hash	malicious	Mirai	Browse	124.110.133.244
COMHEM-SWEDENSE	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	83.255.159.42
	sora.sh4.elf	Get hash	malicious	Unknown	Browse	188.151.150.105
	sora.x86.elf	Get hash	malicious	Unknown	Browse	188.151.101.84
	6.elf	Get hash	malicious	Unknown	Browse	90.133.141.74
	miori.sh4.elf	Get hash	malicious	Unknown	Browse	188.151.174.16
	miori.x86.elf	Get hash	malicious	Unknown	Browse	83.252.39.166
	momo.mpsl.elf	Get hash	malicious	Mirai	Browse	80.216.0.45
	z0r0.m68k.elf	Get hash	malicious	Mirai	Browse	188.149.22.108
	4.elf	Get hash	malicious	Unknown	Browse	83.191.49.150
	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	83.250.34.148
CHINANET-BACKBONENo31Jin-rongStreetCN	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	222.95.139.165
	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	27.144.44.27
	sora.mpsl.elf	Get hash	malicious	Unknown	Browse	218.94.23.201
	sora.m68k.elf	Get hash	malicious	Unknown	Browse	116.29.152.105
	sora.ppc.elf	Get hash	malicious	Unknown	Browse	171.222.69.230
	sora.mips.elf	Get hash	malicious	Unknown	Browse	180.140.198.101
	sora.sh4.elf	Get hash	malicious	Unknown	Browse	183.5.93.200
	sora.arm7.elf	Get hash	malicious	Unknown	Browse	182.87.35.242
	sora.arm.elf	Get hash	malicious	Unknown	Browse	117.70.195.132
	sora.x86.elf	Get hash	malicious	Unknown	Browse	223.215.188.192

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/6471/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Gn:G
MD5:	22531F93A726E95D55BDED84CD850CBE
SHA1:	61D6AE2C76338BFD9441B5D241FB45C54CA4F89B
SHA-256:	137B75277977D1EB9015A2A89300A93442F36B1433B9A69BE7977274D5FD0CDA
SHA-512:	0058BB6B420980CACC754F12588DC37D6ECF6CD7D7A6AB9198F5C02FDEC34CB908358ACA05DBF9168C1289367375FDDC8E474A0C8626795E3F30412A0284C212
Malicious:	false
Reputation:	low
Preview:	6438.

/run/systemd/journal/streams/.#9:75683YF0TOg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.515630799235401
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzGAAEdSWX6tnfMqjq:SbFuFyLVIg1BG+f+MvstfMqji4s
MD5:	DA27955DA678B56198C815E30FD51CC3
SHA1:	3F6A2CFCDC32D7300739560817620073072BD7A5
SHA-256:	EE76F263743CBCFF5232D308C62FF7ACD3CCAC0877E1CDBD91371F09A9072D3D
SHA-512:	8B214DC6358068350D9D037C56F8E4E75C184BBEC063BD385820260E1059224E1DD4D0BD1B08EA0D4833923F5695A695991B296AA48446B91F3ED68FED3BD1CC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9032eea87335497696d6874a03d7f867.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:756846r4VTd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.492745583774593
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/mX25HjRdyXB5xsjq:SbFuFyLVIg1BG+f+M+XMjRd0nqji4s
MD5:	8CF75792F4D743B8E298455235053DC9
SHA1:	4B85C89096EC9CFF42C951F86A6CB79FD5F2FCAF
SHA-256:	E20E8CEA8CA662EEB0D5E6CD3BA17C996D7137D6620DF23B8A143151EC1A0335
SHA-512:	8E7885D81E18D68B90CDA9A4DBD8E2CC3788E9445BC573FD87632BE62467FB2B18E1EF131FB1C19FBB273D9553125FDA6CD1DB2B0F44DB35DDC429C4435572BE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5ef2b81029c542aeafd855480bedaac3.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76209zpQZ1d

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.406861096643433
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm94LTlPBTVfLTjsjOA:SbFuFyLVIg1BG+f+MePFPfLTjNE
MD5:	95A34FED090EE085857C3744DEB26926
SHA1:	D6363F2389C2C0D74DBE23D6B0D1AF3A3FC0EFCA
SHA-256:	78F4CB9FBC3780FF9A1D986621F43EE39427D4C3CBA80A4BAE82CE91E18C868C
SHA-512:	9FDD0ED89F68367C8D9AE346479F173BE750C6458AF7FB3006032A7E876B9A798E8DBA115A104E7B582C044C9CD5603615E3F0B033AF77799C992D843EFB03F7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7eca6b5c9e2e4710a0251602791c0395.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:76210eqkRAg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.431890579266141
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzbjXzAAiUDCHWB0sc:SbFuFyLVIg1BG+f+MAHrqjZcHcljX+
MD5:	75B7C2C3BA9D5324F24AB41BEF4D0181
SHA1:	1F50E3B31C3B0E2A7B911443E5DD66E2E4B30336
SHA-256:	777931703C1E050053C12A6BC0293714E9C0D6477F6137C6207D5E50968490C9
SHA-512:	E818B6394511C8FBB60BFBD4BF8DFFC3B9EE881A3FDC5DBC935E3E32B1CFB9C5C85BEB0FCE6ADD755FDBFA9FE318A9F1B1078124C2BB1195C50905FA8354EB2C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9b9fc99d1aaa42efaee4a1f27b3d7ef7.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:77103evb6dg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.385227876228156
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm76PRDg6XQNrqjsmNm:SbFuFyLVIg1BG+f+MKRDjQNrqjdCLKzK
MD5:	3DBF22358862A6227CED0C6C48315FFD
SHA1:	833828E8DE6B6FA045942C6351DE20B97B7F96CC
SHA-256:	F0B933073D50D9484358C735CE4278E7718B6A0DACF5959BFEEAA335F8B9851A
SHA-512:	CE25A0D262EB4DF83B75DE531E2C907251E5426A0B4C3D6D22C3631E7969C06300494F888C6A3C1F4F4CF788E4E9B4CAC967BABE02DBD6D91F772A134729CAF2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=13722b17ec164c7cb27c1f81fc66bb25.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:77115jMUKfh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.4521172715170545
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmp2OhESEVDkUcxSN2d:SbFuFyLVIg1BG+f+M5OSEVDeq2josQu
MD5:	8A77D2460E1215D2FAB5B2CDDFA86016
SHA1:	BC081B6CBA393B2BABFD0DDB4671F5A289ADB7A8
SHA-256:	67A000CD30ECC00B2D1187B58905EB5A39FB9F5E0172E84EAE414A4E11C13240
SHA-512:	A92BC0BA0D010C8DB2CA08F7C6A66371ED6069ECECCB2EA8D2BB10B4DDBC6B6B71786968C0B3058A462CB76D2475275A3543AAB67F47CFDCC057C5332A985C4A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cb26c851615c4444ab887a0f7219db85.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:77121mfYNDd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.333886424037642
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6EETl48bJjXB5qjsO:SbFuFyLVIg1BG+f+M6t9jXB0jtWL0
MD5:	DB9C19E50AECD37F9B5626F9CA7CF2B1
SHA1:	356397941D4E04BD8F89AF92FE860E6873C77129
SHA-256:	6475E5DBE2568469C9929D85803A249B3C1F1F2C33BE5F133DDB6224A1F449CE
SHA-512:	844B86BEB1A191E45FC45EB40A74B29AD52617D8FF3D8F943246B2BDE5EFF0392F7887DCBD9267FB94895A2726ACC7F52230BA1CAD177D68F08770AD524BC180
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=03ae5a1a9f28473e8dacc8a7bb15d02d.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:77401TQaGih

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.392449048008336
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvGXdk1nJQRTO02ls4:SbFuFyLVIg1BG+f+MuXInJ6O0jbVC
MD5:	75756D6412833205076CAD3BD635A0B3
SHA1:	1233F4FB67DF17A263A06B48F95A4096550B74FC
SHA-256:	0F39BBFC48714DD3E2545A114A72C8734A45E0B5F676F55A37012F66413A3919
SHA-512:	BD6B252233E279C3E1E4C7801B7866ED1D3EE6D860C0796D655446C40CF29D1D7CA2C1078910F85260AAD67F9935E3F16B15CAC22D86121BC5198530E4A5E479
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e562ab76f47b43e6b0bb4ba564546793.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:77537X31nye

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.415749585581988
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M64U2MbetdP+TjLkGq:qgFq6g10+f+MrU9tYT
MD5:	43505D3B4B8798201EE8C4119F176B82
SHA1:	8090134A195DD3391785163FCC79816A8E4051E1
SHA-256:	237D43B4CB8A50149831ADB95432DC4436464D516A3B51CC507F2625DBD37835
SHA-512:	0A5FA7948863C4FE451E2BB5DBE12C9EDBFB91A64921AB6D41F11771ADDFBFA6ADD38B8B6F09183CAB741F8498A9A21F16E93CD41A8064C3D648A4FC447E7C60
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=04011379e19b42828bb8dfba05c88d68.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:77704S2XyEh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.4413823389696665
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7Lq7TtQQVvXsjsmNu:SbFuFyLVIg1BG+f+MmzV0jdCt/rRMtq
MD5:	883321A7D827B3E53FAFA0A6B0CC9BAE
SHA1:	486F8B00C8A8B98BE64CF2CE1CE8AFD37282B01C
SHA-256:	B5C809AB8B814BE671E4BF8D7BEB136539EA1C34D4CE4F98C9CF6CE42B689D1C
SHA-512:	6FA17F6E6FF429B321A2AA99C602D8F697DBE341A61970803BC16D956279E890C98249E9418F587A5DF1868736A713BDA58603C3E9FCFA5EAC49153C3D7A3AC8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1e3f9d3e3c88487dafcfeac52db00670.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:77807ZqykTe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.452298343590185
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MCn2wGSwgDjNALyAZD:qgFq6g1af+McNw6IZD
MD5:	BA275AD58E1201EC456518CEBED791AF
SHA1:	F30D1C69D6065F59F77A9B3F14959882F82C40A7
SHA-256:	E25BED032FC7908C3CFD2A2622856CB855B33665243D82A549591D1EC7169629
SHA-512:	2304A81E4FDDD3DCB11AE66CA21060F865D4D217E11A8E5D170D089C6DCABDEE24DEF87D165B7360BDE295CFB345BD9276A5C21C4901018038BFCDEACD530341
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c720d46fd6f5438ab331cc68588f0b7c.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77810reIlDd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.46303754874821
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm/ZfQRtGMofa0js2BbQL:SbFuFyLVIg1BAf+MBfET2jNdQIeXD
MD5:	83B36D29DBCC9ABA51D965DBDD89FBD7
SHA1:	34245714F208E315DE8596BA03BAC203A29EF6C5
SHA-256:	59EC3BF837E97EA240F0970D09BAF3E1141A9FEFC293617E0DFC257B3B22CF00
SHA-512:	D53CF5E70D617B68A7DD246CCBFF27174AD010522F533AEF23E92AE2EA4309AE9A22EFD5BC38EF57DE76432DC9B319E5BAFAF875E8E4021AB8229AE0888A6C79
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=57f8afc0e54145cd896d2661401c7066.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:789845GOzqg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.424163059725833
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmpMTdCmuTRDXgzvRqjsa:SbFuFyLVIg1BAf+MipzcRLgzv8jNTZD
MD5:	52C936F03ECFA0A456798E8828857CC6
SHA1:	4EBDBDEDA6EB90A6B690144D654C46548CD71D13
SHA-256:	BC547E990535EB48F885A9E0FE1362649E4E203D32908EEAC909A9846086C49C
SHA-512:	5B1B27506D7A341087838E9256EF261D56F1760DF17634993C0C872CEC5946000827AA9DD3AD20BD3B1EB9B207ABB50A970FAB6282BF3383FF8BAB5DC2A83EF9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c6e239661ada44e78644152b5fa9f2ff.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:79100KfqV2g

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.4550843773745195
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Mzyi0eTnvjLTTIWTIL:qgFq6g10+f+Mzy0EWEL
MD5:	F27EFE83A7E3870F9A004634DD5AB11A
SHA1:	916AE8E2288220A3004CE7189F27771CB80BAA62
SHA-256:	0AE3AB24BCFDC96D4D3FCE76A6CD8C83A52B80A14D0E47FC308D426C2CBB765C
SHA-512:	9A096985BE998A08D300103BFB54067B84B3C41010B86891466569CDA0F588EFD91201F64C4EDD8679580CF9B4ABC0B696373A622DCF4DBC31F9AEEF63717A57
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3b8d141e287b4e4197f64c1751372aaf.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:79125QtDcHf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.3814471703739075
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmuDMNTdH7wsjs2BI:SbFuFyLVK6g7/+BG+f+MuoNZjNq
MD5:	A6F6D42C79845C67FA077844224DA5E4
SHA1:	2F7E2CC943DE6371DB57C9771657A0EBB2617F29
SHA-256:	E046F5F34487CA5A029FDF0D9B7470C3B813675D1DD95377EF26354B142805CE
SHA-512:	B7FBABA4077F3E8CC4E6418A9902D985F05D7158FCF8075ED27D5F04082EE7BE05E3326546E06035E678D91AB4FD3769A511778E410CAEF9ADCA9CD1523CD494
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d068e62ec2ca432883e195f824cec2ea.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:79126ZLJalg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.39084439601986
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmsZHTDGm1Q7F0Zjk:SbFuFyLVI6g7/+BG+f+Ms5PGI3jNq
MD5:	F22AB7A67D839435A48D0EA213752E55
SHA1:	1F37117D56E6CBED0F05ADE888C6F7A8C5E284F3
SHA-256:	6E023EC5F2ED1CD9C6F25E5D0CE7E511CFB37A37357867007B35ACCA9C08D555
SHA-512:	685EB0296B57D599E0ED71114ECD485FEBC436B70740EEA5248057D1491A7690F5B95E6E07BBE782A9367C1A8ED56D3440B4A19EFBB6F93F3DB17A20441832BB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f1eb6fe075644b34a6e50c77dab3d5c7.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:79144yYHZtg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.489553208948557
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+Miy2Qc3ojFQMzKaBu:qgFqo6g7/+0+f+Miy3cSTmh
MD5:	E0C104E28A2ADC0FE2371AB4C2399122
SHA1:	070510A4D2B89A0901D3C39E6DC6A430FC60DC0A
SHA-256:	E19A35F5D2943DC30C4771532FFA4482601E6F8418E680774AAB56288627BF99
SHA-512:	601EBB5F60B3C5AD43D998E81F084F1BD3760618333193679C07E5B117E9879FEF03C8B1142DDF5F918A19795396A32295F4D0762F94E59C9880C9ECD6873E97
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9dc0f5e855f9454594edc37545ddf396.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:79146c70pSf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.527049889810114
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MWdD1lGNjFQMzKaBu:qgFqdg7/+0+f+MaBlGTTmh
MD5:	7B26DA9E321320EA0E9F4268AF5D575A
SHA1:	48D0CD959F69EFC18A6CE0C464FFEE12050F52D2
SHA-256:	99B25693A86AC21C662BC2226E3FFCD2B4D2C9DD35945EC0DBD41971A5DEC8DA
SHA-512:	CA0687DAEA35D7189D905FF2A6F656D79795F345A092B350E1AD43686657E214FCDB37332B88CDAF2B6D1FDDCE62364471C3E06561BA77A76F238D9201F39361
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=35178f200130451783b266fc22a120e4.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:79741iLPVQe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.3787548718188924
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7LZTBENDnqjs1Han:SbFuFyLVIg1BG+f+MZBENDqjoa
MD5:	55CB81E6D0CDCDC2C6A2F68671C47049
SHA1:	0C022F14D32E78548095736C9D90EED6AEF9F348
SHA-256:	7592308DAC138113A1577D39FE17F0E3DC40837071BF587C9C1F46F05110B027
SHA-512:	E537C47B907D96259943DCF088A666343BC6283CAA92A3F16A99FF004A06FA7BEB1BD2731ECE629E157E655D74351BD7990CF126AFB7C0339F07CD4E5A7ADA27
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1a9d9c0f6e7247d4b83cb7330775ed9d.IDENTIFIER=dbus-daemon.

/run/systemd/seats/.#seat0ZPJUEX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0np9HT0

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/users/.#127R1zmuZ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127TCH5CX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.277723078288866
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgDxVv39zVykH206qodrTD:SbFuFyL3BVgdL87iesnAiRJgDxp39VyV
MD5:	5499487F7F6ED6025B8B487A91D5B7EC
SHA1:	69BB46BEBD44A9C4D8F1F080B65EC731DB4103E4
SHA-256:	AFD86E860B02EC5FC7743CCC5FE018C1B2BDF0B6211034969767CBCECF724E67
SHA-512:	612B2E5D8133FA0A3012798EE3F5F69CFBBB25AA0145B58DAEE045931BC7926DFF22884C3E1E01D6EB4BC3D0D2B238FD5F0F85B5F153976AC910CBE87DA21DDC
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1736440418441093.MONOTONIC=461260690.LAST_SESSION_TIMESTAMP=461314934.

/run/systemd/users/.#127mCtJyY

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.293544436915217
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gDxp39VtQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+gDDdjthQHtPYq9M
MD5:	7305E1ED8062DF499BBC9E6BD7AE86D4
SHA1:	76E9228590F8732716A3A39D2533F7CFB0C5082F
SHA-256:	2AA0A0CA4D319ABBC38303F731FFFDE74760C1D8B8CA01D1CE9CFFFA2C3E39B0
SHA-512:	D9DD3EDA45B95C37E293804F09FECAB2E65A529F49DC793B7F65FDC3A912C269E0B118573F7EB1571AD33315911D2CC774C0965448EA75F9E278A013D6CF6F9A
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1736440418441093.MONOTONIC=461260690.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127vdjxB1

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.293544436915217
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gDxp39VtQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+gDDdjthQHtPYq9M
MD5:	7305E1ED8062DF499BBC9E6BD7AE86D4
SHA1:	76E9228590F8732716A3A39D2533F7CFB0C5082F
SHA-256:	2AA0A0CA4D319ABBC38303F731FFFDE74760C1D8B8CA01D1CE9CFFFA2C3E39B0
SHA-512:	D9DD3EDA45B95C37E293804F09FECAB2E65A529F49DC793B7F65FDC3A912C269E0B118573F7EB1571AD33315911D2CC774C0965448EA75F9E278A013D6CF6F9A
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1736440418441093.MONOTONIC=461260690.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127xsk1jY

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.432241622994479
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6lgTgDxp39Vyot6FTD:qgFq30dABibB3TgDDCoIl
MD5:	621AB4504D42276CEE249DA38A3EA7CF
SHA1:	ED466DD416B90076257C353EACFC8D7360817452
SHA-256:	BEE28616B709290DECC34342490C76FB1104E2780C5D245488CD79EFAF9E9AE9
SHA-512:	702783D9D4DD42FF3A6D21872B30833D51ED5665D3AAA6D29C6975865C76DE6C10455BA5431B036C05CE8A1F1B7027AF940DF173476F7DA96A82FE797C88FF6E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12412.REALTIME=1736440418441093.MONOTONIC=461260690.LAST_SESSION_TIMESTAMP=461314934.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:cj:cj
MD5:	1A9FB42733DF63B30C9B5CB6B5E776F1
SHA1:	8E3156D63027FDF49CD5A4A5728A85D3C6295DE0
SHA-256:	F9DAB62108F0B9821BE9CCD7DFC10858979035DFD5360C0353F02587A89BC03A
SHA-512:	7578477F18E4E7450D9F3679E70D708445C0CC4FAC4CF96D75CC93278C7B00637896A68B192D0DE2D840D65938B63FB471D69EC64BED9686286FF1D73F4FF98E
Malicious:	false
Preview:	6326.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6722951801018083
Encrypted:	false
SSDEEP:	3:Ulc1sXlXEWtl/F1l:0cQ+yld1
MD5:	A45EB3CE0F0DE4C04FE08E67D190D3E0
SHA1:	EC1E14FB344A75447AF25EAF025BEEE81CDD41BC
SHA-256:	8CE3390FF7D7B1C49D50D02D5B6A1674C654EEEC21B97BBBFD4DB0F0FB523C98
SHA-512:	40B70EE4A44BCC10776C805225C680C8578D191DA9B8CF169EBC9EE996F2DBBD5F6E928C91A73B2AB7E184E58905EA34241326D4B447F3750933D3A2E5BC894B
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................L..g........................................

/tmp/qemu-open.7mSfSg (deleted)

Download File

Process:	/tmp/Fantazy.mpsl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	3.608804255899556
Encrypted:	false
SSDEEP:	6:URgcaFF6EP0gcdtSY/VUd/vYcaFF6EP0HVYHT/VtVxGdtj/VDM/V+4D/VH:I9anPktSZdHFan2aKxMfF
MD5:	308AA166207D86C7A0A00B497228F37E
SHA1:	D048AF35689233D62088D066D5BD48EF86384570
SHA-256:	B0CC0C029F50B65525A150BBC91D245605CEC9E373B97872510F5CAD5329E130
SHA-512:	959D8C4E11DAD1F7BF9B0F7854E0B426A4DFCC97372E11C8C914E73CC016377B954713FD74877D2161672B05B16EFD40E626B577C671141020D37D39F27CEF15
Malicious:	false
Preview:	400000-418000 r-xp 00000000 fd:00 531563 /tmp/Fantazy.mpsl.elf.458000-459000 rw-p 00018000 fd:00 531563 /tmp/Fantazy.mpsl.elf.459000-45a000 rw-p 00000000 00:00 0 .45a000-45c000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/var/lib/AccountsService/users/gdm.B7ZYZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	678
Entropy (8bit):	4.787450499173542
Encrypted:	false
SSDEEP:	12:gF0hLadRFrGT4p1Wr4/F0nCLGaWr4JWF0hLajOnFXwzfbZUQU:OG0pYr4sJr4orCQU
MD5:	0118615254659562151095DF5CE91E70
SHA1:	4BA78BE16EAB357571B63233127BED9B43EADDBD
SHA-256:	40BFB305B3745E2FC125412D25182E249A1D1CEECED346303147D8089A8F3CDF
SHA-512:	41851B706BB68C983EE5F664A95DFA38A353F270B0175D0357B624B2520D98D53E2954C57713EC8052C2F4A4BD3B2ABDF5F1ADA884E85807023CE56212C89615
Malicious:	false
Preview:	Jan 9 10:33:38 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Jan 9 10:33:38 galassia systemd-logind[6332]: Failed to start session scope session-c1.scope: Unit session-c1.scope already exists..Jan 9 10:33:38 galassia gdm-launch-environment]: pam_systemd(gdm-launch-environment:session): Failed to create session: Unit session-c1.scope already exists..Jan 9 10:33:40 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session closed for user gdm.Jan 9 10:33:44 galassia dbus-daemon[6325]: [system] Failed to activate service 'org.bluez': timed out (service_start_timeout=25000ms).

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.43656862359913
Encrypted:	false
SSDEEP:	3:F31Hl524ZMAabX24ZMAaj/:F3RKi
MD5:	3052B83B5A0CA37346149CB72B5CCA3C
SHA1:	CF996B7129C94722D699E192F0820E95BA173CAB
SHA-256:	AD1E73D58FD532DB3A94E06AF12E490B4B618BBB3D9867D07F092B76A60FD7B6
SHA-512:	4D919F2575C41ED6B774A714493E98452B2BB93C8151417F6B13AB8FD2D79CAE22DC0CBBA6188F57E6534120314664A5CD2A173844BCFDA8C379FCDBF743F951
Malicious:	false
Preview:	LPKSHHRH.................k.~.L..".ie]..................................k.~.L..".ie].........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31HlCsa4Y3WrEsa4Y3WR:F3S0YGrE0YG
MD5:	C255B9770A841E340746AF03B76FC644
SHA1:	22A80EE1C0A96823C9D6FD1E791A327603D9FA8F
SHA-256:	635AD2138AE5BA29D3FBDCDF8845C48EF396E8A82D0A1BB119E23A7FB4D44443
SHA-512:	FC62A744262DAF1ABB49592B749F812761C991A5D979C841A4CA3FB1DC138F4933A627A6DFB1199AEC7F82BCBFBB85461F36271428BD18F9F454D5AF375F1911
Malicious:	false
Preview:	LPKSHHRH................G..!.?A......\|..................................G..!.?A......\|..........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	10856
Entropy (8bit):	4.953720379434087
Encrypted:	false
SSDEEP:	96:5RvC9VB1sdn2OpI+kBeS1IJiWOr8MxOrMYIviN/Dfd5dSwLXGbOc8kY5y:7uM9WFBhr822NdO
MD5:	7FD328A09CA0D1032F3E218A3EAB123A
SHA1:	036FA9D6A0885C627096B55FB36827F3DEC57B97
SHA-256:	2CF08B9D81B41477D8F7E6A02F2EFA3AD9B1F2F2121ECDA9BD257349CB78A06D
SHA-512:	A23FDDC73EAD25ADD184B9931DA4940830C19189BFBA10675403730C763D7B4717FD00DD6EABB451BE064626F915E09A20B59F381F031CB1CFFA173C551BF268
Malicious:	false
Preview:	Jan 9 10:33:17 galassia kernel: [ 439.114864] Reached call limit: pid 6256, name read.Jan 9 10:33:17 galassia kernel: [ 439.931574] New task spawned: old: (tgid 6405, tid 6405), new (tgid: 6405, tid: 6406).Jan 9 10:33:17 galassia kernel: [ 439.932797] New task spawned: old: (tgid 6405, tid 6405), new (tgid: 6405, tid: 6407).Jan 9 10:33:18 galassia kernel: [ 439.939464] New task spawned: old: (tgid 6405, tid 6406), new (tgid: 6405, tid: 6408).Jan 9 10:33:18 galassia kernel: [ 441.139541] New task spawned: old: (tgid 6409, tid 6409), new (tgid: 6410, tid: 6410).Jan 9 10:33:18 galassia kernel: [ 441.146879] blocking signal 0: 6256 -> 1860.Jan 9 10:33:18 galassia kernel: [ 441.201612] New task spawned: old: (tgid 6410, tid 6410), new (tgid: 6411, tid: 6411).Jan 9 10:33:18 galassia kernel: [ 441.374027] New task spawned: old: (tgid 6409, tid 6409), new (tgid: 6412, tid: 6412).Jan 9 10:33:18 galassia kernel: [ 441.412104] New task spawned: old: (tgid 6412, tid 6412), new (t

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	32834
Entropy (8bit):	5.022431532228714
Encrypted:	false
SSDEEP:	768:rHDp56+ItreasLquE/TcYSIMhD/B1E4mP8oylbvV5KWUktxTP5lbI+C8CgM+ynr1:OXlMS
MD5:	968221799E82327D820449720E3D0E43
SHA1:	AE8B8AA45840BA9E03497319CE7FFD92D82C404B
SHA-256:	8682D48003A1117F2DE936C7D14AAA5CAD98178C4E2EF50D69BD63A687E44A9D
SHA-512:	782EE87757255ADE453F205A9D0DDE36F52275BDE962C49C3ECACC6681034D40BA6B04A915606DB661CA7159D3433472E08FE73A755686C496C8856946AA94E1
Malicious:	false
Preview:	Jan 9 10:33:16 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Jan 9 10:33:16 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Jan 9 10:33:17 galassia kernel: [ 439.114864] Reached call limit: pid 6256, name read.Jan 9 10:33:16 galassia multipathd[658]: sda: add missing path.Jan 9 10:33:16 galassia multipathd[658]: sda: failed to get udev uid: Invalid argument.Jan 9 10:33:16 galassia multipathd[658]: sda: failed to get sysfs uid: Invalid argument.Jan 9 10:33:16 galassia multipathd[658]: sda: failed to get sgio uid: No such file or directory.Jan 9 10:33:17 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 1..Jan 9 10:33:17 galassia kernel: [ 439.931574] New task spawned: old: (tgid 6405, tid 6405), new (tgid: 6405, tid: 6406).Jan 9 10:33:17 galassia systemd[1]: Stopped System Logging Service..Jan 9 10:33:17 galassia systemd[1]: Starting System Logging Service....Jan 9 10:33:17 galassia

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6722951801018083
Encrypted:	false
SSDEEP:	3:Ulc1sXlXEWtl/F1l:0cQ+yld1
MD5:	A45EB3CE0F0DE4C04FE08E67D190D3E0
SHA1:	EC1E14FB344A75447AF25EAF025BEEE81CDD41BC
SHA-256:	8CE3390FF7D7B1C49D50D02D5B6A1674C654EEEC21B97BBBFD4DB0F0FB523C98
SHA-512:	40B70EE4A44BCC10776C805225C680C8578D191DA9B8CF169EBC9EE996F2DBBD5F6E928C91A73B2AB7E184E58905EA34241326D4B447F3750933D3A2E5BC894B
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................L..g........................................

File type:	ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.506362496692027
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Fantazy.mpsl.elf
File size:	100'468 bytes
MD5:	f6cadb9b9681f7d75b590b47bc3525c5
SHA1:	48cffb19556c98c26facdca3b2ad65d2fa080e35
SHA256:	2aa67052ab69866887e288d3d5c1b95cb7ff5cafd71a0ed91e38cdfdeb9ef55e
SHA512:	2c5795b9108fa13a24fae2cc4be5d969cc9c8dd0fa8cd5d4abfcb53c3ff449b029bda920a03a99e9ce852cb57f4ea8be89a1155f8326dd9d9954b6ca937a1655
SSDEEP:	1536:277/BCaYLJcHPasWK20j+QNIxhRQmnDRZNdanoy:0LAaYeHlWK2ABaDRfy
TLSH:	29A3831ABF605EF3ECAFDC77499A2745208D141A21897B78BD70D814F64E24F19E38B1
File Content Preview:	.ELF....................`.@.4...D.......4. ...(...............@...@..z...z....................E...E.....x...........Q.td...............................<...'!......'.......................<...'!... .........9'.. ........................<...'!............f9

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	99908
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x16600	0x0	0x6	AX	16
.fini	PROGBITS	0x416720	0x16720	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x416780	0x16780	0x1340	0x0	0x2	A	16
.ctors	PROGBITS	0x458000	0x18000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x458008	0x18008	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x458014	0x18014	0x4	0x0	0x3	WA	4
.data	PROGBITS	0x458020	0x18020	0x258	0x0	0x3	WA	16
.got	PROGBITS	0x458280	0x18280	0x360	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x4585e0	0x185e0	0x20	0x0	0x10000003	WAp	4
.bss	NOBITS	0x458600	0x185e0	0x578	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x678	0x185e0	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x185e0	0x64	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x17ac0	0x17ac0	5.5662	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x18000	0x458000	0x458000	0x5e0	0xb78	4.0368	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 17:33:15.576848030 CET	192.168.2.23	8.8.8.8	0x2d5a	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 17:33:15.576888084 CET	192.168.2.23	8.8.8.8	0x14da	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Jan 9, 2025 17:33:15.788911104 CET	192.168.2.23	8.8.8.8	0xf0c3	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 17:33:15.583290100 CET	8.8.8.8	192.168.2.23	0x2d5a	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Jan 9, 2025 17:33:15.583290100 CET	8.8.8.8	192.168.2.23	0x2d5a	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2025-01-09 16:33:20 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2025-01-09 16:33:20 UTC	25	IN	HTTP/1.1 100 Continue
2025-01-09 16:33:20 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2025-01-09 16:33:20 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2025-01-09 16:33:20 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2025-01-09 16:33:20 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2025-01-09 16:33:20 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2025-01-09 16:33:20 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2025-01-09 16:33:20 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2025-01-09 16:33:20 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2025-01-09 16:33:20 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2025-01-09 16:33:20 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2025-01-09 16:33:20 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Thu, 09 Jan 2025 16:33:20 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	16:32:46
Start date (UTC):	09/01/2025
Path:	/tmp/Fantazy.mpsl.elf
Arguments:	/tmp/Fantazy.mpsl.elf
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Start time (UTC):	16:32:53
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:32:55
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:33:12
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:33:14
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:33:16
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:33:17
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:33:18
Start date (UTC):	09/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	16:33:19
Start date (UTC):	09/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	16:33:20
Start date (UTC):	09/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	16:33:21
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:33:22
Start date (UTC):	09/01/2025
Path:	/usr/share/gdm/generate-config
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	16:33:24
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Fantazy.mpsl.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6471/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:75683YF0TOg

/run/systemd/journal/streams/.#9:756846r4VTd

/run/systemd/journal/streams/.#9:76209zpQZ1d

/run/systemd/journal/streams/.#9:76210eqkRAg

/run/systemd/journal/streams/.#9:77103evb6dg

/run/systemd/journal/streams/.#9:77115jMUKfh

/run/systemd/journal/streams/.#9:77121mfYNDd

/run/systemd/journal/streams/.#9:77401TQaGih

/run/systemd/journal/streams/.#9:77537X31nye

/run/systemd/journal/streams/.#9:77704S2XyEh

/run/systemd/journal/streams/.#9:77807ZqykTe

/run/systemd/journal/streams/.#9:77810reIlDd

/run/systemd/journal/streams/.#9:789845GOzqg

/run/systemd/journal/streams/.#9:79100KfqV2g

/run/systemd/journal/streams/.#9:79125QtDcHf

/run/systemd/journal/streams/.#9:79126ZLJalg

/run/systemd/journal/streams/.#9:79144yYHZtg

/run/systemd/journal/streams/.#9:79146c70pSf

/run/systemd/journal/streams/.#9:79741iLPVQe

/run/systemd/seats/.#seat0ZPJUEX

/run/systemd/seats/.#seat0np9HT0

/run/systemd/users/.#127R1zmuZ

/run/systemd/users/.#127TCH5CX

/run/systemd/users/.#127mCtJyY

/run/systemd/users/.#127vdjxB1

/run/systemd/users/.#127xsk1jY

Linux Analysis Report
Fantazy.mpsl.elf

Start time (UTC):	16:33:35
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:33:37
Start date (UTC):	09/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	16:33:39
Start date (UTC):	09/01/2025
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	16:33:40
Start date (UTC):	09/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	16:33:56
Start date (UTC):	09/01/2025
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Start time (UTC):	16:35:26
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre