Edit tour

Linux Analysis Report
Fantazy.x86_64.elf

Overview

General Information

Sample name:	Fantazy.x86_64.elf
Analysis ID:	1586871
MD5:	b34ddc516fcce918035df6442d0e5ac6
SHA1:	e8440ad19475572f7a9bcf8824536b0affdd5d84
SHA256:	a769a12edb041a6e87ea892e47f75ff7a4dd6ba57a4ed5a8f8dcf4a9dd74b5a3
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Machine Learning detection for sample

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1586871
Start date and time:	2025-01-09 17:47:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Fantazy.x86_64.elf
Detection:	MAL
Classification:	mal72.spre.troj.linELF@0/44@3/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing network information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Fantazy.x86_64.elf

Runtime Messages

Command:	/tmp/Fantazy.x86_64.elf
PID:	6240
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	VegaSec-KATANA001
Standard Error:

Process Tree

system is lnxubuntu20

Fantazy.x86_64.elf (PID: 6240, Parent: 6152, MD5: b34ddc516fcce918035df6442d0e5ac6) Arguments: /tmp/Fantazy.x86_64.elf

Fantazy.x86_64.elf New Fork (PID: 6241, Parent: 6240)

Fantazy.x86_64.elf New Fork (PID: 6242, Parent: 6240)

Fantazy.x86_64.elf New Fork (PID: 6243, Parent: 6242)

Fantazy.x86_64.elf New Fork (PID: 6244, Parent: 6242)

Fantazy.x86_64.elf New Fork (PID: 6245, Parent: 6242)

systemd New Fork (PID: 6249, Parent: 1)

journalctl (PID: 6249, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6265, Parent: 1)

systemd-journald (PID: 6265, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6271, Parent: 1)

journalctl (PID: 6271, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6331, Parent: 1860)

pulseaudio (PID: 6331, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6332, Parent: 1)

dbus-daemon (PID: 6332, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6337, Parent: 1)

rtkit-daemon (PID: 6337, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6340, Parent: 1)

systemd-logind (PID: 6340, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6402, Parent: 1)

polkitd (PID: 6402, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6407, Parent: 1)

agetty (PID: 6407, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6408, Parent: 1)

rsyslogd (PID: 6408, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

gdm3 New Fork (PID: 6409, Parent: 1320)

Default (PID: 6409, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6410, Parent: 1320)

Default (PID: 6410, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6411, Parent: 1320)

Default (PID: 6411, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6415, Parent: 1)

gpu-manager (PID: 6415, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6416, Parent: 6415)

sh (PID: 6416, Parent: 6415, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6417, Parent: 6416)

grep (PID: 6417, Parent: 6416, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6418, Parent: 6415)

sh (PID: 6418, Parent: 6415, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6419, Parent: 6418)

grep (PID: 6419, Parent: 6418, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6420, Parent: 6415)

sh (PID: 6420, Parent: 6415, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6421, Parent: 6420)

grep (PID: 6421, Parent: 6420, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6425, Parent: 6415)

sh (PID: 6425, Parent: 6415, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6426, Parent: 6425)

grep (PID: 6426, Parent: 6425, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6427, Parent: 6415)

sh (PID: 6427, Parent: 6415, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6428, Parent: 6427)

grep (PID: 6428, Parent: 6427, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6430, Parent: 6415)

sh (PID: 6430, Parent: 6415, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6432, Parent: 6430)

grep (PID: 6432, Parent: 6430, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6433, Parent: 6415)

sh (PID: 6433, Parent: 6415, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6434, Parent: 6433)

grep (PID: 6434, Parent: 6433, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6435, Parent: 6415)

sh (PID: 6435, Parent: 6415, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6436, Parent: 6435)

grep (PID: 6436, Parent: 6435, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6437, Parent: 1)

generate-config (PID: 6437, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6438, Parent: 6437)

pkill (PID: 6438, Parent: 6437, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6441, Parent: 1)

gdm-wait-for-drm (PID: 6441, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6446, Parent: 1)

gdm3 (PID: 6446, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6450, Parent: 6446)

plymouth (PID: 6450, Parent: 6446, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6468, Parent: 6446)

gdm-session-worker (PID: 6468, Parent: 6446, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6474, Parent: 6468)

gdm-wayland-session (PID: 6474, Parent: 6468, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6476, Parent: 6474)

dbus-daemon (PID: 6476, Parent: 6474, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6478, Parent: 6476)

dbus-daemon New Fork (PID: 6479, Parent: 6478)

false (PID: 6479, Parent: 6478, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6480, Parent: 6474)

dbus-run-session (PID: 6480, Parent: 6474, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6481, Parent: 6480)

dbus-daemon (PID: 6481, Parent: 6480, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6482, Parent: 6446)

Default (PID: 6482, Parent: 6446, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6483, Parent: 6446)

Default (PID: 6483, Parent: 6446, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6452, Parent: 1)

accounts-daemon (PID: 6452, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6463, Parent: 6452)

language-validate (PID: 6463, Parent: 6452, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6464, Parent: 6463)

language-options (PID: 6464, Parent: 6463, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6465, Parent: 6464)

sh (PID: 6465, Parent: 6464, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6466, Parent: 6465)

locale (PID: 6466, Parent: 6465, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6467, Parent: 6465)

grep (PID: 6467, Parent: 6465, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

gvfsd-fuse New Fork (PID: 6495, Parent: 2038)

fusermount (PID: 6495, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6537, Parent: 1860)

dbus-daemon (PID: 6537, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Fantazy.x86_64.elf	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xdd84:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
Fantazy.x86_64.elf	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xe573:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
Fantazy.x86_64.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xd262:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xd370:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
Fantazy.x86_64.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xe133:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
Fantazy.x86_64.elf	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0xd9c2:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
Fantazy.x86_64.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xe3fe:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
Fantazy.x86_64.elf	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0xdbbb:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
Fantazy.x86_64.elf	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x242a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
Fantazy.x86_64.elf	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x84ef:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
Fantazy.x86_64.elf	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0x10594:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
Fantazy.x86_64.elf	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x252d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
Fantazy.x86_64.elf	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x5a82:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Click to see the 7 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6244.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xdd84:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6244.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xe573:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
6244.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xd262:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xd370:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6244.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xe133:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6244.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0xd9c2:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
6244.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xe3fe:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6244.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0xdbbb:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
6244.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x242a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
6244.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x84ef:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
6244.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0x10594:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
6244.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x252d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
6244.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x5a82:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
6242.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xdd84:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6242.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xe573:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
6242.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xd262:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xd370:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6242.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xe133:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6242.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0xd9c2:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
6242.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xe3fe:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6242.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0xdbbb:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
6242.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x242a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
6242.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x84ef:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
6242.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0x10594:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
6242.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x252d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
6242.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x5a82:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
6241.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xdd84:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6241.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xe573:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
6241.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xd262:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xd370:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6241.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xe133:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6241.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0xd9c2:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
6241.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xe3fe:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6241.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0xdbbb:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
6241.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x242a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
6241.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x84ef:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
6241.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0x10594:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
6241.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x252d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
6241.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x5a82:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
6240.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xdd84:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6240.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xe573:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
6240.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xd262:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xd370:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6240.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xe133:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6240.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0xd9c2:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
6240.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xe3fe:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6240.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0xdbbb:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
6240.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x242a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
6240.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x84ef:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
6240.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0x10594:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
6240.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x252d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
6240.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x5a82:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
6243.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xdd84:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6243.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xe573:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
6243.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xd262:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xd370:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6243.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xe133:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6243.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0xd9c2:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
6243.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xe3fe:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6243.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0xdbbb:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
6243.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x242a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
6243.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x84ef:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
6243.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_575f5bc8	unknown	unknown	0x10594:$a: 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00
6243.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x252d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
6243.1.0000000000400000.0000000000412000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x5a82:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Click to see the 55 entries

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6408)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /tmp/Fantazy.x86_64.elf (PID: 6240)	Socket: 127.0.0.1:59025	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6446)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6476)	Socket: unknown address family	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 191.102.177.85
Source: unknown	TCP traffic detected without corresponding DNS query: 155.181.80.70
Source: unknown	TCP traffic detected without corresponding DNS query: 57.252.41.85
Source: unknown	TCP traffic detected without corresponding DNS query: 119.243.48.9
Source: unknown	TCP traffic detected without corresponding DNS query: 207.20.253.57
Source: unknown	TCP traffic detected without corresponding DNS query: 31.241.213.255
Source: unknown	TCP traffic detected without corresponding DNS query: 92.254.149.96
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.194.92
Source: unknown	TCP traffic detected without corresponding DNS query: 126.157.9.88
Source: unknown	TCP traffic detected without corresponding DNS query: 183.8.104.231
Source: unknown	TCP traffic detected without corresponding DNS query: 38.132.148.87
Source: unknown	TCP traffic detected without corresponding DNS query: 222.230.214.17
Source: unknown	TCP traffic detected without corresponding DNS query: 53.148.21.160
Source: unknown	TCP traffic detected without corresponding DNS query: 13.4.242.141
Source: unknown	TCP traffic detected without corresponding DNS query: 173.99.101.101
Source: unknown	TCP traffic detected without corresponding DNS query: 176.192.223.58
Source: unknown	TCP traffic detected without corresponding DNS query: 23.254.226.197
Source: unknown	TCP traffic detected without corresponding DNS query: 47.117.29.159
Source: unknown	TCP traffic detected without corresponding DNS query: 175.58.24.137
Source: unknown	TCP traffic detected without corresponding DNS query: 1.78.245.64
Source: unknown	TCP traffic detected without corresponding DNS query: 117.189.153.78
Source: unknown	TCP traffic detected without corresponding DNS query: 76.202.96.124
Source: unknown	TCP traffic detected without corresponding DNS query: 144.12.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 205.250.115.62
Source: unknown	TCP traffic detected without corresponding DNS query: 48.3.220.48
Source: unknown	TCP traffic detected without corresponding DNS query: 181.144.50.247
Source: unknown	TCP traffic detected without corresponding DNS query: 41.129.184.220
Source: unknown	TCP traffic detected without corresponding DNS query: 12.225.114.150
Source: unknown	TCP traffic detected without corresponding DNS query: 123.177.138.225
Source: unknown	TCP traffic detected without corresponding DNS query: 107.139.98.16
Source: unknown	TCP traffic detected without corresponding DNS query: 179.190.239.66
Source: unknown	TCP traffic detected without corresponding DNS query: 146.14.90.50
Source: unknown	TCP traffic detected without corresponding DNS query: 48.58.72.36
Source: unknown	TCP traffic detected without corresponding DNS query: 102.232.217.188
Source: unknown	TCP traffic detected without corresponding DNS query: 78.7.188.197
Source: unknown	TCP traffic detected without corresponding DNS query: 154.62.217.56
Source: unknown	TCP traffic detected without corresponding DNS query: 19.87.5.60
Source: unknown	TCP traffic detected without corresponding DNS query: 167.157.56.35
Source: unknown	TCP traffic detected without corresponding DNS query: 31.64.211.183
Source: unknown	TCP traffic detected without corresponding DNS query: 222.253.34.110
Source: unknown	TCP traffic detected without corresponding DNS query: 160.234.68.48
Source: unknown	TCP traffic detected without corresponding DNS query: 206.51.102.90
Source: unknown	TCP traffic detected without corresponding DNS query: 198.152.153.226
Source: unknown	TCP traffic detected without corresponding DNS query: 220.11.221.1
Source: unknown	TCP traffic detected without corresponding DNS query: 105.199.33.43
Source: unknown	TCP traffic detected without corresponding DNS query: 153.179.198.69
Source: unknown	TCP traffic detected without corresponding DNS query: 4.59.58.165
Source: unknown	TCP traffic detected without corresponding DNS query: 197.6.159.103

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.39.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53726
Source: unknown	Network traffic detected: HTTP traffic on port 53726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6244.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6244.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6244.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6244.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6244.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 6244.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6244.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 6244.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 6244.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 6244.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Source: 6244.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 6244.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6242.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6242.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6242.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6242.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6242.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 6242.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6242.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 6242.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 6242.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 6242.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Source: 6242.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 6242.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6241.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6241.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6241.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6241.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6241.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 6241.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6241.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 6241.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 6241.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 6241.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Source: 6241.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 6241.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6240.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6240.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6240.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6240.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6240.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 6240.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6240.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 6240.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 6240.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 6240.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Source: 6240.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 6240.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6243.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6243.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6243.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6243.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6243.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 6243.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6243.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 6243.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 6243.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 6243.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 Author: unknown
Source: 6243.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 6243.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 6054, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 6225, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 6226, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 6242, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 6244, result: unknown	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 6054, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 6225, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 6226, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 6242, result: successful	Jump to behavior
Source: /tmp/Fantazy.x86_64.elf (PID: 6244)	SIGKILL sent: pid: 6244, result: unknown	Jump to behavior

Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: Fantazy.x86_64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6244.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6244.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6244.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6244.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6244.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 6244.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6244.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 6244.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 6244.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 6244.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Source: 6244.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 6244.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6242.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6242.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6242.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6242.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6242.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 6242.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6242.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 6242.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 6242.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 6242.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Source: 6242.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 6242.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6241.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6241.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6241.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6241.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6241.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 6241.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6241.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 6241.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 6241.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 6241.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Source: 6241.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 6241.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6243.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6243.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6243.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6243.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6243.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 6243.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6243.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 6243.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 6243.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 6243.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_575f5bc8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f, id = 575f5bc8-b848-4db4-a99c-132d4d2bc8a4, last_modified = 2021-09-16
Source: 6243.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 6243.1.0000000000400000.0000000000412000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16

Source: classification engine

Classification label: mal72.spre.troj.linELF@0/44@3/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6332)	File: /proc/6332/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6476)	File: /proc/6476/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6481)	File: /proc/6481/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6495)	File: /proc/6495/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6537)	File: /proc/6537/mounts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6265)	File: /run/systemd/journal/streams/.#9:75802bUX8jU	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File: /run/systemd/journal/streams/.#9:75803gWPC9U	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File: /run/systemd/journal/streams/.#9:75985uHPCkX	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File: /run/systemd/journal/streams/.#9:75994dxvC1V	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File: /run/systemd/journal/streams/.#9:76000bFE1UV	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File: /run/systemd/journal/streams/.#9:76012AT55vU	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File: /run/systemd/journal/streams/.#9:76014I9dO4U	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File: /run/systemd/journal/streams/.#9:76841mxGyRW	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File: /run/systemd/journal/streams/.#9:76843H1r5qT	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File: /run/systemd/journal/streams/.#9:76868O2hTAT	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File: /run/systemd/journal/streams/.#9:764025KqBZT	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File: /run/systemd/journal/streams/.#9:76701JlTbTV	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File: /run/systemd/journal/streams/.#9:76706oYT2eX	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File: /run/systemd/journal/streams/.#9:76777nptbvV	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File: /run/systemd/journal/streams/.#9:76782A5ndPW	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File: /run/systemd/journal/streams/.#9:77846rq7Y0X	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File: /run/systemd/journal/streams/.#9:77868xWVzOV	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File: /run/systemd/journal/streams/.#9:77869JLtwzW	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File: /run/systemd/journal/streams/.#9:77888gkIivW	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File: /run/systemd/journal/streams/.#9:77893AJwLQU	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File: /run/systemd/journal/streams/.#9:79538eG5BWU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6340)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6340)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6340)	File: /run/systemd/seats/.#seat0NsG7ZA	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6340)	File: /run/systemd/users/.#127mxeADC	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6340)	File: /run/systemd/users/.#12787UB7z	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6340)	File: /run/systemd/seats/.#seat0WOrYzA	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6340)	File: /run/systemd/users/.#1272l8DmC	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6340)	File: /run/systemd/users/.#127fXClPB	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6340)	File: /run/systemd/users/.#127JYcLeB	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6340)	File: /run/systemd/users/.#127kgYI3B	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6402)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6474)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6452)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6452)	Directory: /root/.cache	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/6474/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/6474/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/6474/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/6474/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/6474/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/6474/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/6474/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/6476/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/6476/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/6476/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/6476/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/6476/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/6476/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/6476/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/6431/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/6431/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/6431/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/6431/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/6431/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/6431/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/6431/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2078/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2078/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2078/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2078/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2078/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2078/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2078/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2077/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2077/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2077/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2077/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2077/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2077/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2077/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2033/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2033/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2033/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2033/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2033/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2033/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2033/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2074/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2074/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2074/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2074/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2074/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2074/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2074/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1335/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1335/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1335/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1335/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1335/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1335/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1532/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1532/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1532/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1532/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1532/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1532/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1532/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1334/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/1334/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2302/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2302/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2302/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2302/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2302/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6265)	File opened: /proc/2302/cgroup	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6416)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6418)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6420)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6425)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6427)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6430)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6433)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6435)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6465)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Source: /bin/sh (PID: 6417)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6419)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6421)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6426)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6428)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6432)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6434)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6436)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6467)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6438)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6265)

Reads from proc file: /proc/meminfo

Jump to behavior

Source: /sbin/agetty (PID: 6407)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6446)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6446)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6452)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6452)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6408)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6408)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 6415)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 6415)

Truncated file: /var/log/gpu-manager.log

Jump to behavior

Source: /usr/bin/pulseaudio (PID: 6331)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pkill (PID: 6438)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6265)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6331)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6407)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6408)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6415)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6468)	Queries kernel information via 'uname':	Jump to behavior

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6452)

Logged in records file read: /var/log/wtmp

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Fantazy.x86_64.elf	100%	Avira	EXP/ELF.Gafgyt.Z.A
Fantazy.x86_64.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.39.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
148.253.223.217	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
174.183.30.80	unknown	United States	7922	COMCAST-7922US	false
20.199.179.37	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
109.35.190.108	unknown	Netherlands	15480	VFNL-ASVodafoneNLAutonomousSystemNL	false
220.148.181.204	unknown	Japan	10010	TOKAITOKAICommunicationsCorporationJP	false
78.138.162.222	unknown	Russian Federation	28840	TATTELECOM-ASRU	false
110.172.86.163	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	false
96.158.206.62	unknown	United States	7922	COMCAST-7922US	false
217.94.84.120	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
44.43.245.118	unknown	United States	7377	UCSDUS	false
38.139.100.175	unknown	United States	174	COGENT-174US	false
39.114.213.255	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
99.35.224.140	unknown	United States	7018	ATT-INTERNET4US	false
220.141.187.1	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
158.32.138.224	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
222.14.34.132	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
142.185.253.198	unknown	Canada	577	BACOMCA	false
180.16.35.157	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
101.214.93.239	unknown	India	58519	CHINATELECOM-CTCLOUDCloudComputingCorporationCN	false
102.12.204.217	unknown	unknown	37069	MOBINILEG	false
162.231.86.130	unknown	United States	7018	ATT-INTERNET4US	false
59.227.19.19	unknown	China	2516	KDDIKDDICORPORATIONJP	false
201.67.164.167	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
1.3.115.13	unknown	China	13335	CLOUDFLARENETUS	false
38.107.137.204	unknown	United States	394229	TELOGIKSUS	false
60.5.80.198	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
192.102.98.18	unknown	United States	12582	TSF-DATANET-NGD-ASTeliaFinlandMPLSVPNServicesFI	false
93.123.77.220	unknown	Bulgaria	43561	NET1-ASBG	false
53.38.230.54	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
150.200.157.141	unknown	United States	2572	MORENETUS	false
184.137.80.174	unknown	United States	5778	CENTURYLINK-LEGACY-EMBARQ-RCMTUS	false
85.134.68.111	unknown	Finland	24751	MULTIFI-ASFI	false
185.237.150.203	unknown	Ireland	201000	WHIZZY-FTTXIE	false
172.187.21.152	unknown	United States	7018	ATT-INTERNET4US	false
116.217.176.187	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
133.220.89.236	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
57.204.240.5	unknown	Belgium	2686	ATGS-MMD-ASUS	false
218.164.56.161	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
154.8.52.226	unknown	Japan	10003	OCT-NETOgakiCableTelevisionCoIncJP	false
144.82.152.186	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
154.90.253.251	unknown	Seychelles	26484	IKGUL-26484US	false
200.103.110.212	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
80.167.105.49	unknown	Denmark	3292	TDCTDCASDK	false
63.106.97.242	unknown	United States	701	UUNETUS	false
146.162.49.10	unknown	United Kingdom	9605	DOCOMONTTDOCOMOINCJP	false
201.172.21.89	unknown	Mexico	265594	TelevisionInternacionalSAdeCVMX	false
197.130.125.94	unknown	Morocco	6713	IAM-ASMA	false
191.128.90.131	unknown	Brazil	26615	TIMSABR	false
84.229.249.236	unknown	Israel	9116	GOLDENLINES-ASNPartnerCommunicationsMainAutonomousSyste	false
9.35.127.98	unknown	United States	3356	LEVEL3US	false
193.189.141.209	unknown	United Kingdom	25525	REASONNET-ASAmsterdamtheNetherlandsNL	false
79.24.45.188	unknown	Italy	3269	ASN-IBSNAZIT	false
187.163.52.179	unknown	Mexico	6503	AxtelSABdeCVMX	false
157.37.131.133	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
199.57.200.181	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
126.117.13.4	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
175.203.75.232	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
213.236.204.99	unknown	Norway	25400	TELIA-NORWAY-ASTeliaNorwayCoreNetworksNO	false
93.214.61.140	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
93.254.173.91	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
86.58.240.62	unknown	Denmark	16095	JAYNETSentiaDanmarkASDK	false
74.3.84.95	unknown	United States	18566	MEGAPATH5-US	false
112.120.128.134	unknown	Hong Kong	4760	HKTIMS-APHKTLimitedHK	false
174.191.135.3	unknown	United States	7922	COMCAST-7922US	false
82.74.56.197	unknown	Netherlands	33915	TNF-ASNL	false
19.167.98.8	unknown	United States	3	MIT-GATEWAYSUS	false
211.176.122.227	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
145.54.105.43	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
207.196.126.250	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
173.17.53.199	unknown	United States	30036	MEDIACOM-ENTERPRISE-BUSINESSUS	false
98.40.152.33	unknown	United States	7922	COMCAST-7922US	false
141.72.220.212	unknown	Germany	553	BELWUEBelWue-KoordinationEU	false
185.73.159.190	unknown	Liechtenstein	59748	KPMSLI	false
216.1.206.139	unknown	United States	2828	XO-AS15US	false
23.126.69.247	unknown	United States	7018	ATT-INTERNET4US	false
197.211.78.199	unknown	South Africa	29918	IMPOL-ASNZA	false
72.63.145.159	unknown	United States	10507	SPCSUS	false
164.66.192.201	unknown	United States	1458	DNIC-ASBLK-01458-01460US	false
74.52.39.73	unknown	United States	36351	SOFTLAYERUS	false
64.65.211.223	unknown	United States	7029	WINDSTREAMUS	false
12.130.194.61	unknown	United States	7018	ATT-INTERNET4US	false
76.222.194.120	unknown	United States	7018	ATT-INTERNET4US	false
154.59.121.127	unknown	United States	27385	QUALYSUS	false
141.182.29.210	unknown	United States	197921	HBTFJO	false
97.143.15.25	unknown	United States	6167	CELLCO-PARTUS	false
208.32.145.230	unknown	United States	1239	SPRINTLINKUS	false
163.140.145.148	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
179.181.230.144	unknown	Brazil	18881	TELEFONICABRASILSABR	false
155.232.92.167	unknown	South Africa	2018	TENET-1ZA	false
96.98.176.168	unknown	United States	7922	COMCAST-7922US	false
181.43.78.107	unknown	Chile	6471	ENTELCHILESACL	false
8.244.157.180	unknown	United States	3356	LEVEL3US	false
157.240.25.27	unknown	United States	32934	FACEBOOKUS	false
118.222.159.178	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
70.107.97.114	unknown	United States	701	UUNETUS	false
180.184.14.229	unknown	China	38841	KBRO-AS-TWkbroCOLtdTW	false
185.248.70.73	unknown	Netherlands	202374	PREWESTNL	false
182.211.218.107	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
18.126.156.31	unknown	United States	3	MIT-GATEWAYSUS	false
185.118.24.102	unknown	Lebanon	13044	ASAOUNLB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
109.35.190.108	05crhY8VQT.elf	Get hash	malicious	Mirai	Browse
142.185.253.198	AAwUREvt6b.elf	Get hash	malicious	Mirai	Browse
59.227.19.19	arm6.elf	Get hash	malicious	Unknown	Browse
201.67.164.167	sora.arm.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	Fantazy.arm5.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Fantazy.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	sora.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	sora.m68k.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	sora.ppc.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	sora.mips.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	sora.arm7.elf	Get hash	malicious	Unknown	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	40.71.160.224
	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	20.2.198.143
	sora.ppc.elf	Get hash	malicious	Unknown	Browse	20.196.136.5
	sora.sh4.elf	Get hash	malicious	Unknown	Browse	20.135.246.71
	sora.arm7.elf	Get hash	malicious	Unknown	Browse	20.21.172.65
	sora.x86.elf	Get hash	malicious	Unknown	Browse	20.235.211.182
	24EPV9vjc5.exe	Get hash	malicious	Unknown	Browse	204.79.197.219
	kXzODlqJak.exe	Get hash	malicious	Unknown	Browse	204.79.197.219
	MDE_File_Sample_c404ec52446527b77da6860ca493ea2007ac03d5.zip	Get hash	malicious	Unknown	Browse	20.189.173.22
	https://combatironapparel.com/collections/ranger-panty-shorts	Get hash	malicious	Unknown	Browse	131.253.33.203
BT-UK-ASBTnetUKRegionalnetworkGB	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	86.156.138.130
	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	86.137.60.17
	sora.mips.elf	Get hash	malicious	Unknown	Browse	86.136.126.52
	sora.arm.elf	Get hash	malicious	Unknown	Browse	81.151.223.214
	4.elf	Get hash	malicious	Unknown	Browse	86.165.205.69
	miori.mpsl.elf	Get hash	malicious	Unknown	Browse	217.38.250.163
	botnet.spc.elf	Get hash	malicious	Mirai, Moobot	Browse	81.131.48.32
	miori.sh4.elf	Get hash	malicious	Unknown	Browse	86.131.0.8
	sora.mpsl.elf	Get hash	malicious	Mirai	Browse	217.39.40.169
	sora.mips.elf	Get hash	malicious	Mirai	Browse	81.149.77.243
COMCAST-7922US	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	73.123.188.204
	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	174.181.88.2
	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	73.106.17.236
	sora.mpsl.elf	Get hash	malicious	Unknown	Browse	98.46.251.43
	sora.m68k.elf	Get hash	malicious	Unknown	Browse	184.115.101.239
	sora.ppc.elf	Get hash	malicious	Unknown	Browse	24.13.36.36
	sora.mips.elf	Get hash	malicious	Unknown	Browse	76.134.50.39
	sora.sh4.elf	Get hash	malicious	Unknown	Browse	68.85.102.8
	sora.arm7.elf	Get hash	malicious	Unknown	Browse	67.164.101.19
	sora.x86.elf	Get hash	malicious	Unknown	Browse	174.167.169.189
VFNL-ASVodafoneNLAutonomousSystemNL	miori.arm.elf	Get hash	malicious	Unknown	Browse	109.36.24.60
	i686.elf	Get hash	malicious	Mirai	Browse	109.32.248.161
	DEMONS.sh4.elf	Get hash	malicious	Unknown	Browse	31.137.99.215
	db0fa4b8db0333367e9bda3ab68b8042.spc.elf	Get hash	malicious	Mirai, Gafgyt	Browse	109.32.196.208
	telnet.sh4.elf	Get hash	malicious	Unknown	Browse	109.35.189.227
	armv4l.elf	Get hash	malicious	Unknown	Browse	62.140.153.80
	armv6l.elf	Get hash	malicious	Mirai	Browse	109.33.226.45
	arm5.elf	Get hash	malicious	Unknown	Browse	109.33.202.91
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse	109.32.248.119
	la.bot.powerpc.elf	Get hash	malicious	Mirai	Browse	31.139.105.85

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/6479/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.5219280948873621
Encrypted:	false
SSDEEP:	3:Hn:H
MD5:	D707782225F64057E1D7AA8C7E3BBB23
SHA1:	875A581BBA8116D5238704ED8FDA9C3AF848573F
SHA-256:	748CDA3878E8E885C9D4E779BDEC5BC58A2D851FD216B35A410FB29AE5E1A496
SHA-512:	23821974916D044A643080CB77E4A62CAE8C0A4EAB254C7189CE50ECE51635A8C61ED02B03B6F418C6CE87EE73BC407C0DEBB095B25EA64C41FB79CB2999E31E
Malicious:	false
Reputation:	low
Preview:	6446.

/run/systemd/journal/streams/.#9:75802bUX8jU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.537516828478613
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+XwzRVgfKNhgrxsjq:SbFuFyLVIg1BG+f+M+ifji4s
MD5:	10B30625B88ECA67F990D2B4A8B96EA5
SHA1:	D56406F57AA18EE646704155ACF1368AB2F22FAC
SHA-256:	0AE673873A0E01E1B1EFB018F09B21F163581B3B80C5393DFB608A316AD65422
SHA-512:	6C9C9C35125D3C52140B648A2C286D9B832A5C0E8C9C810247080CB1CD4C3C8C8DEEE4C4DE55A5E9605AC6CE8E882835655B30A10A79404D54BFA06F39B2B5D7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=42bb5214cb40443196ca5634c6f72152.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:75803gWPC9U

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.492382606208342
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9Yt2cr9ww0js7LbgS:SbFuFyLVIg1BG+f+Mkr9ww0ji4s
MD5:	D6472DC518181677D796F8DA63D7892E
SHA1:	64F8020E1BB95EC6704B8F8D3C9B1C4BA839E388
SHA-256:	08F37B90BF0C37F4CBEB4E998D7F3D18F753702CA974709268B242217A959E39
SHA-512:	D5C6146A99E1AFEE462F792315FC021B4052D1F22AADD2793258BCF8270E6586C7F47144A69510936C3F836C06F55B69BF984A729FAE02A4FD233A5762D4093B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=72f1e41ae61d493c9573e53030d9dfed.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:75985uHPCkX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.378650637986566
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M+PZAWQJNAg0ZjdCLKzK:qgFq6g10+f+MQ8FmCLAK
MD5:	D7D3E240094D0336AD6622E4A71A6EDE
SHA1:	5C2E3B3874BA7D8365D410ED33D4AA0EAA3BAD33
SHA-256:	D9CC363A7873D8ADBB215BFEA53144A041FD6426BDDBFE997E24F1533644AA4B
SHA-512:	64E98BF462EC764075E08DB67F9F5D1367010DF0927D845650B566EECC7B88E04BED45B2E43E573759505102832E7A36B019768E941C3566FCEBA584213AC700
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e5f3886363a24b23b358d0a2211ce09b.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:75994dxvC1V

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.400345014823148
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M4DRA2SAlNuqjFmzXvn:qgFqo6g7/+0+f+M41+4QXvn
MD5:	B558AE7E1A0BFF536572BA87C3720AC5
SHA1:	E0AC0AE35F8B921B5FE76E3FF14684CEAC6CACCB
SHA-256:	196E62DB2D599F61E0320EC7F9938B872A194ECAC28F6FAACE9AD83C43341D97
SHA-512:	23C7826BCF735E82AF74BDAE5298DBFDA32CF712A227DD740AB79C8775375CC72FFCC1CFADA17DAEDD57F5A9D8800DD6CE0DD03735F5DD817DA9E83A0B12606B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2f9b69890cc94fe8a4d43599ea96e919.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:76000bFE1UV

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.403410905083584
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm/Rm4IS22+sjs+Xc:SbFuFyLVI6g7/+BG+f+M5m4ZTjFmzXvn
MD5:	B53787D23F8DE5D1AF55190457F0D5FA
SHA1:	F4C73808B64EDC8B93C360EA11173EE2B097528C
SHA-256:	A517BB9AF9B1109F50D1810A6AEEAECF20C26EB339808D472EB94E053988F6DD
SHA-512:	4BC07147E335225DBB203A507B9835425BFE516726E58E3621DD2BFD9D254DF4697BDA0F279B648B9F611C7521A4EE7811F3470C40B1376082474A6199829666
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5b34cb92a4284eab8504452e60859bfb.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:76012AT55vU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.406939068405588
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpNdEpAAAaR5qjs1Ha:SbFuFyLVIg1BG+f+MhibR5qjosQu
MD5:	8A18A6526B9FE253558F808090BD2DBF
SHA1:	523154AE1AA6287EE27C046518F4E5BA1FF4CFF8
SHA-256:	1AF4DE1F35723DAE3033331A8E2F113862D7691A59E962F7554AC36D67685741
SHA-512:	5990D199E347EA94EE6C9CA187F9E2E674CF5C7EEE40B488F103D5A368A15BB206B8617DC599E03B49E04D89BD11745539DF5B1C2827733CF275864E176E6A8D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c6d8a9fb34ed4b09b10dc1c920cb96f7.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76014I9dO4U

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.382702578127576
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmz6WHWRH9XVvsjshQJ:SbFuFyLVIg1BG+f+MR4H9XmjtWL0
MD5:	C9A7360B4E1FD4D0E65F608C6A1A2539
SHA1:	52372F6178B9576BF38954FF2C4C14966607CAD1
SHA-256:	E9A7DF2B1F9BEA258A8810D4EFD3917B1B381E075A745D1FAF35BAA0621877B0
SHA-512:	AF4017E0667C9A802C2FAB6525B53C324D8FAC6E697E5D3B5515789B539DEF3FA2E84ED1A2E807DA133E17F2FCD4AE140649E475D944519D4051AAF60FF4B5C7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=979d45be7c79418087b0386beef2b620.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:764025KqBZT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.418697556986253
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoHGi8UQZEuuRq1D0A:SbFuFyLVIg1BG+f+MoHGNbuRqCjLkGq
MD5:	2AB65FA75B2D31BB289045E32801C5C4
SHA1:	C8688A79E82D8BFAA4DCD1C49C08C6BA32D0674D
SHA-256:	F320E5B56AB05C86E3BE2BBD298F94AB66FD7DE92FCE3E435331C14F205E151C
SHA-512:	B7FDF7DBE38A62D6B3818891721418B143D279FE5B7B5C9299221973DB1FBF2D0F69B0B8C865F5841B659DDA18834DD8E4920860C55E0DC9AD3C9D6E34F84657
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bbc96860515949a999b783dc4070ba9f.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:76701JlTbTV

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.459535696370621
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MzEmcYVjdCt/rRMtq:qgFq6g10+f+MTtTCDL
MD5:	370BB6300C31E14F59F28BD594971D11
SHA1:	FBB5D3D108AF43D1760C4D5DD2F3EECD18BCDAEF
SHA-256:	E4920D6D7342941E76B5859D448D9EA4F0FA0206B482D4FAE1B837C5942E5DBF
SHA-512:	C43F1464060D2201548FBE4C74515DF216CD57CDB73D0978FCF6555560331A73981C3363A3AD0418D5227B3047F925CC50A8902A5A1E9D658842940A5E881AF4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=17c4487b3ae14b47bdf829ca17f3329c.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:76706oYT2eX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.426659876993736
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmz4iRfVTtExnqjs2ALAQ:SbFuFyLVIg1BAf+M5nwqjNALyAZD
MD5:	1056A7A6B1AC9B6FF909F1F5CD3C15CC
SHA1:	44CA5068057B5D7CE1FF151123E2B20A70D185D5
SHA-256:	1720C03164FBA40B849D80565C196CFCEAF52E78F2C2CD2F06D47DD8793BD28A
SHA-512:	A8BFED7262195733D29D1C4E9DD75FF05AE3246643865AC140377569473A021846B70F768AE75BE01B77E978174A0C8669B3B0551521CEA9807E467C639DBE58
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=962bad197e3040fd8766670f6fe9a42d.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76777nptbvV

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.441038716692718
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmycyUdcVgKJsh+sjs2BI:SbFuFyLVIg1BAf+MylEfKCTjNdQIeXD
MD5:	DF37A49F70DF1A4BF5B41732551A5376
SHA1:	D07082DB0B74BF4FD15811D41089FC1641C36C92
SHA-256:	8962D4DF73122ED474F45929ADFFA5361CB482850DD7FB5DA6037137DD6E93F0
SHA-512:	4EDD4844C22D75ABDF1938B338A9C3E4577337F16410AF20129C2DB026152B37ACA98F7F21B20363EEEAE65C3CC9CCFC5BDEC2071C0F35780130742EB4C8F0CF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=81f2bd47189048b5a1a1c842d1f4fca1.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76782A5ndPW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.392682343612815
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmvwdhABA2JRgxShgrqjr:SbFuFyLVIg1BAf+MgaLJmU22jNTZD
MD5:	26C5761CC298607E546548419D930778
SHA1:	65DEF8FAC631FC41FB5F80A30A5BDE68691D6356
SHA-256:	4E3EDFDE89EAF617DB158841DF16D90F543CA878DF5061B46D9FAEF5F8C861D2
SHA-512:	113D70F5DF6867D9DAFC428A3C8C307AA305F193500AD677466092617C5E5BD54D01E4FB3B109E44B219526A91B012A2737A5C31F5D46F55D34BD0E8B3D07305
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e45289c4e77242c9822606e598d3dc2d.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76841mxGyRW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.415001953494423
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7yuodhRqVhBBhc8ja:SbFuFyLVIg1BG+f+MmuofRqVxhc8jNE
MD5:	00BB0E16089B1B91CC9CCE4A0ACD0FD3
SHA1:	3C299723D3B569EAA734756F6C7EDAC3C054E2A0
SHA-256:	8AA52A2AE677D1573E3BC3890C011B4358B1BC1888886D97424FED1478F9C338
SHA-512:	BE553A1661642E58E0DAFE3306D320C462EC727287B54EEA8919923CC50E21237F42B2A50581CAFF6D83354F21C0054120958A6477FCF4FC41E0C482BE07B5B2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=19dbc80d8cd8431b9ed937b3cd233957.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:76843H1r5qT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.461464385751036
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6B84L2UwsjsicWmIo:SbFuFyLVIg1BG+f+M68UZjZcHcljX+
MD5:	6112A23E1FA06C011DE5907DD14757E4
SHA1:	1801A4546F81D2A05336BD5203CE2A42C810B5CF
SHA-256:	5D6D8F8271785CB31944F66F36E03DEC6771E24333C6186B94C45DE197F1A3BA
SHA-512:	D285BBB1EA11630840295F6A4570E4C40F5CDC71E3DF0AAA2F890A6DF0EBBA65E22001DD0B5A2EF2178C3C92F5AFE30866D37A259D795328A3E0A900FCB9A035
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0d4d1791949843389aacd735e4defbfb.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:76868O2hTAT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.422078481770029
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+mXrUKQDXnEc2jshP:SbFuFyLVIg1BG+f+M+gAKQLAjbVC
MD5:	EC9D269657D7CF8B360E51CB93B3A42F
SHA1:	F3AB4E0D5FA962A6492D708612325C1EEC6D64EA
SHA-256:	587733FC349965BF274861AB2E71C818F4089C4E11E3EE8EB9C484F9F76315B1
SHA-512:	FC3FFF42E520DCF8A904D0EDC033E45E2E037CABDC0DAF48CB9161155C8B9A2C1919005640C72E1E2BBD4A4B062D47313412392E28CF251FCAD62E4A1C57A3C2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4c5c2d6beb7d41ea90b9f22f235507a7.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:77846rq7Y0X

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.419953545076305
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8Ej5R3xXS+Ehuxsju:SbFuFyLVIg1BG+f+M8WEMqjLTTIWTIL
MD5:	35B91C3A88C60A2AE4B31E86A55D2775
SHA1:	5E5620F0998D9A75A142510F8C5171D7D728B596
SHA-256:	F3D2593B9919C17C3E72943944120C3ED343603B083F2403AA47B99F229F45DE
SHA-512:	A0E2E54820281CD6EFB3AED266583213D9DA6BCF2127945D49937310DE1971752FE41B3CBD95A407E1F1C2CA5D9C3CA876A29A7635DAD361389BE1A22DA3511A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6a4a1319b08345bca8b2f3b4ce30a27a.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:77868xWVzOV

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.411704270527191
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmzsPQE0JcTdZ/wFF:SbFuFyLVK6g7/+BG+f+MwmSTdBw8jNq
MD5:	B10D846A0F53B5B1B5AAB54E047C0503
SHA1:	953EB5CDB24F8C4B35384D325F089D4CFA617A0D
SHA-256:	423FF3B680E2786DBAA5B8781705180399EF5CB31223E7FD30EB28FC6A958840
SHA-512:	6D0ADDE2FAC04A55E04B91653CE8A28301B030032EB438A4A0088605DA31FA07E8E530D92657A63E07747AFC8EE8E0BC957900EE4BD8914FC13BBD490732A32F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9b1fb429a10a4aa7b59968acd7cb951b.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:77869JLtwzW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.422805793790681
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmzy9lBUQ2o2sjs2q:SbFuFyLVI6g7/+BG+f+MeqQBjNq
MD5:	B874942BA5707DFA0AE9C59FBB4A7959
SHA1:	27D6803FBE9A5A5FFC36404CBCD84935FC965A03
SHA-256:	F899C249A7CB9814AE6B80E073E74D26A29D1D493FAD51A63503CCE9F69D499D
SHA-512:	009E839EE6C34F6B96C2958CE2E1572A4956A775A31281C794D5B2F97079D116A255512F6B6B5A38B3D9C3BE5A0641B27E51EE69AD2576F6044BC3ABECC20790
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=97441d5d6d1545848858c30f1fbaa893.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:77888gkIivW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.501301482326503
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MoNTdHhtPTjFQMzKaBu:qgFqo6g7/+0+f+MoThVNTmh
MD5:	F237DFFF8150CB47C57BE14DA47FF899
SHA1:	69EAE707143DF52C1443A589B2AB5EB3244E232A
SHA-256:	EC7246C072A54945AF38BE2B1E0BC557CD0D4754F98EF0FC2988278AEF34237A
SHA-512:	91C1184DA1FAE72901178635C50BC5378BC0A4AF02C231EACC81CA0595B56A61DE35160CB13992EE0734745034B8A24B4807E7CF1D44145ACC0FF0B1DB9AB341
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bac5c69f6b7a4309b2568beab6d6f520.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:77893AJwLQU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.51472919217619
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MSy2Pvs8jFQMzKaBu:qgFqdg7/+0+f+MSPs2Tmh
MD5:	567BE3B90F7F206B7AD729F6EE64DDE2
SHA1:	72192DC3347538B33C7ABA04E10F5D08C5F26197
SHA-256:	24B8D387364DBC8B6058D5A4274C5B09E1A1FA0394A0B19A110A4C23431FD193
SHA-512:	5E33A67B139B725CE4581D7D1A3ED25B90CEDD4A9C933D6A2D53770B20864D9143D6F67D1B295C9DE9898AC8405BB1DC88A16C1FE64080AED827AEBB0A305620
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=33c365f691b64fd288dd8160d13b6f8e.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:79538eG5BWU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.366022745064571
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/n+8iGr22js1Han:SbFuFyLVIg1BG+f+MG8iKjoa
MD5:	4056C6CC973B059CDFB99E8591FB5ECC
SHA1:	6CC18327C6F5AD57696FA82D427C67A90CF16E84
SHA-256:	B00805FC12F7E363FDE6FC087ED6760C4ABDE8DDC60FCDFED76B1EE4E9020E09
SHA-512:	11FDF2165789A1E8C18A61413D2E56D7C71D08781BF4AB61F87135120C569C55BFAA94E5B1EEB8730597D89C12FDC288B8D70A3D72B816B3B05D54C6D8D03A59
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=593a2988173a4e089770152441026b1e.IDENTIFIER=dbus-daemon.

/run/systemd/seats/.#seat0NsG7ZA

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0WOrYzA

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/users/.#1272l8DmC

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.3023995258223104
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gD/lF0S12thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+gDMS8thQHtPYq9M
MD5:	C6ECCF680452ECCA0AF0DC430A7B3DAC
SHA1:	223EA93440AAF44AE9C998CE6568F8EDB30592C3
SHA-256:	EB4CAC1F160C8C25FA6976B92F5BBC81568A0F83B876CA48EC115DA216E55759
SHA-512:	F7B8986BCDD0B51E5A4EAA05A2F2D178C95E1D8D37B538E5462F88871769637FAB27649D8289CF151104AA689AE2518382822FB24CA2DCDB8F88962B7814B21E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1736441326512082.MONOTONIC=469780117.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#12787UB7z

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.3023995258223104
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gD/lF0S12thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+gDMS8thQHtPYq9M
MD5:	C6ECCF680452ECCA0AF0DC430A7B3DAC
SHA1:	223EA93440AAF44AE9C998CE6568F8EDB30592C3
SHA-256:	EB4CAC1F160C8C25FA6976B92F5BBC81568A0F83B876CA48EC115DA216E55759
SHA-512:	F7B8986BCDD0B51E5A4EAA05A2F2D178C95E1D8D37B538E5462F88871769637FAB27649D8289CF151104AA689AE2518382822FB24CA2DCDB8F88962B7814B21E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1736441326512082.MONOTONIC=469780117.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127JYcLeB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.478428153982504
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6lgTgD/lF0Si5t6NTp6:qgFq30dABibB3TgDMSi5IpQ
MD5:	5A506748B0A14AEA62AE44C0791744A2
SHA1:	63A0862ED0E6E9A65E5926261469682A172E38DF
SHA-256:	1FB20F0881C2B6715428C65B133512DCBCB29946C47813DCE713760B02647F22
SHA-512:	C2A814A921EEB890F0F26F3B377EECD40BA06997D0461D329288ABF519C5DDCB0D72F865FC1C577A5A0A9CD696745B11C13BEA43480422B516ABB02E659DE1FE
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12412.REALTIME=1736441326512082.MONOTONIC=469780117.LAST_SESSION_TIMESTAMP=469840135.

/run/systemd/users/.#127fXClPB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.341053825465037
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgD/cUFnHUSiWi206qodjTp6:SbFuFyL3BVgdL87iesnAiRJgD/lF0Sir
MD5:	0E6FD497A03928744C2E1F499FD1E59F
SHA1:	9923B72C4BD605D79838FC7EBF34BFE499EC0102
SHA-256:	3725EB885EA2EECAA95483ABFD7238CA6A7517465AABF12419B2D8CF30EA5E48
SHA-512:	55B5B41DD8B6F3B410CDD6A2570CD2D50BD35627AA2ABBF95107E355438B39AD02EB2CFC7B8C24457B354740E90C8C9A262928E0E3BF93803B9B97513C726C18
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1736441326512082.MONOTONIC=469780117.LAST_SESSION_TIMESTAMP=469840135.

/run/systemd/users/.#127kgYI3B

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.478428153982504
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6lgTgD/lF0Si5t6NTp6:qgFq30dABibB3TgDMSi5IpQ
MD5:	5A506748B0A14AEA62AE44C0791744A2
SHA1:	63A0862ED0E6E9A65E5926261469682A172E38DF
SHA-256:	1FB20F0881C2B6715428C65B133512DCBCB29946C47813DCE713760B02647F22
SHA-512:	C2A814A921EEB890F0F26F3B377EECD40BA06997D0461D329288ABF519C5DDCB0D72F865FC1C577A5A0A9CD696745B11C13BEA43480422B516ABB02E659DE1FE
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12412.REALTIME=1736441326512082.MONOTONIC=469780117.LAST_SESSION_TIMESTAMP=469840135.

/run/systemd/users/.#127mxeADC

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:d2:o
MD5:	93A3EE69A4211C63D767C4BE90AB7231
SHA1:	01F563550CF8BA137B13407DBFF8C6F791061CFC
SHA-256:	15C935F05EC38A894F73109ED5691198D02E2C7666C74B17AE786284AAA605A3
SHA-512:	65A4A983AA50CBA3261AC4072D4BD2860E5EBBB1318FB38A0704374D90E51A42AB0007676D20E61EB21E42AD54DDB1FB40487CC6A7A23F8F753C91CBC9EF663C
Malicious:	false
Preview:	6331.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351417
Encrypted:	false
SSDEEP:	3:tCsXlXEWtl/5p+nl:tf+ylxQnl
MD5:	4C4E643D450D3E61CDE198556A36A9CB
SHA1:	BE39403EEA601545B54B56B04898F1ED3BE4B14E
SHA-256:	869DA1AF2C81052C9E19E6FD5AAC835B8ECDE0E728834FC3758424C9E55A11EE
SHA-512:	C1E351B02ED45A2B1742B02C4BF6B79804B71B52A07BD5A57CE65B30471134A9B106B27E365A65971E213AE2182CE9381D7EDE0E3AFABD4668598F4535A8E8FF
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN......................................................................................................................................................................................................................................................................................................g........................................

/var/lib/AccountsService/users/gdm.463WZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	4.788958727441709
Encrypted:	false
SSDEEP:	12:YEJeF0nCLL7QMy1EJeFbwH9FEqLKMydF0hLaduF1JT4p1Wr4sF0nCLGaWr4MkF0A:pC71KqT0pYr4tJr4drCQYG
MD5:	B0E173E60A8670718CDB9A017608FC89
SHA1:	A88435DEDBD566238C7750316D3340F91F83D32B
SHA-256:	BB61F2E8F72BD5F8E3A6F0BD4C7F87F9759D2B013E732077881C4B808C6AEBDE
SHA-512:	56E90ED80599E6AC5DE8BDBDD8F05AB1262E23EDD57733A86EAAB4C2B3F93D1920C73322ABFB62740320668D913981CA576E55C29D9C286733197A11D2A92D0A
Malicious:	false
Preview:	Jan 9 10:48:23 galassia gdm-launch-environment]: pam_systemd(gdm-launch-environment:session): Failed to release session: No session 'c2' known.Jan 9 10:48:23 galassia gdm-password]: pam_systemd(gdm-password:session): Failed to release session: No session '2' known.Jan 9 10:48:45 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Jan 9 10:48:46 galassia systemd-logind[6340]: Failed to start session scope session-c1.scope: Unit session-c1.scope already exists..Jan 9 10:48:46 galassia gdm-launch-environment]: pam_systemd(gdm-launch-environment:session): Failed to create session: Unit session-c1.scope already exists..Jan 9 10:48:47 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session closed for user gdm.Jan 9 10:48:51 galassia dbus-daemon[6332]: [system] Failed to activate service 'org.bluez': timed out (service_start_timeout=25000ms).Jan 9 10:48:56 galassia systemd: pam_unix(systemd-user

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4313806548581445
Encrypted:	false
SSDEEP:	3:F31Hlusyj///GsyjV//l:F3+syj//esyjV//
MD5:	BE48DC844EEE2ECD9598E2C2008E2F1A
SHA1:	D82EAEB8D665D1073EE1B3550C7A718CC0B531FC
SHA-256:	2A46A907CE03FA1C51ABD4EF6813B3990C5DDB0B8430CF1C95FE55DE9F1932E1
SHA-512:	6D453753E2D0A3EC979FE0AB2F11595125AA4725E4CC87626BAB6FA6BB245539C6C2B14024D382D8EC18731C72FAC36F22E251DAFB8E29082DB778378FE114CB
Malicious:	false
Preview:	LPKSHHRH..................#.oSB.b...B....................................#.oSB.b...B..........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.448047321524811
Encrypted:	false
SSDEEP:	3:F31HlYeWpbIeWpBlX:F3oVIvl
MD5:	4197383C4BA94E4D2102CF14815B2779
SHA1:	F711D747362623E832B0ECC3A7CA3EC439D9D2BA
SHA-256:	9DB4309AD869C73EABB020F5817DEB3A5318ACD46F2143D47F93D4FDBC7D5CCB
SHA-512:	F00B8C780373B4CDA0237CEB134EA2D7DEE03F4B8880FA01787A0C6BCFD23FEF1504E17AA50E1453C35BF474972B33BF487B32D1C1052AD22DC717488C00EAAB
Malicious:	false
Preview:	LPKSHHRH.................)...B....L.}...................................)...B....L.}..........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	6895
Entropy (8bit):	4.680740790647092
Encrypted:	false
SSDEEP:	96:pK1xkzsl/vfSnijZIuRsVgslsfdBtQuWaWsw4MsjmNsb:pK1xZ2qdBtQBC
MD5:	4489154E90583C40A96122D7B2DAA1F5
SHA1:	AABCC109DFBC34BC860A150697C74B66C91A2765
SHA-256:	5C0B42692D3174872BCA5EE82BC32B773C8793B0063477070F47CE1070FBEE6A
SHA-512:	AAA951834B1C1D5233252C986EAF195069B89266EFEB28385768DE110AECD550665B140E587C81A07CB31A3AE3AE803AC8BE418B62E545B9D7221579376363A7
Malicious:	false
Preview:	Jan 9 10:48:23 galassia kernel: [ 445.352624] New task spawned: old: (tgid 6329, tid 6329), new (tgid: 6329, tid: 6406).Jan 9 10:48:23 galassia kernel: [ 447.015402] New task spawned: old: (tgid 6408, tid 6408), new (tgid: 6408, tid: 6412).Jan 9 10:48:23 galassia kernel: [ 447.015967] New task spawned: old: (tgid 6408, tid 6408), new (tgid: 6408, tid: 6413).Jan 9 10:48:25 galassia kernel: [ 447.019768] New task spawned: old: (tgid 6408, tid 6412), new (tgid: 6408, tid: 6414).Jan 9 10:48:25 galassia kernel: [ 448.496849] New task spawned: old: (tgid 6415, tid 6415), new (tgid: 6416, tid: 6416).Jan 9 10:48:25 galassia kernel: [ 448.556660] New task spawned: old: (tgid 6416, tid 6416), new (tgid: 6417, tid: 6417).Jan 9 10:48:25 galassia kernel: [ 448.677176] blocking signal 0: 6265 -> 1860.Jan 9 10:48:25 galassia kernel: [ 448.784790] New task spawned: old: (tgid 6415, tid 6415), new (tgid: 6418, tid: 6418).Jan 9 10:48:26 galassia kernel: [ 448.825341] New task spawned:

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (317)
Category:	dropped
Size (bytes):	28431
Entropy (8bit):	4.982197926947876
Encrypted:	false
SSDEEP:	768:p5yZSUENqKoNCaJcFCxu4w0uHIKo2gs6ZmnLdz1JTyZSOUHmaMfB9rNeKMbZtrbp:p5yZSUENZoNCaJcFCxuskwsmg
MD5:	99B55B4B3A3CB537FE04CF11E4BC6596
SHA1:	259EDB3CE2BD2581749C159E75F5F03B3776B2EB
SHA-256:	8D738821D58C2D51BCC30761E32CAD7BAECDAE5B1C445A2B9303DF810A4CA969
SHA-512:	536E0093C316E9503E27304135A82DE27C4770AF77805E809A8E1E9C4CCBE5D9D56995232F28FA2E7F0699CE56B64B5912CAFBCD7036846EFE9134AD60A2B30B
Malicious:	false
Preview:	Jan 9 10:48:23 galassia systemd[1]: Started Login Service..Jan 9 10:48:23 galassia systemd[1]: Started Getty on tty2..Jan 9 10:48:23 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Jan 9 10:48:23 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Jan 9 10:48:23 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 1..Jan 9 10:48:23 galassia systemd[1]: Stopped System Logging Service..Jan 9 10:48:23 galassia systemd[1]: Starting System Logging Service....Jan 9 10:48:23 galassia gdm3: GdmLocalDisplayFactory: Failed to issue method call: The connection is closed.Jan 9 10:48:23 galassia gdm3: Child process 1389 was already dead..Jan 9 10:48:23 galassia systemd[1]: session-c2.scope: Succeeded..Jan 9 10:48:23 galassia gdm3: Unable to kill session worker process.Jan 9 10:48:23 galassia gdm3: Child process -1463 was already dead..Jan 9 10:48:23 galassia gdm3: Failed to contact accountsservice: Error

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351417
Encrypted:	false
SSDEEP:	3:tCsXlXEWtl/5p+nl:tf+ylxQnl
MD5:	4C4E643D450D3E61CDE198556A36A9CB
SHA1:	BE39403EEA601545B54B56B04898F1ED3BE4B14E
SHA-256:	869DA1AF2C81052C9E19E6FD5AAC835B8ECDE0E728834FC3758424C9E55A11EE
SHA-512:	C1E351B02ED45A2B1742B02C4BF6B79804B71B52A07BD5A57CE65B30471134A9B106B27E365A65971E213AE2182CE9381D7EDE0E3AFABD4668598F4535A8E8FF
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN......................................................................................................................................................................................................................................................................................................g........................................

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.2509097331896815
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Fantazy.x86_64.elf
File size:	73'632 bytes
MD5:	b34ddc516fcce918035df6442d0e5ac6
SHA1:	e8440ad19475572f7a9bcf8824536b0affdd5d84
SHA256:	a769a12edb041a6e87ea892e47f75ff7a4dd6ba57a4ed5a8f8dcf4a9dd74b5a3
SHA512:	7bc1a1940be86bad197d43cc0730bd6bcaf1f1c09999d0fadb704dd76ab55eaa6f8b4471543f27e33be97d9f2616b8529c1003226478503a5dbbc66a6d283cbc
SSDEEP:	1536:LqO1qNU3qK2iAQDEI3QSzuig2UOXS4gT6Z6ojiQjEQ:LBqG6K23QDEIgZdOXZgTUqQjEQ
TLSH:	6F733A03A98599FDC088E07943BF7276C556B07D233AB1D777C8BF1A6805EA01F1E46A
File Content Preview:	.ELF..............>.......@.....@....... ...........@.8...@.......................@.......@...............................................Q.......Q.....8.......................Q.td....................................................H...._........H........

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	72992
Section Header Size:	64
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	1
.text	PROGBITS	0x400100	0x100	0x10246	0x0	0x6	AX	16
.fini	PROGBITS	0x410346	0x10346	0xe	0x0	0x6	AX	1
.rodata	PROGBITS	0x410360	0x10360	0x1740	0x0	0x2	A	32
.ctors	PROGBITS	0x511aa8	0x11aa8	0x10	0x0	0x3	WA	8
.dtors	PROGBITS	0x511ab8	0x11ab8	0x10	0x0	0x3	WA	8
.data	PROGBITS	0x511ae0	0x11ae0	0x200	0x0	0x3	WA	32
.bss	NOBITS	0x511ce0	0x11ce0	0x1088	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x11ce0	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x11aa0	0x11aa0	6.2917	0x5	R E	0x100000	.init .text .fini .rodata
LOAD	0x11aa8	0x511aa8	0x511aa8	0x238	0x12c0	2.9419	0x6	RW	0x100000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 17:48:22.518265963 CET	192.168.2.23	1.1.1.1	0x5cab	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 17:48:22.518265963 CET	192.168.2.23	1.1.1.1	0x5bd7	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Jan 9, 2025 17:48:22.802109003 CET	192.168.2.23	1.1.1.1	0xa652	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 17:48:22.526133060 CET	1.1.1.1	192.168.2.23	0x5cab	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Jan 9, 2025 17:48:22.526133060 CET	1.1.1.1	192.168.2.23	0x5cab	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2025-01-09 16:48:27 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2025-01-09 16:48:27 UTC	25	IN	HTTP/1.1 100 Continue
2025-01-09 16:48:27 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2025-01-09 16:48:27 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2025-01-09 16:48:27 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2025-01-09 16:48:27 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2025-01-09 16:48:27 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2025-01-09 16:48:27 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2025-01-09 16:48:27 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2025-01-09 16:48:27 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2025-01-09 16:48:27 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2025-01-09 16:48:27 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2025-01-09 16:48:28 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Thu, 09 Jan 2025 16:48:28 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	16:47:52
Start date (UTC):	09/01/2025
Path:	/tmp/Fantazy.x86_64.elf
Arguments:	/tmp/Fantazy.x86_64.elf
File size:	73632 bytes
MD5 hash:	b34ddc516fcce918035df6442d0e5ac6

Start time (UTC):	16:47:59
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:48:00
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:48:02
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:48:19
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:48:21
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:48:23
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:48:24
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:48:25
Start date (UTC):	09/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	16:48:26
Start date (UTC):	09/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	16:48:27
Start date (UTC):	09/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	16:48:28
Start date (UTC):	09/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	16:48:29
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Fantazy.x86_64.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6479/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:75802bUX8jU

/run/systemd/journal/streams/.#9:75803gWPC9U

/run/systemd/journal/streams/.#9:75985uHPCkX

/run/systemd/journal/streams/.#9:75994dxvC1V

/run/systemd/journal/streams/.#9:76000bFE1UV

/run/systemd/journal/streams/.#9:76012AT55vU

/run/systemd/journal/streams/.#9:76014I9dO4U

/run/systemd/journal/streams/.#9:764025KqBZT

/run/systemd/journal/streams/.#9:76701JlTbTV

/run/systemd/journal/streams/.#9:76706oYT2eX

/run/systemd/journal/streams/.#9:76777nptbvV

/run/systemd/journal/streams/.#9:76782A5ndPW

/run/systemd/journal/streams/.#9:76841mxGyRW

/run/systemd/journal/streams/.#9:76843H1r5qT

/run/systemd/journal/streams/.#9:76868O2hTAT

/run/systemd/journal/streams/.#9:77846rq7Y0X

/run/systemd/journal/streams/.#9:77868xWVzOV

/run/systemd/journal/streams/.#9:77869JLtwzW

/run/systemd/journal/streams/.#9:77888gkIivW

/run/systemd/journal/streams/.#9:77893AJwLQU

/run/systemd/journal/streams/.#9:79538eG5BWU

/run/systemd/seats/.#seat0NsG7ZA

/run/systemd/seats/.#seat0WOrYzA

/run/systemd/users/.#1272l8DmC

/run/systemd/users/.#12787UB7z

/run/systemd/users/.#127JYcLeB

Linux Analysis Report
Fantazy.x86_64.elf

Start time (UTC):	16:48:30
Start date (UTC):	09/01/2025
Path:	/usr/share/gdm/generate-config
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	16:48:32
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:48:42
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:48:44
Start date (UTC):	09/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	16:48:46
Start date (UTC):	09/01/2025
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	16:48:47
Start date (UTC):	09/01/2025
Path:	/bin/false
Arguments:	/bin/false
File size:	39256 bytes
MD5 hash:	3177546c74e4f0062909eae43d948bfc

Start time (UTC):	16:48:43
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	16:49:02
Start date (UTC):	09/01/2025
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Start time (UTC):	16:50:32
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre