Edit tour

Linux Analysis Report
Fantazy.arm7.elf

Overview

General Information

Sample name:	Fantazy.arm7.elf
Analysis ID:	1586921
MD5:	5a7465d45aae789d257ca9887ccff0ea
SHA1:	0d573afc8ecbba576f0da92bcc5e6bae93e773ff
SHA256:	38df10f58e558a78a8a10db7c7a6fc084f5efc600be2088110315850de13461d
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected Mirai

Contains symbols with names commonly found in malware

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "rm" command used to delete files or directories

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample and/or dropped files contains symbols with suspicious names

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1586921
Start date and time:	2025-01-09 19:02:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Fantazy.arm7.elf
Detection:	MAL
Classification:	mal80.spre.troj.linELF@0/44@3/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing network information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Fantazy.arm7.elf

Runtime Messages

Command:	/tmp/Fantazy.arm7.elf
PID:	6216
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	VegaSec-KATANA001
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6204, Parent: 4331)

rm (PID: 6204, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.WSIdxAlRWh /tmp/tmp.5OYodBEIkY /tmp/tmp.tVVeCqix2Y

dash New Fork (PID: 6205, Parent: 4331)

rm (PID: 6205, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.WSIdxAlRWh /tmp/tmp.5OYodBEIkY /tmp/tmp.tVVeCqix2Y

Fantazy.arm7.elf (PID: 6216, Parent: 6131, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/Fantazy.arm7.elf

Fantazy.arm7.elf New Fork (PID: 6218, Parent: 6216)

Fantazy.arm7.elf New Fork (PID: 6219, Parent: 6216)

Fantazy.arm7.elf New Fork (PID: 6222, Parent: 6219)

Fantazy.arm7.elf New Fork (PID: 6223, Parent: 6219)

Fantazy.arm7.elf New Fork (PID: 6226, Parent: 6219)

systemd New Fork (PID: 6231, Parent: 1)

journalctl (PID: 6231, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6248, Parent: 1)

systemd-journald (PID: 6248, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6252, Parent: 1)

journalctl (PID: 6252, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6321, Parent: 1)

dbus-daemon (PID: 6321, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6336, Parent: 1860)

pulseaudio (PID: 6336, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6341, Parent: 1)

rtkit-daemon (PID: 6341, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6344, Parent: 1)

systemd-logind (PID: 6344, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6406, Parent: 1)

polkitd (PID: 6406, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6407, Parent: 1)

rsyslogd (PID: 6407, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

gdm3 New Fork (PID: 6411, Parent: 1320)

Default (PID: 6411, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6413, Parent: 1320)

Default (PID: 6413, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6414, Parent: 1320)

Default (PID: 6414, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6420, Parent: 1)

agetty (PID: 6420, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6421, Parent: 1)

gpu-manager (PID: 6421, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6422, Parent: 6421)

sh (PID: 6422, Parent: 6421, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6423, Parent: 6422)

grep (PID: 6423, Parent: 6422, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6424, Parent: 6421)

sh (PID: 6424, Parent: 6421, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6425, Parent: 6424)

grep (PID: 6425, Parent: 6424, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6426, Parent: 6421)

sh (PID: 6426, Parent: 6421, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6427, Parent: 6426)

grep (PID: 6427, Parent: 6426, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6428, Parent: 6421)

sh (PID: 6428, Parent: 6421, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6429, Parent: 6428)

grep (PID: 6429, Parent: 6428, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6430, Parent: 6421)

sh (PID: 6430, Parent: 6421, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6431, Parent: 6430)

grep (PID: 6431, Parent: 6430, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6432, Parent: 6421)

sh (PID: 6432, Parent: 6421, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6433, Parent: 6432)

grep (PID: 6433, Parent: 6432, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6436, Parent: 6421)

sh (PID: 6436, Parent: 6421, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6437, Parent: 6436)

grep (PID: 6437, Parent: 6436, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6438, Parent: 6421)

sh (PID: 6438, Parent: 6421, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6440, Parent: 6438)

grep (PID: 6440, Parent: 6438, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6452, Parent: 1)

generate-config (PID: 6452, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6461, Parent: 6452)

pkill (PID: 6461, Parent: 6452, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6464, Parent: 1)

gdm-wait-for-drm (PID: 6464, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6471, Parent: 1)

gdm3 (PID: 6471, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6475, Parent: 6471)

plymouth (PID: 6475, Parent: 6471, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6494, Parent: 6471)

gdm-session-worker (PID: 6494, Parent: 6471, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6500, Parent: 6494)

gdm-wayland-session (PID: 6500, Parent: 6494, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6502, Parent: 6500)

dbus-daemon (PID: 6502, Parent: 6500, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6504, Parent: 6502)

dbus-daemon New Fork (PID: 6505, Parent: 6504)

false (PID: 6505, Parent: 6504, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6506, Parent: 6500)

dbus-run-session (PID: 6506, Parent: 6500, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6507, Parent: 6506)

dbus-daemon (PID: 6507, Parent: 6506, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6508, Parent: 6471)

Default (PID: 6508, Parent: 6471, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6509, Parent: 6471)

Default (PID: 6509, Parent: 6471, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6477, Parent: 1)

accounts-daemon (PID: 6477, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6489, Parent: 6477)

language-validate (PID: 6489, Parent: 6477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6490, Parent: 6489)

language-options (PID: 6490, Parent: 6489, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6491, Parent: 6490)

sh (PID: 6491, Parent: 6490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6492, Parent: 6491)

locale (PID: 6492, Parent: 6491, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6493, Parent: 6491)

grep (PID: 6493, Parent: 6491, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

gvfsd-fuse New Fork (PID: 6512, Parent: 2038)

fusermount (PID: 6512, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6557, Parent: 1860)

dbus-daemon (PID: 6557, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Fantazy.arm7.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6407)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /tmp/Fantazy.arm7.elf (PID: 6216)	Socket: 127.0.0.1:59025	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6471)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6502)	Socket: unknown address family	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 69.197.34.237
Source: unknown	TCP traffic detected without corresponding DNS query: 109.252.49.235
Source: unknown	TCP traffic detected without corresponding DNS query: 177.39.69.237
Source: unknown	TCP traffic detected without corresponding DNS query: 92.101.236.143
Source: unknown	TCP traffic detected without corresponding DNS query: 111.6.198.133
Source: unknown	TCP traffic detected without corresponding DNS query: 77.209.126.223
Source: unknown	TCP traffic detected without corresponding DNS query: 2.174.22.45
Source: unknown	TCP traffic detected without corresponding DNS query: 62.225.125.248
Source: unknown	TCP traffic detected without corresponding DNS query: 76.146.189.75
Source: unknown	TCP traffic detected without corresponding DNS query: 59.31.128.167
Source: unknown	TCP traffic detected without corresponding DNS query: 23.129.121.71
Source: unknown	TCP traffic detected without corresponding DNS query: 206.236.229.173
Source: unknown	TCP traffic detected without corresponding DNS query: 19.99.146.40
Source: unknown	TCP traffic detected without corresponding DNS query: 84.255.164.201
Source: unknown	TCP traffic detected without corresponding DNS query: 71.11.137.69
Source: unknown	TCP traffic detected without corresponding DNS query: 13.233.192.187
Source: unknown	TCP traffic detected without corresponding DNS query: 84.241.14.102
Source: unknown	TCP traffic detected without corresponding DNS query: 62.136.205.109
Source: unknown	TCP traffic detected without corresponding DNS query: 98.81.160.36
Source: unknown	TCP traffic detected without corresponding DNS query: 18.92.124.226
Source: unknown	TCP traffic detected without corresponding DNS query: 76.120.44.68
Source: unknown	TCP traffic detected without corresponding DNS query: 74.218.173.149
Source: unknown	TCP traffic detected without corresponding DNS query: 191.182.88.182
Source: unknown	TCP traffic detected without corresponding DNS query: 42.173.190.222
Source: unknown	TCP traffic detected without corresponding DNS query: 199.30.82.151
Source: unknown	TCP traffic detected without corresponding DNS query: 36.172.166.26
Source: unknown	TCP traffic detected without corresponding DNS query: 72.241.79.237
Source: unknown	TCP traffic detected without corresponding DNS query: 195.235.82.5
Source: unknown	TCP traffic detected without corresponding DNS query: 95.32.73.4
Source: unknown	TCP traffic detected without corresponding DNS query: 60.254.46.219
Source: unknown	TCP traffic detected without corresponding DNS query: 36.163.45.111
Source: unknown	TCP traffic detected without corresponding DNS query: 92.161.198.216
Source: unknown	TCP traffic detected without corresponding DNS query: 9.180.196.74
Source: unknown	TCP traffic detected without corresponding DNS query: 17.84.78.92
Source: unknown	TCP traffic detected without corresponding DNS query: 82.27.51.176
Source: unknown	TCP traffic detected without corresponding DNS query: 162.99.208.45
Source: unknown	TCP traffic detected without corresponding DNS query: 184.203.162.202
Source: unknown	TCP traffic detected without corresponding DNS query: 62.104.78.136
Source: unknown	TCP traffic detected without corresponding DNS query: 46.226.211.167
Source: unknown	TCP traffic detected without corresponding DNS query: 36.98.97.59
Source: unknown	TCP traffic detected without corresponding DNS query: 8.185.112.248
Source: unknown	TCP traffic detected without corresponding DNS query: 181.246.230.18
Source: unknown	TCP traffic detected without corresponding DNS query: 192.188.26.210
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.240.127
Source: unknown	TCP traffic detected without corresponding DNS query: 223.204.69.89
Source: unknown	TCP traffic detected without corresponding DNS query: 123.71.247.97
Source: unknown	TCP traffic detected without corresponding DNS query: 218.223.158.43

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.41.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38352
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Contains symbols with names commonly found in malware

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_app.c
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_get_opt_str
Source: ELF static info symbol of initial sample	Name: attack_gre.c
Source: ELF static info symbol of initial sample	Name: attack_gre_eth
Source: ELF static info symbol of initial sample	Name: attack_gre_ip
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_method_http

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 6041, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 6192, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 6193, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 6219, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 6223, result: unknown	Jump to behavior

Source: Fantazy.arm7.elf	ELF static info symbol of initial sample: __gnu_unwind_execute
Source: Fantazy.arm7.elf	ELF static info symbol of initial sample: scanner.c
Source: Fantazy.arm7.elf	ELF static info symbol of initial sample: scanner_init
Source: Fantazy.arm7.elf	ELF static info symbol of initial sample: scanner_kill
Source: Fantazy.arm7.elf	ELF static info symbol of initial sample: scanner_pid
Source: Fantazy.arm7.elf	ELF static info symbol of initial sample: scanner_rawpkt

Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 6041, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 6192, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 6193, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 6219, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm7.elf (PID: 6223)	SIGKILL sent: pid: 6223, result: unknown	Jump to behavior

Source: classification engine

Classification label: mal80.spre.troj.linELF@0/44@3/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6321)	File: /proc/6321/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6502)	File: /proc/6502/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6507)	File: /proc/6507/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6512)	File: /proc/6512/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6557)	File: /proc/6557/mounts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:75070MbriLF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:76240DtIMhG	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:76642phCrMD	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:76652odcbFE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:76653BNyseE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:76654JMoChF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:76655E0uGVF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:76773Jf6dQC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:76774tHwDED	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:77917utsqYC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:76974uFDpUE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:78224p6LXJF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:7833275mprD	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:77397yxbDpD	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:77551sU8fAE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:77579bsor6C	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:78591jlkhOE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:78593JdzruE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:78626d2BdWC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:786278qaOAD	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	File: /run/systemd/journal/streams/.#9:79477uDv1wF	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6344)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6344)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6344)	File: /run/systemd/seats/.#seat0VOtGrV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6344)	File: /run/systemd/users/.#127MrlFtV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6344)	File: /run/systemd/users/.#127GSvNWS	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6344)	File: /run/systemd/seats/.#seat0ygiw5R	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6344)	File: /run/systemd/users/.#127JRlgiS	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6344)	File: /run/systemd/users/.#127fTmcoW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6344)	File: /run/systemd/users/.#127SgNnIV	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6406)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6500)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6477)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6477)	Directory: /root/.cache	Jump to behavior

Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/3088/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/230/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/230/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/231/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/231/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/232/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/232/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/233/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/233/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/234/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/234/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/1335/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/1334/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/2302/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/236/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/236/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/237/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/237/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/910/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/910/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/6226/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/6226/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/2307/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/13/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/14/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/14/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/15/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/15/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/16/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/16/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/17/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/17/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/18/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/18/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/120/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/120/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/121/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/121/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/1/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/122/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/122/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/243/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/243/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/123/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/123/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/2/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/2/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/124/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/124/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/3/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/3/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/4/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/4/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/125/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/125/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/126/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/126/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/1344/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/248/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/248/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/6/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/6/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/127/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/127/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/128/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/128/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/249/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/249/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/9/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	File opened: /proc/9/cmdline	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6422)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6424)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6426)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6428)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6430)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6432)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6436)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6438)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6491)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Source: /bin/sh (PID: 6423)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6425)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6427)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6429)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6431)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6433)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6437)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6440)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6493)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6461)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /usr/bin/dash (PID: 6204)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.WSIdxAlRWh /tmp/tmp.5OYodBEIkY /tmp/tmp.tVVeCqix2Y			Jump to behavior
Source: /usr/bin/dash (PID: 6205)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.WSIdxAlRWh /tmp/tmp.5OYodBEIkY /tmp/tmp.tVVeCqix2Y			Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6248)

Reads from proc file: /proc/meminfo

Jump to behavior

Source: /sbin/agetty (PID: 6420)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6471)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6471)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6477)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6477)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6407)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6407)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 6421)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 6421)

Truncated file: /var/log/gpu-manager.log

Jump to behavior

Source: /usr/bin/pulseaudio (PID: 6336)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pkill (PID: 6461)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /tmp/Fantazy.arm7.elf (PID: 6216)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6248)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6336)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6407)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6420)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6421)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6494)	Queries kernel information via 'uname':	Jump to behavior

Source: Fantazy.arm7.elf, 6216.1.00007fff3b971000.00007fff3b992000.rw-.sdmp, Fantazy.arm7.elf, 6218.1.00007fff3b971000.00007fff3b992000.rw-.sdmp, Fantazy.arm7.elf, 6219.1.00007fff3b971000.00007fff3b992000.rw-.sdmp, Fantazy.arm7.elf, 6222.1.00007fff3b971000.00007fff3b992000.rw-.sdmp, Fantazy.arm7.elf, 6223.1.00007fff3b971000.00007fff3b992000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/Fantazy.arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Fantazy.arm7.elf
Source: Fantazy.arm7.elf, 6216.1.000055ca0115e000.000055ca012b0000.rw-.sdmp, Fantazy.arm7.elf, 6218.1.000055ca0115e000.000055ca0128c000.rw-.sdmp, Fantazy.arm7.elf, 6219.1.000055ca0115e000.000055ca0128c000.rw-.sdmp, Fantazy.arm7.elf, 6222.1.000055ca0115e000.000055ca0128c000.rw-.sdmp, Fantazy.arm7.elf, 6223.1.000055ca0115e000.000055ca0128c000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: Fantazy.arm7.elf, 6216.1.000055ca0115e000.000055ca012b0000.rw-.sdmp, Fantazy.arm7.elf, 6218.1.000055ca0115e000.000055ca0128c000.rw-.sdmp, Fantazy.arm7.elf, 6219.1.000055ca0115e000.000055ca0128c000.rw-.sdmp, Fantazy.arm7.elf, 6222.1.000055ca0115e000.000055ca0128c000.rw-.sdmp, Fantazy.arm7.elf, 6223.1.000055ca0115e000.000055ca0128c000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: Fantazy.arm7.elf, 6216.1.00007fff3b971000.00007fff3b992000.rw-.sdmp, Fantazy.arm7.elf, 6218.1.00007fff3b971000.00007fff3b992000.rw-.sdmp, Fantazy.arm7.elf, 6219.1.00007fff3b971000.00007fff3b992000.rw-.sdmp, Fantazy.arm7.elf, 6222.1.00007fff3b971000.00007fff3b992000.rw-.sdmp, Fantazy.arm7.elf, 6223.1.00007fff3b971000.00007fff3b992000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: Fantazy.arm7.elf, 6223.1.00007fff3b971000.00007fff3b992000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.8KuAqK
Source: Fantazy.arm7.elf, 6223.1.00007fff3b971000.00007fff3b992000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.8KuAqK@

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6477)

Logged in records file read: /var/log/wtmp

Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match

File source: Fantazy.arm7.elf, type: SAMPLE

Remote Access Functionality

Yara detected Mirai

Source: Yara match

File source: Fantazy.arm7.elf, type: SAMPLE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File and Directory Permissions Modification	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Hidden Files and Directories	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Indicator Removal	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Fantazy.arm7.elf	68%	ReversingLabs	Linux.Trojan.Mirai
Fantazy.arm7.elf	100%	Avira	EXP/ELF.Gafgyt.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.41.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
81.177.222.184	unknown	Russian Federation	8439	AISTTogliattiRussiaRU	false
165.64.168.69	unknown	United States	37053	RSAWEB-ASZA	false
162.106.108.199	unknown	Canada	395660	EDMONTON-CA	false
74.157.241.221	unknown	United States	7922	COMCAST-7922US	false
196.149.161.189	unknown	Egypt	36935	Vodafone-EG	false
36.184.247.114	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
115.249.70.120	unknown	India	18101	RELIANCE-COMMUNICATIONS-INRelianceCommunicationsLtdDAKC	false
123.228.188.208	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
173.219.190.218	unknown	United States	19108	SUDDENLINK-COMMUNICATIONSUS	false
48.205.4.169	unknown	United States	2686	ATGS-MMD-ASUS	false
90.183.38.162	unknown	Czech Republic	5610	O2-CZECH-REPUBLICCZ	false
19.32.97.194	unknown	United States	3	MIT-GATEWAYSUS	false
88.28.62.30	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
12.230.246.247	unknown	United States	7018	ATT-INTERNET4US	false
111.57.201.7	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
120.188.6.242	unknown	Indonesia	4761	INDOSAT-INP-APINDOSATInternetNetworkProviderID	false
4.83.94.141	unknown	United States	3356	LEVEL3US	false
153.15.74.170	unknown	Norway	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
42.116.101.95	unknown	Viet Nam	18403	FPT-AS-APTheCorporationforFinancingPromotingTechnolo	false
161.212.229.85	unknown	Venezuela	6306	TELEFONICAVENEZOLANACAVE	false
35.63.72.54	unknown	United States	397797	CITYOFMARSHALL-01US	false
198.219.9.194	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
83.152.45.238	unknown	France	12322	PROXADFR	false
66.35.37.164	unknown	United States	32150	TUMMY-COM-LTDUS	false
48.12.255.202	unknown	United States	2686	ATGS-MMD-ASUS	false
96.69.159.234	unknown	United States	7922	COMCAST-7922US	false
37.19.116.24	unknown	Israel	50463	TRIPLEC-ASNIL	false
94.57.97.78	unknown	United Arab Emirates	5384	EMIRATES-INTERNETEmiratesInternetAE	false
148.43.147.37	unknown	United States	6400	CompaniaDominicanadeTelefonosSADO	false
88.51.202.237	unknown	Italy	3269	ASN-IBSNAZIT	false
78.130.136.184	unknown	Bulgaria	29667	ATLANTISNET-ASBG	false
70.137.109.223	unknown	United States	7018	ATT-INTERNET4US	false
198.141.94.126	unknown	Czech Republic	2571	DHLNETCZ	false
62.195.215.33	unknown	Netherlands	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
110.112.199.124	unknown	China	38341	CNNIC-HCENET-APHEXIEInformationtechnologyCoLtdCN	false
135.195.142.99	unknown	United States	14962	NCR-252US	false
190.140.187.31	unknown	Panama	18809	CableOndaPA	false
27.162.177.170	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
107.24.161.101	unknown	United States	14654	WAYPORTUS	false
44.214.166.227	unknown	United States	14618	AMAZON-AESUS	false
113.42.214.139	unknown	Japan	17506	UCOMARTERIANetworksCorporationJP	false
123.225.146.75	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
13.153.80.147	unknown	United States	7018	ATT-INTERNET4US	false
213.21.57.132	unknown	Russian Federation	39102	AS-ATHMbrandAtHomeRU	false
83.186.136.128	unknown	Sweden	1257	TELE2EU	false
91.184.124.200	unknown	Georgia	41738	MOBITEL-GE	false
167.30.253.132	unknown	Australia	7838	USAAUS	false
204.169.128.213	unknown	United States	8148	SOURCEWELL-TECHNOLOGYUS	false
93.41.107.75	unknown	Italy	12874	FASTWEBIT	false
60.120.23.222	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
87.40.149.110	unknown	Ireland	1213	HEANETIE	false
75.228.73.154	unknown	United States	22394	CELLCOUS	false
106.134.247.245	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
202.228.39.39	unknown	Japan	4680	MINDMitsubishiElectricInformationNetworkCorporationJP	false
46.180.27.225	unknown	Russian Federation	39927	ELIGHT-ASRU	false
202.75.62.101	unknown	Malaysia	17971	TMVADS-APTM-VADSDCHostingMY	false
24.210.145.230	unknown	United States	10796	TWC-10796-MIDWESTUS	false
183.162.114.89	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
19.231.228.130	unknown	United States	3	MIT-GATEWAYSUS	false
70.139.223.83	unknown	United States	7018	ATT-INTERNET4US	false
188.2.197.91	unknown	Serbia	31042	SERBIA-BROADBAND-ASSerbiaBroadBand-SrpskeKablovskemreze	false
111.196.69.197	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
146.246.148.234	unknown	United States	3562	SNLL-NET-ASUS	false
153.126.118.110	unknown	Japan	7684	SAKURA-ASAKURAInternetIncJP	false
186.166.20.214	unknown	Venezuela	6306	TELEFONICAVENEZOLANACAVE	false
188.135.192.244	unknown	Italy	48291	ARIASPAIT	false
95.124.77.210	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
72.74.204.49	unknown	United States	701	UUNETUS	false
114.94.128.89	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
211.118.160.11	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	false
170.213.54.64	unknown	United States	46274	UPHSUS	false
167.224.54.92	unknown	United States	2897	GEORGIA-1US	false
178.210.23.124	unknown	Russian Federation	31214	TIS-DIALOG-ASRU	false
153.105.55.90	unknown	United States	195	SDSC-ASUS	false
19.166.69.128	unknown	United States	3	MIT-GATEWAYSUS	false
193.54.61.162	unknown	France	2471	FR-DOM-GUADELOUPEIlesdelaGuadeloupeEU	false
80.223.166.58	unknown	Finland	1759	TSF-IP-CORETeliaFinlandOyjEU	false
189.162.46.253	unknown	Mexico	8151	UninetSAdeCVMX	false
75.108.135.152	unknown	United States	19108	SUDDENLINK-COMMUNICATIONSUS	false
166.46.144.7	unknown	United States	3372	MCI-ASNUS	false
64.33.58.175	unknown	Japan	24255	T-CATVTannanCableTelevisionCorporationJP	false
24.16.109.36	unknown	United States	7922	COMCAST-7922US	false
35.187.55.197	unknown	United States	15169	GOOGLEUS	false
77.87.187.60	unknown	Germany	203085	WIDAS-ASDE	false
73.4.240.21	unknown	United States	7922	COMCAST-7922US	false
35.93.89.129	unknown	United States	237	MERIT-AS-14US	false
12.127.217.95	unknown	United States	7018	ATT-INTERNET4US	false
182.7.179.145	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
117.38.62.195	unknown	China	4809	CHINATELECOM-CORE-WAN-CN2ChinaTelecomNextGenerationCarr	false
147.108.60.137	unknown	United States	54363	BHIUS	false
149.50.117.107	unknown	United States	174	COGENT-174US	false
201.89.15.64	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
71.251.6.67	unknown	United States	701	UUNETUS	false
172.170.189.138	unknown	United States	7018	ATT-INTERNET4US	false
82.255.163.5	unknown	France	12322	PROXADFR	false
111.57.166.73	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
106.17.167.20	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
69.150.22.155	unknown	United States	7018	ATT-INTERNET4US	false
219.50.39.138	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
114.223.205.36	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
111.57.201.7	WrTrAHLpf8.elf	Get hash	malicious	Mirai	Browse
162.106.108.199	oUcRbdZNAx.elf	Get hash	malicious	Mirai	Browse
162.106.108.199	apep.x86	Get hash	malicious	Unknown	Browse
83.152.45.238	3iy1HRKlrm	Get hash	malicious	Mirai	Browse
12.230.246.247	xd.arm7.elf	Get hash	malicious	Mirai	Browse
12.230.246.247	a9978gmF7i.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	2.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Fantazy.i486.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Fantazy.x86_64.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Fantazy.arm5.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Fantazy.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	sora.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	sora.m68k.elf	Get hash	malicious	Unknown	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AISTTogliattiRussiaRU	loligang.mpsl.elf	Get hash	malicious	Mirai	Browse	81.28.188.9
	W6Z9uSRsKQ.elf	Get hash	malicious	Unknown	Browse	5.28.25.46
	jew.mpsl.elf	Get hash	malicious	Mirai	Browse	109.226.104.82
	x86.elf	Get hash	malicious	Mirai	Browse	85.114.183.234
	PBEZlc6yX7.elf	Get hash	malicious	Mirai	Browse	213.178.45.65
	1gx339YsKN.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	5.28.25.19
	16bfcGvz5N.elf	Get hash	malicious	Unknown	Browse	109.226.104.24
	H6ccnU1094.elf	Get hash	malicious	Mirai, Okiru	Browse	5.28.25.18
	aga94GHd1L.elf	Get hash	malicious	Mirai	Browse	213.178.33.93
	bot.arm-20240324-1846.elf	Get hash	malicious	Mirai, Moobot	Browse	5.28.25.15
EDMONTON-CA	http://11ofus.ca	Get hash	malicious	Unknown	Browse	162.106.2.46
	nshkarm5.elf	Get hash	malicious	Mirai	Browse	162.106.108.173
	rebirth.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	162.106.226.4
	jew.x86.elf	Get hash	malicious	Unknown	Browse	162.106.108.158
	sora.mips.elf	Get hash	malicious	Mirai	Browse	162.107.20.49
	fbot.m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	162.107.20.49
	arm5.elf	Get hash	malicious	Unknown	Browse	162.106.108.186
	X309qRfJAl.elf	Get hash	malicious	Mirai	Browse	162.106.108.170
	SecuriteInfo.com.Linux.Siggen.9999.29695.14613.elf	Get hash	malicious	Unknown	Browse	162.106.108.185
	Pn0jlaHvxE.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	162.107.32.146
COMCAST-7922US	6.elf	Get hash	malicious	Unknown	Browse	174.166.47.244
	Fantazy.i486.elf	Get hash	malicious	Unknown	Browse	73.147.9.190
	Fantazy.x86_64.elf	Get hash	malicious	Unknown	Browse	96.98.176.168
	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	73.123.188.204
	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	174.181.88.2
	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	73.106.17.236
	sora.mpsl.elf	Get hash	malicious	Unknown	Browse	98.46.251.43
	sora.m68k.elf	Get hash	malicious	Unknown	Browse	184.115.101.239
	sora.ppc.elf	Get hash	malicious	Unknown	Browse	24.13.36.36
	sora.mips.elf	Get hash	malicious	Unknown	Browse	76.134.50.39
RSAWEB-ASZA	4.elf	Get hash	malicious	Unknown	Browse	41.71.246.57
	6.elf	Get hash	malicious	Unknown	Browse	41.71.246.148
	6.elf	Get hash	malicious	Unknown	Browse	41.71.222.53
	3.elf	Get hash	malicious	Unknown	Browse	41.71.234.77
	3.elf	Get hash	malicious	Unknown	Browse	41.71.210.9
	5.elf	Get hash	malicious	Unknown	Browse	41.71.111.144
	gmpsl.elf	Get hash	malicious	Mirai	Browse	41.71.222.55
	goarm.elf	Get hash	malicious	Mirai	Browse	41.71.222.58
	6.elf	Get hash	malicious	Unknown	Browse	165.41.215.69
	sora.ppc.elf	Get hash	malicious	Unknown	Browse	165.41.240.30

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/6505/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Z:Z
MD5:	CFCE1ACA37F798786F8AB09E6B1CE6CD
SHA1:	8732052601CB54497BE227DAE5CDD7F60D2030C3
SHA-256:	2D1D0E095047F3FD8B4DF1AF97A7340F77E74F3C12427A1832E1007A98EA507A
SHA-512:	DDCB285BB579E1900BACAC4B7B8D95DCDAA68CFEA8FD0110113FBE28F4516088B137D45C54E1C3657E86C183CDD07127C89E71B6DB7CD69287FA89BD4E3718C1
Malicious:	false
Reputation:	low
Preview:	6471.

/run/systemd/journal/streams/.#9:75070MbriLF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.472810731873811
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8wdVAXHUr+8R8QEjH:SbFuFyLVIg1BG+f+M8wQXHBd2ji4s
MD5:	CE873E0406AF3F7DD41BFB65205B321D
SHA1:	65B1A5000C5B291958C50EFFA55CDB5D9006CF3A
SHA-256:	482C773BD256A28674A022C1DA442C4A4D14BA8B313418EE6A030057785D5360
SHA-512:	07963001DFA130F54F19E89CD49D0DDC446A0FB6DA10193D44052DB317EF94E82F84A8416671DD4C6A558FEDFCD0E3D18432DE5651C483C81CF1069DB3632C27
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=69d80e99eabf4c0da29884a09ff01f06.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76240DtIMhG

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.515254776638512
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9bydMeGcP8js7LbgS:SbFuFyLVIg1BG+f+MxOMeGcP8ji4s
MD5:	DAABABB1E1262532ECCEB770B8924913
SHA1:	66250E62F6CCF55A574E0C8FA2E0AD8BB105F754
SHA-256:	0208708FE0B54770B6BCCFD875B35F439744D85B9EF4046CB81A3452B60FC51D
SHA-512:	9223EA1B478F9F3A75217F209C0CF72976D55B11D02BB9745646144623DD4797FC9302319A850A2A87FB67F5D6A623D5C6D2C4E70DE2666DFAA64A8356341C4D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7a8c6a671bf848d5bf97dbe87efc9cde.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76642phCrMD

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.424579089924445
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6Atqxsj2Auxsjs1Ha:SbFuFyLVIg1BG+f+M6A83RqjosQu
MD5:	055B2387F0B3F2CFB8242D276AB9149F
SHA1:	D6C9EF54DBF24340892749B591C18FC413CDD051
SHA-256:	45294FE4E23D3EB5C61472B1DE8D97878C660187E47618B26A11470A6D3ED8CA
SHA-512:	FB007AB0D5F4A4B2E0EE7F4D0C1744BA414A51C4177F30083FA50ADC4A410218F13DA200F928CEF91BF14B21205F1E974FC2C752BE5A51936A2292E957BB403A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0509985c42c449ee828e3f7d381bcdd1.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76652odcbFE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.437185342594402
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M4JDmNkZnrqjFmzXvn:qgFqo6g7/+0+f+M4JDmSr4QXvn
MD5:	1FBEC0593EE45A0659BA49C5F93FBDCF
SHA1:	DA4CAB22E8306E8173D5253E1A396C411F18C272
SHA-256:	CE678397A0240B754E239282F80BADE00C271E4AEB30184AE884BFF0E6125C28
SHA-512:	76629AC13B966CA22E248B40EAEA016FB46563CFA2C725E8D0DCAD2F204E44E6B429B80BD7764E6B1982C6D5328438B3C94B304D08A4FA46F8A04561100DB6F9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=21b3f1f7fa534c4eb4d126a743a42cf7.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:76653BNyseE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.425442764866418
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MidBxdujFmzXvn:qgFqdg7/+0+f+M+BbsQXvn
MD5:	F32AADB1CA765B79E89493F760FB8414
SHA1:	E4168D0C8D0155377AF77E253FE6C8BF8E166104
SHA-256:	595E79A6FDA2F6D2605262692ABB27D78B4A9C6A7B5D7FD9A10617B38B608BEA
SHA-512:	17AED3DAB2F43BFAC24254B55E5DA49F85171699DD8FF00FCCED82D8991BC7B6CBE467EE1641214E1C5E599914755EBC9BF6D3102A71DCA93DC93461420CB781
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3b09769dd61644fdb58df84f0e76818a.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:76654JMoChF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.397881407217336
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoGytWQq/3Uh+sjsmM:SbFuFyLVIg1BG+f+MoDt7hTjdCLKzK
MD5:	FB72CB32D6C851C0164E82E0BFDA52C5
SHA1:	A6BF58C85793E53BF952B15E2F469232042D60D2
SHA-256:	F1EDB62C59A84FF4BF3BC08B221111FBE645864579F419A6E37A3B2B46780910
SHA-512:	5C0C8881263F24ED8778C34D9AB1BBE3DB841CCFB29BFC622ABC7815015CA3CF0C86E3D62AF76C0C38C4E9E58F85E83614AF395583110F23954FDAADF20193C7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bc41aa95b67a4d87acd53d189004286b.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:76655E0uGVF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.384124952963473
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyEaHAts9AAxxsjshQ:SbFuFyLVIg1BG+f+MyEagts9A8qjtWL0
MD5:	874A163F6466A1F19FE9752C0800E384
SHA1:	2E21AE94460F6CF0066ED010A7A3A8CB5258D6EC
SHA-256:	7F4D935207FEF7DF8C51EAAD7ECF5CAC89F7A4495F15579BD91AE870F34020F5
SHA-512:	533ED42D8177658C0D95B6FB2AE6CEFE32D202776C45CBE23F3C2C85B1598794DC9B618A5AB2EE500E5C05D75B38571181D40903320936D5C72754CB853CDFD4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=83f1fb5032f94028bb6e795885ad8e1c.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:76773Jf6dQC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.479354428169841
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/Vz1ZGHyX9+Rxsjsx:SbFuFyLVIg1BG+f+MfXYqjNE
MD5:	514A7C9BADD24C8D00E44A66E8BCB29B
SHA1:	C255CCEC89B4F44079911A6BE3309AE5BE1832FE
SHA-256:	42B1E0C3CB553E75D1325A82D8C79601755A7D39F3CB0BB8EACA35CA6CE6F791
SHA-512:	87AD6BBA29B77EA4EE455DAE33EB0103F9F2969C6548B1E427138862C339CA92ACCD7AF9ADDAADB7DEBF47433A1AF55383EA1095C8C3C9027668F4B7E5DB2055
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=537c9ffdf439439981cbf8a29d254661.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:76774tHwDED

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.4718757223667325
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8EX4RidhaG1f2jsig:SbFuFyLVIg1BG+f+M8b0C62jZcHcljX+
MD5:	895FAC0A9728CF7DB1995FF7340DE6E3
SHA1:	F4E8EC3CB3F2D91AA1AF77F9C6BCC4BFEDDF254D
SHA-256:	EA269405327271B20AD9A7FB19BF3A1BE87F516543F21481C58EDAE030D6C345
SHA-512:	33E6A7AAD607E650603651E082A6C815C1B8C0101C05E0A6BAF10F46D900756B9B721BD8E7AE59DFC07151CA3EC2286024F3C774ED666F11779BC9A01E4ABA47
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6ab9c8a8165444a8ac608ff56d134368.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:76974uFDpUE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.409172347340399
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvAAUhScGKpxMxsjsV:SbFuFyLVIg1BG+f+Mo5h/jLkGq
MD5:	76BF960F4A45A86439244C6FF80E6A89
SHA1:	6CA8D7C6DD310721CFA9D641B8A2E340185BCF18
SHA-256:	D577F509C02B8FCC5C61ABC1D7C156562828208F9762900A5D3D2B3C2EFA8CC1
SHA-512:	EBB55AC17904C601D080CF1BC8C254C08BCEDCD6D8569D864220F34191AB47FA10A7B19C756B6172DD291D9B87AF315CD87E48CABE487E550800DB2E553070B9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e50ed41d27844aa594f7ef79683f6fc0.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:77397yxbDpD

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.434479105388196
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MuQVdRqssZjNdQIeXD:qgFq6g1af+Mftp+2D
MD5:	456B34CDF64E1B2CEF98E76E5BE4C192
SHA1:	23F84658A2075BE46CF02F8338AD27448382EC90
SHA-256:	089AA306E28BA7F65ADDE685E5A9E4F2ECB9491676A95AEB6A04B421C8C01327
SHA-512:	5D153A24EB449288FAED842C1346F70A8D234728F97B3E1541A32802C9BF13EB94F8F66195672C80723A49CA15005F7D3EE9592A42635A9B3A95316C32ADE0E1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d0419382f2ce44df864434d0d7c371ae.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77551sU8fAE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.333419233142196
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MupRDEO0VAX2Xe5qjNTZD:qgFq6g1af+MqD10shwTZD
MD5:	B90B9D16E55B2B76ABF46E76615DA60F
SHA1:	43106693DFE72EE61986849F58ADDD56A0A82924
SHA-256:	1B84224E893DBBBB152CFD8B21BA408E5084421DF60E0B057B181B5325BBA1CA
SHA-512:	A3905341766A29F4DAD940C1E0BD7DD9161887DA4A0835F2B8A34775CB327ED1AE17EB92D401F2E093466325BE479EC1F58B4F9CBD6FE7E3D4D6794EC74274DC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dcdd2d4a4a4e429da7127b0e243f21a9.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77579bsor6C

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.431431389250371
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MsIDiV8jjLTTIWTIL:qgFq6g10+f+MsIDrEWEL
MD5:	EF919AD65A89E64115D3E7C27894F394
SHA1:	C1F0425BE0506B0280CA8307B13BA2ACE0C16586
SHA-256:	41B76AF1DEE7BEB0C779AF90535C5CD54BC74ABA85A2651C848270D350DBC1BB
SHA-512:	F6542910AF49FED6DF5BA94A740AC16EBB3479897E970332396DE03B072B30D399FEC44C69A149C2E25DC416A0F512E343AA67147EC69129583C87B75E480A08
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f081df2e929f4ecebf5955ee1637e82e.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:77917utsqYC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.32573043335777
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8AHOaFkqpUVZvsjs1:SbFuFyLVIg1BG+f+M8guqpUL0jbVC
MD5:	A7A832D2764C5F77AD9A6952757161A2
SHA1:	1FCAC3F76753B3C4CDCA27637D2BBE384A116B49
SHA-256:	B5A608FD5392DF70CE9A1F5EAF311E836B56845E9091B43C3F0692BA6669F875
SHA-512:	C7BC8790D662BE27305403D9FD3B146080FBC0C97CDE0DD281DB83A86DD517A6CF2EEDB9C788AC704C33CAAD7FAF74DA8DFB43B539EC994185678704035C7B2D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6efdea121f4244a186a70e04af0f1060.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:78224p6LXJF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.417039118175841
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvm7Wic0TUmF2jsmNu:SbFuFyLVIg1BG+f+MW/c0WjdCt/rRMtq
MD5:	D5FF4E352166C582655FD6F54231434A
SHA1:	D9BC37082C6F48B3A2BA37107484088C24B1F842
SHA-256:	EBDB102CCBA9E2F1DA94B0650036B2CDCDB0CAC11F86B4C6798B09A9830DDB0D
SHA-512:	D442D7C973EE71ADF4701117A63898ED8C1B9CC3398F67762D35A7B1FA7740227CC0AB2EFBB5000C6E33025CA99F3AEA9AE7D7081E1CE4028EA7E480928BC040
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ed4700f5a3a94cf3b44ba033f61bdbe6.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:7833275mprD

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.41199170812966
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmoBfSU8kmwB1BJZjs2Ax:SbFuFyLVIg1BAf+MoBPDPJZjNALyAZD
MD5:	0AD0660EE5BE1472C65713C39717D5C6
SHA1:	4AB3FB6B7EEE20D468622B8CA7CF310F8C563E1C
SHA-256:	6A088126D6807FC9404510A5A45DB3064C83FC43A376A92CBC0EB8D8CCC67CE6
SHA-512:	CB3C5D0EAD62324CF46BF831F49797F4EACCD99A3A1444F2B7EFB3FF5B85BB3C383779044EA122113CB16644CB038F93B3DCCC6B6CCEE26E155E2FA772C8809D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bd594f417d31492ba02ab5d9ada7ba0f.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78591jlkhOE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.350879299073811
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm7WLMB1IlRl0wsjk:SbFuFyLVK6g7/+BG+f+MCLMUgjNq
MD5:	C1D14A0743B926CCD430FFD61E5D1900
SHA1:	6A6CDF3738F5A228B43329C695531B8F0DC9C3F5
SHA-256:	88E4E9FF6BB02E22380F5931BB0BD4020A1946DB32A904D608E6FEAB90CA1914
SHA-512:	E248E0328016492BC918F9D876228F173CFC14D84A8AA54DD2D463781E4FD68557FFCF05F8FA8D83F141AB962AF65169A4113595A4B916F9F911AA096B8AED74
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1cd0804884de4deeba50141744ad9d82.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78593JdzruE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.355906401187518
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm8TU0ZESBUd6+sjk:SbFuFyLVI6g7/+BG+f+M8v66TjNq
MD5:	F5949FD5738AFB1ADC03FED95DDD3AB5
SHA1:	398A9C0C2FBE261B4B931366AEB4A0802A14A516
SHA-256:	0AD8B6BD397D5622358FA3256F0528E0734AB53B00DDAE591629FB2AAF505899
SHA-512:	1C35BF4AC0F2C80258DC8B16811BC9C441A19780272A7D27740BA7FBBCDEDB6D8D52DF362B050128C3001D6798B842DF9C8A4FEF94F0EBE936412C78DCD8A687
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=60658a75100e4b06a6181cbd5d86e171.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78626d2BdWC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.491688356642398
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MyTcFqvIATjFQMzKaBu:qgFqo6g7/+0+f+M4cFqvHNTmh
MD5:	40B82D40442D8998B1F6AB2AA09666A3
SHA1:	C00F885A31E28B50EDFF192BC16BAFFFC1624BEE
SHA-256:	779F92500E617A0080DBE1F9A8693C7F329FAE025943A1739E01CFF14C899563
SHA-512:	2693F6515168DADCB4DFFDE8A99734DFA4E76B975F6E9502602EA44ABD7C9FB06D06128D72F06123C488B6741748B70D6A21205A86464DEB344C5B2BEE29DD04
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=85989cf9f70e4566ae703e9688d5e799.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:786278qaOAD

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.470981139758604
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M+FMnolWPrjFQMzKaBu:qgFqdg7/+0+f+MhCq1Tmh
MD5:	0EAD0009416A57F7C50E97E7414D11F0
SHA1:	F07230F1892B5A702B8972781157EC4F2E08F3F9
SHA-256:	0F426D7DA52A682101038B1C1DBC0ADB6BBA0D7D7A4209F90264D2946E29BF41
SHA-512:	6D656D38953A9065FBC239C5B7DFA7B01D6EE946F89B3DB18269360C2DA1CBEE6E13C993B2C32D5C5590B6B5BC33E08CD8E9573AA092FAFC0390CD72E4C38F74
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4a1a367ddb3d4e5cbbe4ff4f3ce66b1b.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:79477uDv1wF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.350880797299629
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/HjJmrca+VUYosMxQ:SbFuFyLVIg1BG+f+Mrk5q8Rqjoa
MD5:	90E889D25ACA3247A0E2100C5769DB9D
SHA1:	04B114E5E5D341372C1E0C5C5C651E5F2C67B3F9
SHA-256:	424F7C2B801D1F5788072A7D6FE4582E997B8F63E91D20B4AE8275BFBCC01652
SHA-512:	AAB8F8F220FBAA78A28EE2443CDC88897BA17F69B7C8608DCE8B12C23799A7964B8D1CBF50CFEBCAC15B9025890731BE45967B92EBA4684A1F49FBD1ACC742B0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5573efee655945d99fcd157017af6d33.IDENTIFIER=dbus-daemon.

/run/systemd/seats/.#seat0VOtGrV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0ygiw5R

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/users/.#127GSvNWS

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2954312063323785
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gDWKOn2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+gDXO2thQHtPYq9M
MD5:	E69FBC960B0C719D260A8F3DCBB2D236
SHA1:	FF61517FDC0581C92662C2B90FE07710280573CB
SHA-256:	00B78A727FBD734414A5D87F5481778BD8D8BA4B409D640BBBC1B03FA8D344AD
SHA-512:	ECE594A80C009E524EB98CAC29A8710675B22A44A0607110524840AA46BFBB3E12F4540E94FAB95D6D42CB21D1615C1170CCF4B060277BBE74124175D4EA2B75
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1736445830621805.MONOTONIC=473811808.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127JRlgiS

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2954312063323785
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gDWKOn2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+gDXO2thQHtPYq9M
MD5:	E69FBC960B0C719D260A8F3DCBB2D236
SHA1:	FF61517FDC0581C92662C2B90FE07710280573CB
SHA-256:	00B78A727FBD734414A5D87F5481778BD8D8BA4B409D640BBBC1B03FA8D344AD
SHA-512:	ECE594A80C009E524EB98CAC29A8710675B22A44A0607110524840AA46BFBB3E12F4540E94FAB95D6D42CB21D1615C1170CCF4B060277BBE74124175D4EA2B75
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1736445830621805.MONOTONIC=473811808.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127MrlFtV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127SgNnIV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.4744075398469
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6lgTgDWKO4t6Qn:qgFq30dABibB3TgDXO4IQn
MD5:	DD9604A87607BCDBD2CBDF057F2D4B75
SHA1:	2587ADB82F03945CD923510CCE9E5D80BF0FC6FC
SHA-256:	60E85A10208905FBFBE29A6AF2543D915ADFECBC974228F62F5E3DA0FE06DD72
SHA-512:	31C73CC233A8F176480F47618E2E6E4F462B2F81A46A9DDF6FCCF0A310C9FE74B08C93A6A2DBDC517625CED1DEA81281D2D14B3D6FA53F3F1AA752D73CEAFE1C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12412.REALTIME=1736445830621805.MONOTONIC=473811808.LAST_SESSION_TIMESTAMP=473910440.

/run/systemd/users/.#127fTmcoW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.32546162131448
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgDRbUX6o/x4QTg206qodDMRDn:SbFuFyL3BVgdL87iesnAiRJgDWKO4t6Q
MD5:	4EBBA3AD983EF52128CF678EF1DEE76A
SHA1:	4467F849B86C33A985A2F43185255D318FBEEA08
SHA-256:	4F52B632FCAD9012C4F66E57D2C6FC64259807ECA73A2E38D69820AC0F6CB4D5
SHA-512:	B8C52E27E576C1C42C80FEAF54482C54DEE2BDB0EA05226E8195CE0BB0D1A10308A9135664D2C57E66E8C6CCCA521CD7009950F023ADBE51B25CDD2899565340
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1736445830621805.MONOTONIC=473811808.LAST_SESSION_TIMESTAMP=473910440.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.5219280948873621
Encrypted:	false
SSDEEP:	3:dj:J
MD5:	5FC77DCCF0EFC30E3C69B7DCEEECF389
SHA1:	3B0255FD55F52F80F4086713174995D855AE29CE
SHA-256:	6B6388156BBDBB41C5D7670CEB44DA7DDF7319F2D652B736435261FE96E317DC
SHA-512:	F6B6FE318E8989E087425978D0E3F5A8E23A1DEA4A75517B0051D4C3173F9B096576174F7B5185CD421644111198B12FF511458EDABD6E9E6B7C61336F1FBC40
Malicious:	false
Preview:	6336.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:A61sXlXEWtl/YWeOvt:AV+ylAst
MD5:	695D76F34E9177108CE73BA78FD17E51
SHA1:	DB3B8E05732C92836FF3525D3B3159D3624E8033
SHA-256:	A46A80B3502A3F8B45A85A388A3F81ABBEB1CCC8378624BB6D24034E72AAE92D
SHA-512:	76028E12D1B49518B3C729BDAC74B98233B34ED389A1EA36DE3AAD41FC2EF0233B5B3267C0E05FEC7A804C7061F59F165774B682EBA6D3FE19F7478B9748F5D7
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................i..g........................................

/tmp/qemu-open.8KuAqK (deleted)

Download File

Process:	/tmp/Fantazy.arm7.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	3.5200302942967485
Encrypted:	false
SSDEEP:	6:NgDF6ElAX6/VUd/vYDF6El0/ImY/VEXM/VjmsVot/VOArB/VH:NYNlArdHQNl0/I2Xfl
MD5:	BE4CC7D0E2320E7D1C6072CEBACF4906
SHA1:	9034F2D38C70F326D05BC5D533A696B15FF5AD4D
SHA-256:	1F4705A052148D768605374E1B6BC2E4BFD73CCBB220F569C1704BAA1974B2E3
SHA-512:	35520E5C425BFFC18CD9B600DD23D29DF284E24B7719E43E9D4AA77A28EF2EB3B4BC45F7E9C2534B3748AEE514BE89F78BEA7FA456FBEA61DCE95D707A0A8A50
Malicious:	false
Preview:	8000-20000 r-xp 00000000 fd:00 531606 /tmp/Fantazy.arm7.elf.20000-21000 rw-p 00018000 fd:00 531606 /tmp/Fantazy.arm7.elf.21000-26000 rw-p 00000000 00:00 0 .26000-27000 rw-p 00000000 00:00 0 .ff7ef000-ff7f0000 ---p 00000000 00:00 0 .ff7f0000-ffff0000 rw-p 00000000 00:00 0 [stack].

/var/lib/AccountsService/users/gdm.GK3F02

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1963
Entropy (8bit):	4.869454483555577
Encrypted:	false
SSDEEP:	24:MaqBeZ4IaeZedagZaIGI7IzJM7Avj7A2+VF90pYr4/Jr4G7rCQlL:MfBJqt7Yu2EvjEfVFYYr4Br4orC4L
MD5:	32DCE77774C23B4E5B47973733110C68
SHA1:	9B86F80253A795B74D24F30FDB52BFD2698B4848
SHA-256:	E40AC6681DE2FB2C0CAE6C05369577ADA4E1E7496244906BE52F3B66C0DCAFC3
SHA-512:	63B1E787FA58CAAD8D75830454DAAE967ECF58DBB1B8A647E4F78F08B1C0AB3992919D92314498D9C12886DBB0F6A5C91692B1817D43E7C68F33056E0DB04447
Malicious:	false
Preview:	Jan 9 12:03:18 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session closed for user gdm.Jan 9 12:03:19 galassia gdm-password]: pam_unix(gdm-password:session): session closed for user saturnino.Jan 9 12:03:23 galassia gdm-password]: pam_systemd(gdm-password:session): Failed to release session: No session '2' known.Jan 9 12:03:24 galassia systemd-logind[6344]: Failed to add user by file name 127, ignoring: Invalid argument.Jan 9 12:03:24 galassia systemd-logind[6344]: Failed to add user by file name 1000, ignoring: Invalid argument.Jan 9 12:03:24 galassia systemd-logind[6344]: User enumeration failed: Invalid argument.Jan 9 12:03:24 galassia systemd-logind[6344]: User of session c2 not known..Jan 9 12:03:24 galassia systemd-logind[6344]: User of session 2 not known..Jan 9 12:03:24 galassia systemd-logind[6344]: User of session c1 not known..Jan 9 12:03:24 galassia systemd-logind[6344]: Session enumeration failed: No such file or directory.Jan 9 1

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4428593527838256
Encrypted:	false
SSDEEP:	3:F31HlVVAAiRXllNVAAiRPl:F3cxX8x
MD5:	6CF0CADD7DCBE0A57173444590C47149
SHA1:	CF5550EC5B57D490DFC349C80745E4B861FC924D
SHA-256:	315055582836897E064D192F73F2CA2C837575924846503F35EC91A86B548CF6
SHA-512:	7288AB9BB7CD63D5DD0CF9051EBE245E8BBC9784A0A1C86F60553ED2689AA2A222B7CBBFD8928A09A8E25BAA50742611B85532478A6FB5690E7318FC401ED98B
Malicious:	false
Preview:	LPKSHHRH................4..G.=M..@17Q0.4................................4..G.=M..@17Q0.4........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.448047321524811
Encrypted:	false
SSDEEP:	3:F31HlGVHcZXETlX4VHcZXETn:F3WVgI4Vgo
MD5:	4A5C87F7752C343D5043AFE144B63A3C
SHA1:	FCC5557DE5D52BA23B872ADF4079C02DC0F4D74A
SHA-256:	7832850CE80D4AABE6CA3E35D69943AFE83B977761A3DC0FB376536B8AADC3D5
SHA-512:	37AE3D7CD390ED08FBE8D7573DF19FF53B3639CEDE8BBB627A58482229711B261FF5852CC48DA5C669639599A547BA3D89F3EABBEFBDA424AE610FA99B7F68D5
Malicious:	false
Preview:	LPKSHHRH................k.-M.vK6.#d...G................................k.-M.vK6.#d...G........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	7791
Entropy (8bit):	4.72220368538192
Encrypted:	false
SSDEEP:	96:TosICJ8kglbOFfmFxuipPRQRrzlhZl00u3K9QfyRHPSXFUtdjBUq9:TAU3ENPRQRrzLZlBCK9QfyR6Vgf
MD5:	A8B4336F37B612A664C8E650680C48F6
SHA1:	F984D275D3BC2697591213043EA6EC1756D8F009
SHA-256:	AA8FEF42617C575E3BCAE63EB2B06F2F0327348395CE2DF824347279E83C4FA7
SHA-512:	AE5054BF8D51D069548F3A6C4ABF89FE4A9807657A4F40AFE78BC3C99DB92852442494C0A54B00713D737C8A13798E42BE84E9E96B1A056B1441C196654B234B
Malicious:	false
Preview:	Jan 9 12:03:20 galassia kernel: [ 441.643908] New task spawned: old: (tgid 6341, tid 6341), new (tgid: 6341, tid: 6405).Jan 9 12:03:20 galassia kernel: [ 442.241121] New task spawned: old: (tgid 6406, tid 6406), new (tgid: 6406, tid: 6408).Jan 9 12:03:20 galassia kernel: [ 442.243082] New task spawned: old: (tgid 6406, tid 6406), new (tgid: 6406, tid: 6409).Jan 9 12:03:20 galassia kernel: [ 442.286345] New task spawned: old: (tgid 6406, tid 6409), new (tgid: 6406, tid: 6410).Jan 9 12:03:20 galassia kernel: [ 442.617981] New task spawned: old: (tgid 6335, tid 6335), new (tgid: 6335, tid: 6412).Jan 9 12:03:20 galassia kernel: [ 442.729808] Reached call limit: pid 6248, name read.Jan 9 12:03:20 galassia kernel: [ 443.331660] New task spawned: old: (tgid 6407, tid 6407), new (tgid: 6407, tid: 6415).Jan 9 12:03:20 galassia kernel: [ 443.340043] New task spawned: old: (tgid 6407, tid 6407), new (tgid: 6407, tid: 6416).Jan 9 12:03:20 galassia kernel: [ 443.366100] New task s

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (317)
Category:	dropped
Size (bytes):	37870
Entropy (8bit):	5.015866905915809
Encrypted:	false
SSDEEP:	768:nQMmEo28aNEsBiCKgMSC6OUPLP7hijfhOWKUvLZlBNQMWul5jTSuE/nbRbtZXuYf:XaLZlBB731C
MD5:	624BE80C892C1CCC8D52FB8BCE5E15A6
SHA1:	BE86369856DB0F3FB335B54E14CA5EDB667E237E
SHA-256:	1B2B15E084CB26CA7F1890E453C0C57E69D620ABCA231FE5144F835164F3AEE6
SHA-512:	83D186CECB7A4786E394B80CA2266F76DC7AD30C318D736FD63C849C3291C64FEC2F35BCA814F0A7FF93F64C1771A33EDB2309FF7979F40A70CCAA55E44E6359
Malicious:	false
Preview:	Jan 9 12:03:19 galassia systemd[1]: networkd-dispatcher.service: Main process exited, code=exited, status=1/FAILURE.Jan 9 12:03:19 galassia gdm-x-session: GLib: Source ID 2 was not found when attempting to remove it.Jan 9 12:03:19 galassia systemd[1]: networkd-dispatcher.service: Failed with result 'exit-code'..Jan 9 12:03:19 galassia systemd[1]: switcheroo-control.service: Succeeded..Jan 9 12:03:19 galassia dbus-daemon[6321]: [system] AppArmor D-Bus mediation is enabled.Jan 9 12:03:19 galassia systemd[1]: ModemManager.service: Succeeded..Jan 9 12:03:19 galassia dbus-daemon[6321]: [system] Activating systemd to hand-off: service name='org.freedesktop.login1' unit='dbus-org.freedesktop.login1.service' requested by ':1.1' (uid=0 pid=1389 comm="gdm-session-worker [pam/gdm-launch-environment] " label="unconfined").Jan 9 12:03:19 galassia whoopsie[6335]: [12:03:19] Could not get the Network Manager state:.Jan 9 12:03:19 galassia whoopsie[6335]: [12:03:19] GDBus.Error:org.freedeskto

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:A61sXlXEWtl/YWeOvt:AV+ylAst
MD5:	695D76F34E9177108CE73BA78FD17E51
SHA1:	DB3B8E05732C92836FF3525D3B3159D3624E8033
SHA-256:	A46A80B3502A3F8B45A85A388A3F81ABBEB1CCC8378624BB6D24034E72AAE92D
SHA-512:	76028E12D1B49518B3C729BDAC74B98233B34ED389A1EA36DE3AAD41FC2EF0233B5B3267C0E05FEC7A804C7061F59F165774B682EBA6D3FE19F7478B9748F5D7
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................i..g........................................

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.010668026229647
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Fantazy.arm7.elf
File size:	150'354 bytes
MD5:	5a7465d45aae789d257ca9887ccff0ea
SHA1:	0d573afc8ecbba576f0da92bcc5e6bae93e773ff
SHA256:	38df10f58e558a78a8a10db7c7a6fc084f5efc600be2088110315850de13461d
SHA512:	caa737f5caec534221412563139a0b849e269a3e8ffded825fcddda2129d1ef478835d973ed0b65926d6eb53c52ce2098af8ca73fa809ce1321e99d17c9975e1
SSDEEP:	3072:PxRizSAt/6R6Ii24dO21MiFN3ZOfU1CUeYJoMeNAy7ap0kM/9lnr:PjizSO/6R6I4bGfU1CU7OMm7apnM/9lr
TLSH:	17E33C86EA409E13C4C51776FAAF514E3322E794E3DB33028D185FB43F8AA5E4E57606
File Content Preview:	.ELF..............(.........4...........4. ...(........p.}...........................................~...~...............................5..........................................Q.td..................................-...L..................@-.,@...0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	122776
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x16938	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1ea28	0x16a28	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1ea38	0x16a38	0x1334	0x0	0x2	A	0	0	4
.ARM.extab	PROGBITS	0x1fd6c	0x17d6c	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x1fd84	0x17d84	0x118	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x20000	0x18000	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x20004	0x18004	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x20004	0x18004	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x20008	0x18008	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2000c	0x1800c	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x20010	0x18010	0xa8	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x200b8	0x180b8	0x204	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x202bc	0x182bc	0x32ec	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x182bc	0x8f2	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x18bb0	0xc0	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x18c70	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x18e83	0x1d23	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x1aba6	0x692	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1b238	0x9c7	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1bc00	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x1beb8	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x1c782	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x1d911	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x1de69	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1de7f	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1e420	0x4540	0x10	0x0		28	642	4
.strtab	STRTAB	0x0	0x22960	0x21f2	0x0	0x0		0	0	1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x17d84	0x1fd84	0x1fd84	0x118	0x118	4.4755	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x17e9c	0x17e9c	6.1155	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x18000	0x20000	0x20000	0x2bc	0x35a8	3.8391	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x18004	0x20004	0x20004	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 19:03:19.493114948 CET	192.168.2.23	8.8.8.8	0x65db	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:03:19.493114948 CET	192.168.2.23	8.8.8.8	0x14d7	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Jan 9, 2025 19:03:20.090528965 CET	192.168.2.23	8.8.8.8	0xe194	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 19:03:19.499725103 CET	8.8.8.8	192.168.2.23	0x65db	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:03:19.499725103 CET	8.8.8.8	192.168.2.23	0x65db	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2025-01-09 18:03:28 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2025-01-09 18:03:29 UTC	25	IN	HTTP/1.1 100 Continue
2025-01-09 18:03:29 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2025-01-09 18:03:29 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2025-01-09 18:03:29 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2025-01-09 18:03:29 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2025-01-09 18:03:29 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2025-01-09 18:03:29 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2025-01-09 18:03:29 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2025-01-09 18:03:29 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2025-01-09 18:03:29 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2025-01-09 18:03:29 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2025-01-09 18:03:29 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Thu, 09 Jan 2025 18:03:29 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	18:02:38
Start date (UTC):	09/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	18:02:48
Start date (UTC):	09/01/2025
Path:	/tmp/Fantazy.arm7.elf
Arguments:	/tmp/Fantazy.arm7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	18:02:55
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:02:58
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:03:14
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:03:17
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:03:18
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:03:19
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:03:20
Start date (UTC):	09/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	18:03:21
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:03:22
Start date (UTC):	09/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	18:03:23
Start date (UTC):	09/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	18:03:24
Start date (UTC):	09/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Fantazy.arm7.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6505/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:75070MbriLF

/run/systemd/journal/streams/.#9:76240DtIMhG

/run/systemd/journal/streams/.#9:76642phCrMD

/run/systemd/journal/streams/.#9:76652odcbFE

/run/systemd/journal/streams/.#9:76653BNyseE

/run/systemd/journal/streams/.#9:76654JMoChF

/run/systemd/journal/streams/.#9:76655E0uGVF

/run/systemd/journal/streams/.#9:76773Jf6dQC

/run/systemd/journal/streams/.#9:76774tHwDED

/run/systemd/journal/streams/.#9:76974uFDpUE

/run/systemd/journal/streams/.#9:77397yxbDpD

/run/systemd/journal/streams/.#9:77551sU8fAE

/run/systemd/journal/streams/.#9:77579bsor6C

/run/systemd/journal/streams/.#9:77917utsqYC

/run/systemd/journal/streams/.#9:78224p6LXJF

/run/systemd/journal/streams/.#9:7833275mprD

/run/systemd/journal/streams/.#9:78591jlkhOE

/run/systemd/journal/streams/.#9:78593JdzruE

/run/systemd/journal/streams/.#9:78626d2BdWC

/run/systemd/journal/streams/.#9:786278qaOAD

/run/systemd/journal/streams/.#9:79477uDv1wF

/run/systemd/seats/.#seat0VOtGrV

/run/systemd/seats/.#seat0ygiw5R

/run/systemd/users/.#127GSvNWS

Linux Analysis Report
Fantazy.arm7.elf

Start time (UTC):	18:03:25
Start date (UTC):	09/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	18:03:26
Start date (UTC):	09/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	18:03:27
Start date (UTC):	09/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	18:03:30
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:03:34
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:03:44
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:03:45
Start date (UTC):	09/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	18:03:48
Start date (UTC):	09/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	18:03:50
Start date (UTC):	09/01/2025
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	18:03:51
Start date (UTC):	09/01/2025
Path:	/usr/lib/gdm3/gdm-wayland-session
Arguments:	-
File size:	76368 bytes
MD5 hash:	d3def63cf1e83f7fb8a0f13b1744ff7c