Edit tour

Linux Analysis Report
Fantazy.mips.elf

Overview

General Information

Sample name:	Fantazy.mips.elf
Analysis ID:	1586945
MD5:	88541ed76411e259c0b44706211ae4fa
SHA1:	c8cef923f1cd2380d7cb1c5a97d537a74191abd6
SHA256:	37e6bed205fff2ee6a700142008d3cfb4a0350da259ad2e65790a8a5758af708
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "rm" command used to delete files or directories

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1586945
Start date and time:	2025-01-09 19:22:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Fantazy.mips.elf
Detection:	MAL
Classification:	mal68.spre.troj.linELF@0/41@3/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing network information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Fantazy.mips.elf

Runtime Messages

Command:	/tmp/Fantazy.mips.elf
PID:	6247
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	VegaSec-KATANA001
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6233, Parent: 4331)

rm (PID: 6233, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.8Rehu1tbIX /tmp/tmp.RYqmDASzg2 /tmp/tmp.u7P5v8MeWT

dash New Fork (PID: 6234, Parent: 4331)

rm (PID: 6234, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.8Rehu1tbIX /tmp/tmp.RYqmDASzg2 /tmp/tmp.u7P5v8MeWT

Fantazy.mips.elf (PID: 6247, Parent: 6167, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/Fantazy.mips.elf

Fantazy.mips.elf New Fork (PID: 6249, Parent: 6247)

Fantazy.mips.elf New Fork (PID: 6250, Parent: 6247)

Fantazy.mips.elf New Fork (PID: 6253, Parent: 6250)

Fantazy.mips.elf New Fork (PID: 6254, Parent: 6250)

Fantazy.mips.elf New Fork (PID: 6256, Parent: 6250)

systemd New Fork (PID: 6266, Parent: 1)

journalctl (PID: 6266, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6284, Parent: 1)

systemd-journald (PID: 6284, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6285, Parent: 1)

journalctl (PID: 6285, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6342, Parent: 1)

dbus-daemon (PID: 6342, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6350, Parent: 1860)

pulseaudio (PID: 6350, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6357, Parent: 1)

systemd-logind (PID: 6357, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6372, Parent: 1)

rtkit-daemon (PID: 6372, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6420, Parent: 1)

polkitd (PID: 6420, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6425, Parent: 1)

agetty (PID: 6425, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 6426, Parent: 1320)

Default (PID: 6426, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6427, Parent: 1320)

Default (PID: 6427, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6428, Parent: 1)

rsyslogd (PID: 6428, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

gdm3 New Fork (PID: 6429, Parent: 1320)

Default (PID: 6429, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6433, Parent: 1)

gpu-manager (PID: 6433, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6436, Parent: 6433)

sh (PID: 6436, Parent: 6433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6437, Parent: 6436)

grep (PID: 6437, Parent: 6436, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6438, Parent: 6433)

sh (PID: 6438, Parent: 6433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6439, Parent: 6438)

grep (PID: 6439, Parent: 6438, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6440, Parent: 6433)

sh (PID: 6440, Parent: 6433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6441, Parent: 6440)

grep (PID: 6441, Parent: 6440, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6442, Parent: 6433)

sh (PID: 6442, Parent: 6433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6443, Parent: 6442)

grep (PID: 6443, Parent: 6442, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6444, Parent: 6433)

sh (PID: 6444, Parent: 6433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6445, Parent: 6444)

grep (PID: 6445, Parent: 6444, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6447, Parent: 6433)

sh (PID: 6447, Parent: 6433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6448, Parent: 6447)

grep (PID: 6448, Parent: 6447, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6449, Parent: 6433)

sh (PID: 6449, Parent: 6433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6450, Parent: 6449)

grep (PID: 6450, Parent: 6449, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6452, Parent: 6433)

sh (PID: 6452, Parent: 6433, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6454, Parent: 6452)

grep (PID: 6454, Parent: 6452, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6455, Parent: 1)

generate-config (PID: 6455, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6456, Parent: 6455)

pkill (PID: 6456, Parent: 6455, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6459, Parent: 1)

gdm-wait-for-drm (PID: 6459, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6464, Parent: 1)

gdm3 (PID: 6464, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6469, Parent: 6464)

plymouth (PID: 6469, Parent: 6464, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6485, Parent: 6464)

gdm-session-worker (PID: 6485, Parent: 6464, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6491, Parent: 6485)

gdm-wayland-session (PID: 6491, Parent: 6485, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6493, Parent: 6491)

dbus-daemon (PID: 6493, Parent: 6491, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6495, Parent: 6493)

dbus-daemon New Fork (PID: 6496, Parent: 6495)

false (PID: 6496, Parent: 6495, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6497, Parent: 6491)

dbus-run-session (PID: 6497, Parent: 6491, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6498, Parent: 6497)

dbus-daemon (PID: 6498, Parent: 6497, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6499, Parent: 6464)

Default (PID: 6499, Parent: 6464, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6500, Parent: 6464)

Default (PID: 6500, Parent: 6464, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6470, Parent: 1)

accounts-daemon (PID: 6470, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6480, Parent: 6470)

language-validate (PID: 6480, Parent: 6470, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6481, Parent: 6480)

language-options (PID: 6481, Parent: 6480, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6482, Parent: 6481)

sh (PID: 6482, Parent: 6481, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6483, Parent: 6482)

locale (PID: 6483, Parent: 6482, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6484, Parent: 6482)

grep (PID: 6484, Parent: 6482, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

gvfsd-fuse New Fork (PID: 6512, Parent: 2038)

fusermount (PID: 6512, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

cleanup

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6428)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /tmp/Fantazy.mips.elf (PID: 6247)	Socket: 127.0.0.1:59025	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6464)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6493)	Socket: unknown address family	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 68.112.254.62
Source: unknown	TCP traffic detected without corresponding DNS query: 202.216.71.103
Source: unknown	TCP traffic detected without corresponding DNS query: 77.93.198.204
Source: unknown	TCP traffic detected without corresponding DNS query: 145.91.243.97
Source: unknown	TCP traffic detected without corresponding DNS query: 31.174.56.27
Source: unknown	TCP traffic detected without corresponding DNS query: 83.13.185.41
Source: unknown	TCP traffic detected without corresponding DNS query: 87.211.51.117
Source: unknown	TCP traffic detected without corresponding DNS query: 222.114.190.150
Source: unknown	TCP traffic detected without corresponding DNS query: 145.17.3.107
Source: unknown	TCP traffic detected without corresponding DNS query: 159.144.3.24
Source: unknown	TCP traffic detected without corresponding DNS query: 135.105.41.252
Source: unknown	TCP traffic detected without corresponding DNS query: 217.121.193.208
Source: unknown	TCP traffic detected without corresponding DNS query: 105.125.208.167
Source: unknown	TCP traffic detected without corresponding DNS query: 216.156.140.111
Source: unknown	TCP traffic detected without corresponding DNS query: 173.167.47.122
Source: unknown	TCP traffic detected without corresponding DNS query: 102.181.148.144
Source: unknown	TCP traffic detected without corresponding DNS query: 124.216.215.245
Source: unknown	TCP traffic detected without corresponding DNS query: 150.70.223.170
Source: unknown	TCP traffic detected without corresponding DNS query: 219.107.121.29
Source: unknown	TCP traffic detected without corresponding DNS query: 27.113.176.218
Source: unknown	TCP traffic detected without corresponding DNS query: 61.112.46.197
Source: unknown	TCP traffic detected without corresponding DNS query: 123.55.102.151
Source: unknown	TCP traffic detected without corresponding DNS query: 79.39.54.62
Source: unknown	TCP traffic detected without corresponding DNS query: 85.249.15.241
Source: unknown	TCP traffic detected without corresponding DNS query: 171.181.226.56
Source: unknown	TCP traffic detected without corresponding DNS query: 114.97.209.116
Source: unknown	TCP traffic detected without corresponding DNS query: 66.114.23.63
Source: unknown	TCP traffic detected without corresponding DNS query: 71.64.252.61
Source: unknown	TCP traffic detected without corresponding DNS query: 101.126.91.201
Source: unknown	TCP traffic detected without corresponding DNS query: 69.76.5.26
Source: unknown	TCP traffic detected without corresponding DNS query: 191.53.248.66
Source: unknown	TCP traffic detected without corresponding DNS query: 191.7.19.41
Source: unknown	TCP traffic detected without corresponding DNS query: 189.124.149.148
Source: unknown	TCP traffic detected without corresponding DNS query: 185.51.49.93
Source: unknown	TCP traffic detected without corresponding DNS query: 158.121.46.25
Source: unknown	TCP traffic detected without corresponding DNS query: 209.123.216.124
Source: unknown	TCP traffic detected without corresponding DNS query: 175.111.179.74
Source: unknown	TCP traffic detected without corresponding DNS query: 212.226.22.117
Source: unknown	TCP traffic detected without corresponding DNS query: 126.146.149.5
Source: unknown	TCP traffic detected without corresponding DNS query: 176.228.84.77
Source: unknown	TCP traffic detected without corresponding DNS query: 108.19.115.121
Source: unknown	TCP traffic detected without corresponding DNS query: 145.80.142.222
Source: unknown	TCP traffic detected without corresponding DNS query: 32.198.12.7
Source: unknown	TCP traffic detected without corresponding DNS query: 63.38.165.152
Source: unknown	TCP traffic detected without corresponding DNS query: 219.144.146.2
Source: unknown	TCP traffic detected without corresponding DNS query: 151.76.41.4

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.47.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38390
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 6078, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 6227, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 6228, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 6250, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 6254, result: unknown	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 6078, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 6227, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 6228, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 6250, result: successful	Jump to behavior
Source: /tmp/Fantazy.mips.elf (PID: 6254)	SIGKILL sent: pid: 6254, result: unknown	Jump to behavior

Source: classification engine

Classification label: mal68.spre.troj.linELF@0/41@3/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6342)	File: /proc/6342/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6493)	File: /proc/6493/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6512)	File: /proc/6512/mounts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6284)	File: /run/systemd/journal/streams/.#9:74612BFRSGk	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File: /run/systemd/journal/streams/.#9:74613NpsQfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File: /run/systemd/journal/streams/.#9:75785GTu8xo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File: /run/systemd/journal/streams/.#9:76862q8RuCo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File: /run/systemd/journal/streams/.#9:76865MMpK2k	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File: /run/systemd/journal/streams/.#9:76928jOBlxm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File: /run/systemd/journal/streams/.#9:76930PbP32n	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File: /run/systemd/journal/streams/.#9:76947RsLlfm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File: /run/systemd/journal/streams/.#9:76972K5Z0Ul	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File: /run/systemd/journal/streams/.#9:76535aOmJPk	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File: /run/systemd/journal/streams/.#9:76639hQys9n	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File: /run/systemd/journal/streams/.#9:77840OtZKYk	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File: /run/systemd/journal/streams/.#9:77423b8hhOl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File: /run/systemd/journal/streams/.#9:77540aF8Bun	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File: /run/systemd/journal/streams/.#9:77571fuRurl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File: /run/systemd/journal/streams/.#9:77572PFfMbn	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File: /run/systemd/journal/streams/.#9:77586SpyPAl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File: /run/systemd/journal/streams/.#9:77587O1tH1n	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6357)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6357)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6357)	File: /run/systemd/seats/.#seat0Luyb8T	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6357)	File: /run/systemd/users/.#127hbniJQ	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6357)	File: /run/systemd/users/.#127M9UkgT	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6357)	File: /run/systemd/seats/.#seat0GL75OU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6357)	File: /run/systemd/users/.#1278EsdkR	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6357)	File: /run/systemd/users/.#127gcyN3U	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6357)	File: /run/systemd/users/.#127pN923R	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6420)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6491)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6470)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6470)	Directory: /root/.cache	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6350/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6350/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6350/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6350/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6350/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6350/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6350/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6350/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6350/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6350/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6350/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6350/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6350/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6350/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6357/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6357/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6357/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6357/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6357/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6357/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6357/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6357/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6357/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6357/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6357/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6357/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6357/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6357/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2078/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2078/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2078/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2078/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2078/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2078/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2078/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2077/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2077/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2077/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2077/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2077/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2077/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2077/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2033/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2033/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2033/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2033/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2033/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2033/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2033/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2074/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2074/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2074/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2074/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2074/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2074/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2074/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6470/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6470/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6470/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6470/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6470/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6470/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/6470/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/1532/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/1532/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/1532/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/1532/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/1532/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/1532/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/1532/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/1334/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/1334/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2302/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2302/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2302/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2302/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2302/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	File opened: /proc/2302/cgroup	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6436)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6438)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6440)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6442)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6444)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6447)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6449)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6452)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6482)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Source: /bin/sh (PID: 6437)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6439)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6441)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6443)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6445)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6448)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6450)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6454)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6484)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6456)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /usr/bin/dash (PID: 6233)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.8Rehu1tbIX /tmp/tmp.RYqmDASzg2 /tmp/tmp.u7P5v8MeWT			Jump to behavior
Source: /usr/bin/dash (PID: 6234)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.8Rehu1tbIX /tmp/tmp.RYqmDASzg2 /tmp/tmp.u7P5v8MeWT			Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6284)

Reads from proc file: /proc/meminfo

Jump to behavior

Source: /sbin/agetty (PID: 6425)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6464)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6464)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6470)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6470)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6428)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6428)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 6433)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 6433)

Truncated file: /var/log/gpu-manager.log

Jump to behavior

Source: /usr/bin/pulseaudio (PID: 6350)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pkill (PID: 6456)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /tmp/Fantazy.mips.elf (PID: 6247)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6284)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6350)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6425)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6428)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6433)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6485)	Queries kernel information via 'uname':	Jump to behavior

Source: kern.log.47.dr	Binary or memory string: Jan 9 12:24:19 galassia kernel: [ 476.032065] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: Fantazy.mips.elf, 6247.1.0000560b6f7ec000.0000560b6f873000.rw-.sdmp, Fantazy.mips.elf, 6249.1.0000560b6f7ec000.0000560b6f873000.rw-.sdmp, Fantazy.mips.elf, 6250.1.0000560b6f7ec000.0000560b6f873000.rw-.sdmp, Fantazy.mips.elf, 6253.1.0000560b6f7ec000.0000560b6f873000.rw-.sdmp, Fantazy.mips.elf, 6254.1.0000560b6f7ec000.0000560b6f873000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/mips
Source: Fantazy.mips.elf, 6254.1.00007fffd8ffe000.00007fffd901f000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.SoqY43
Source: Fantazy.mips.elf, 6247.1.0000560b6f7ec000.0000560b6f873000.rw-.sdmp, Fantazy.mips.elf, 6249.1.0000560b6f7ec000.0000560b6f873000.rw-.sdmp, Fantazy.mips.elf, 6250.1.0000560b6f7ec000.0000560b6f873000.rw-.sdmp, Fantazy.mips.elf, 6253.1.0000560b6f7ec000.0000560b6f873000.rw-.sdmp, Fantazy.mips.elf, 6254.1.0000560b6f7ec000.0000560b6f873000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: Fantazy.mips.elf, 6254.1.00007fffd8ffe000.00007fffd901f000.rw-.sdmp	Binary or memory string: V/tmp/qemu-open.SoqY43@
Source: Fantazy.mips.elf, 6247.1.00007fffd8ffe000.00007fffd901f000.rw-.sdmp, Fantazy.mips.elf, 6249.1.00007fffd8ffe000.00007fffd901f000.rw-.sdmp, Fantazy.mips.elf, 6250.1.00007fffd8ffe000.00007fffd901f000.rw-.sdmp, Fantazy.mips.elf, 6253.1.00007fffd8ffe000.00007fffd901f000.rw-.sdmp, Fantazy.mips.elf, 6254.1.00007fffd8ffe000.00007fffd901f000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips
Source: Fantazy.mips.elf, 6247.1.00007fffd8ffe000.00007fffd901f000.rw-.sdmp, Fantazy.mips.elf, 6249.1.00007fffd8ffe000.00007fffd901f000.rw-.sdmp, Fantazy.mips.elf, 6250.1.00007fffd8ffe000.00007fffd901f000.rw-.sdmp, Fantazy.mips.elf, 6253.1.00007fffd8ffe000.00007fffd901f000.rw-.sdmp, Fantazy.mips.elf, 6254.1.00007fffd8ffe000.00007fffd901f000.rw-.sdmp	Binary or memory string: 0x86_64/usr/bin/qemu-mips/tmp/Fantazy.mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Fantazy.mips.elf
Source: kern.log.47.dr	Binary or memory string: Jan 9 12:24:19 galassia kernel: [ 476.032085] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6470)

Logged in records file read: /var/log/wtmp

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Fantazy.mips.elf	61%	ReversingLabs	Linux.Trojan.Mirai
Fantazy.mips.elf	100%	Avira	EXP/ELF.Gafgyt.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.47.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
202.199.173.131	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
8.140.140.254	unknown	Singapore	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
167.140.66.183	unknown	United States	15086	QVCUS	false
1.250.128.210	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
218.206.129.254	unknown	China	56046	CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN	false
107.55.192.68	unknown	United States	16567	NETRIX-16567US	false
152.247.120.44	unknown	Brazil	26599	TELEFONICABRASILSABR	false
60.3.25.94	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
173.81.206.117	unknown	United States	19108	SUDDENLINK-COMMUNICATIONSUS	false
42.41.84.165	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
162.21.71.148	unknown	Switzerland	3303	SWISSCOMSwisscomSwitzerlandLtdCH	false
125.13.1.4	unknown	Japan	9824	JTCL-JP-ASJupiterTelecommunicationCoLtdJP	false
191.237.191.37	unknown	Brazil	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
220.26.231.196	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
210.27.169.253	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
81.175.218.151	unknown	Finland	16086	DNAFI	false
43.128.25.245	unknown	Japan	4249	LILLY-ASUS	false
84.28.185.11	unknown	Netherlands	33915	TNF-ASNL	false
158.62.6.221	unknown	United States	32577	KROGERUS	false
104.223.240.66	unknown	United States	46573	LAYER-HOSTUS	false
42.20.131.137	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
125.186.137.32	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
39.69.244.197	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
8.72.107.114	unknown	United States	3356	LEVEL3US	false
75.228.222.140	unknown	United States	22394	CELLCOUS	false
59.229.48.239	unknown	China	2516	KDDIKDDICORPORATIONJP	false
159.45.129.82	unknown	United States	4196	WELLSFARGO-4196US	false
150.212.107.161	unknown	United States	4130	UPITT-ASUS	false
151.241.96.248	unknown	Iran (ISLAMIC Republic Of)	31549	RASANAIR	false
196.136.113.52	unknown	Egypt	36935	Vodafone-EG	false
201.171.210.2	unknown	Mexico	8151	UninetSAdeCVMX	false
114.245.169.141	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
44.26.161.96	unknown	United States	63069	SURELINEUS	false
97.255.135.207	unknown	United States	6167	CELLCO-PARTUS	false
138.200.245.76	unknown	Germany	24989	IXEUROPE-DE-FRANKFURT-ASNEquinixGermanyPreviouslyIXEur	false
66.71.81.209	unknown	United States	3999	PENN-STATEUS	false
196.87.240.52	unknown	Morocco	6713	IAM-ASMA	false
142.164.140.18	unknown	Canada	803	SASKTELCA	false
43.42.50.119	unknown	Japan	4249	LILLY-ASUS	false
93.223.4.229	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
69.236.28.70	unknown	United States	7018	ATT-INTERNET4US	false
179.199.250.156	unknown	Brazil	7738	TelemarNorteLesteSABR	false
142.151.26.181	unknown	Canada	239	UTORONTO-ASCA	false
219.114.16.252	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
138.6.246.114	unknown	Sweden	38956	ASN-UPPSALASE	false
192.201.225.233	unknown	United States	10912	INTERNAP-BLKUS	false
162.157.28.230	unknown	Canada	852	ASN852CA	false
109.74.105.122	unknown	Poland	44061	SMSNETPL	false
166.50.125.150	unknown	United States	3371	MCI-ASNUS	false
73.232.73.21	unknown	United States	7922	COMCAST-7922US	false
108.248.70.229	unknown	United States	7018	ATT-INTERNET4US	false
80.129.81.25	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
220.76.214.19	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
171.98.215.245	unknown	Thailand	17552	TRUE-AS-APTrueInternetCoLtdTH	false
201.173.103.55	unknown	Mexico	11888	TelevisionInternacionalSAdeCVMX	false
198.231.98.120	unknown	United States	701	UUNETUS	false
176.88.87.229	unknown	Turkey	34984	TELLCOM-ASTR	false
212.54.1.29	unknown	Finland	719	ELISA-ASHelsinkiFinlandEU	false
67.47.210.2	unknown	United States	6621	HNS-DIRECPCUS	false
126.75.186.113	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
195.119.219.105	unknown	European Union	51964	ORANGE-BUSINESS-SERVICES-IPSN-ASNFR	false
146.223.107.153	unknown	United States	204590	SWISS-ASCH	false
53.95.250.36	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
20.88.226.216	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
108.77.253.218	unknown	United States	7018	ATT-INTERNET4US	false
84.229.249.228	unknown	Israel	9116	GOLDENLINES-ASNPartnerCommunicationsMainAutonomousSyste	false
193.160.7.116	unknown	Norway	2119	TELENOR-NEXTELTelenorNorgeASNO	false
142.7.14.49	unknown	Canada	46606	UNIFIEDLAYER-AS-1US	false
147.50.81.214	unknown	Thailand	4750	CSLOXINFO-AS-APCSLOXINFOPUBLICCOMPANYLIMITEDTH	false
150.179.29.135	unknown	United States	3479	PEACHNET-AS1US	false
135.32.203.100	unknown	United States	54614	CIKTELECOM-CABLECA	false
109.236.158.127	unknown	Germany	62023	NYNEXDE	false
5.200.85.113	unknown	Iran (ISLAMIC Republic Of)	56466	ZENTEXIR	false
90.205.184.119	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
116.209.114.122	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
123.93.33.139	unknown	China	45069	CNNIC-CTTSDNET-APchinatietongShandongnetCN	false
170.251.108.146	unknown	United States	15404	COLTTechnologyServicesGroupSE	false
103.179.208.2	unknown	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
105.251.243.21	unknown	South Africa	29975	VODACOM-ZA	false
187.88.34.6	unknown	Brazil	26599	TELEFONICABRASILSABR	false
222.79.164.199	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
75.186.121.218	unknown	United States	10796	TWC-10796-MIDWESTUS	false
23.87.149.48	unknown	United States	395954	LEASEWEB-USA-LAX-11US	false
115.35.146.244	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
19.156.151.239	unknown	United States	3	MIT-GATEWAYSUS	false
89.192.32.233	unknown	United Kingdom	12479	UNI2-ASES	false
176.177.149.195	unknown	France	5410	BOUYGTEL-ISPFR	false
27.112.145.64	unknown	Korea Republic of	18310	VITSSEN-AS-KRTBROADABCBROADCASTINGCOLTDKR	false
200.125.64.229	unknown	Argentina	27747	TelecentroSAAR	false
38.64.166.19	unknown	United States	174	COGENT-174US	false
142.145.188.110	unknown	Canada	808	GONET-ASN-1CA	false
93.145.171.172	unknown	Italy	30722	VODAFONE-IT-ASNIT	false
82.3.7.151	unknown	United Kingdom	5089	NTLGB	false
43.136.201.229	unknown	Japan	4249	LILLY-ASUS	false
165.121.56.247	unknown	United States	7029	WINDSTREAMUS	false
87.33.194.90	unknown	Ireland	1213	HEANETIE	false
66.127.156.22	unknown	United States	7132	SBIS-ASUS	false
148.143.80.46	unknown	France	3246	TDCSONGTele2BusinessTDCSwedenSE	false
178.176.79.118	unknown	Russian Federation	25159	SONICDUO-ASRU	false
71.140.64.90	unknown	United States	7018	ATT-INTERNET4US	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
8.140.140.254	31SIEydtR4.elf	Get hash	malicious	Mirai	Browse
107.55.192.68	5r3fqt67ew531has4231.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse
39.69.244.197	BA1tRkqujL.elf	Get hash	malicious	Mirai	Browse
60.3.25.94	GenoSecx86	Get hash	malicious	Mirai	Browse
84.28.185.11	LcFNHxYAAs	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	.i.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Fantazy.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	2.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Fantazy.i486.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Fantazy.x86_64.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Fantazy.arm5.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Fantazy.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	k2vUsu5VZ5.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	47.121.190.121
	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	8.167.197.133
	sora.mpsl.elf	Get hash	malicious	Unknown	Browse	8.182.192.34
	sora.m68k.elf	Get hash	malicious	Unknown	Browse	47.116.180.218
	sora.arm.elf	Get hash	malicious	Unknown	Browse	223.6.159.231
	Benefit_401k_2025_Enrollment.pdf	Get hash	malicious	Unknown	Browse	203.119.157.14
	arm.elf	Get hash	malicious	Mirai	Browse	8.145.236.38
	arm7.elf	Get hash	malicious	Mirai	Browse	8.159.149.205
	ppc.elf	Get hash	malicious	Mirai	Browse	8.168.165.33
	spc.elf	Get hash	malicious	Mirai	Browse	8.162.167.206
ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	121.195.89.154
	sora.mips.elf	Get hash	malicious	Unknown	Browse	211.71.146.36
	4.elf	Get hash	malicious	Unknown	Browse	211.64.63.62
	6.elf	Get hash	malicious	Unknown	Browse	115.156.10.40
	6.elf	Get hash	malicious	Unknown	Browse	101.7.79.8
	6.elf	Get hash	malicious	Unknown	Browse	121.48.214.224
	miori.spc.elf	Get hash	malicious	Unknown	Browse	101.6.160.104
	botnet.spc.elf	Get hash	malicious	Mirai, Moobot	Browse	120.95.78.103
	miori.arm5.elf	Get hash	malicious	Unknown	Browse	222.16.157.64
	miori.m68k.elf	Get hash	malicious	Unknown	Browse	59.73.236.98
SKB-ASSKBroadbandCoLtdKR	Fantazy.x86.elf	Get hash	malicious	Unknown	Browse	39.123.27.30
	Fantazy.x86_64.elf	Get hash	malicious	Unknown	Browse	118.222.159.178
	sora.arm.elf	Get hash	malicious	Unknown	Browse	116.126.91.23
	arm.elf	Get hash	malicious	Mirai	Browse	1.253.210.138
	spc.elf	Get hash	malicious	Mirai	Browse	1.253.60.26
	6.elf	Get hash	malicious	Unknown	Browse	218.49.75.56
	4.elf	Get hash	malicious	Unknown	Browse	58.122.42.87
	miori.x86.elf	Get hash	malicious	Unknown	Browse	211.203.144.243
	botnet.spc.elf	Get hash	malicious	Mirai, Moobot	Browse	58.238.210.43
	miori.arm5.elf	Get hash	malicious	Unknown	Browse	218.239.105.37
QVCUS	miori.mips.elf	Get hash	malicious	Unknown	Browse	167.140.176.249
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	167.140.75.169
	ZeHA1CMTQq.elf	Get hash	malicious	Mirai	Browse	167.140.211.11
	RsxXCSXOUK.elf	Get hash	malicious	Unknown	Browse	167.140.18.249
	Zo5nx6nbWO.elf	Get hash	malicious	Gafgyt	Browse	167.140.158.206
	BSi1j39YE3.elf	Get hash	malicious	Mirai, Moobot	Browse	167.140.66.182
	O7eR7j1Bqm.elf	Get hash	malicious	Mirai	Browse	167.140.176.255
	bf1ByTD3YX.elf	Get hash	malicious	Mirai	Browse	167.140.176.231
	8pprGUKs46.elf	Get hash	malicious	Mirai	Browse	167.140.176.255
	nIofBL8NR5.elf	Get hash	malicious	Mirai	Browse	167.140.176.253

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/6496/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.5219280948873621
Encrypted:	false
SSDEEP:	3:f:f
MD5:	30A02EB3D1A9A3FED05CF059CB6FA899
SHA1:	64E6E54FAC8C0BDF7D14262220E160B08E2B7E28
SHA-256:	521F792C6AD01842C46F76646E38ADF29FAD5D3FF8ABB1E7F00BAB075A9497DF
SHA-512:	670D017568BD0EFF0630444465D0B6C32CDB3C15BC35A64341CF1B40CFC4210D3001C593999ED599559F49BDC8BFA798CB882EDA72E38C6822191BC132F0F390
Malicious:	false
Reputation:	low
Preview:	6464.

/run/systemd/journal/streams/.#9:74612BFRSGk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.479067511006163
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuMlTHUpdcw6F2js77:SbFuFyLVIg1BG+f+MuMlT0vz5ji4s
MD5:	5091E2EDCC798AEBD9EE01806D6DF716
SHA1:	9E65F458D5B0F66602C35A9929F22CFA2F74A85C
SHA-256:	2B9698AE9AAEED8821D8E033B386EC66AD353D9ABE30BB4E6949DBB395CE6CA3
SHA-512:	48C1FAEB4582F2E0A0CDB243022DF78043C3C5A940B59A43BCF1BD93DC0ECB795CE7E7316BF71E450A9B3AEF701B1F56E4B93C06AB820372A1173A10BD367FA7
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d15c047370584b19a3a0dba131a7adc5.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:74613NpsQfo

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.522297558957477
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+Y4SiE1h+DGDuN2jq:SbFuFyLVIg1BG+f+M+YqE1RY2ji4s
MD5:	546DC469C55D0BE0FDE09F4380D06E5B
SHA1:	F5F27DE8EF53AD1350BE3856A1169014DD0ED244
SHA-256:	9089CC2036A106945CF71989095D9D267E2E8F1D21470B75EA801029E5F52DF2
SHA-512:	99D58BD517E4C2502CD1607282D0209E30C6ED268542BF9E570A05648ED792AC75A6B32EA5E2ED5EEF446A17857A3B073EB07F149F1F4C85370466DA67B4DD3F
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=44c8b489707e4564a46bd0917fcfad6d.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:75785GTu8xo

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.408342421330484
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpZljjbdUHVc5shglU:SbFuFyLVIg1BG+f+MTljj5U1cyTjosQu
MD5:	2EF45CCCD200AC09DB85BB21691B23EB
SHA1:	89B8171AAABD8ED77B1008D75F8D2A9409667D6A
SHA-256:	1763296CBC0B46C1F9E4AE3FF5A8741A81F9189DE2D84A9445434446A4618E57
SHA-512:	4A249A7007D55D9BC34FE16921F29FD1C92E5FA4E00F1EFF2A7633B10D58D2239133FD3519C5263CF886DB9B400B45B67504743B988569CE8012317A6A0C0BD6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c16d70741b11475c8e845959acc065ea.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76535aOmJPk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.432071141353815
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MrI0A50LhTjdCt/rRMtq:qgFq6g10+f+M0dAhVCDL
MD5:	7F941571A398E0395B93DEA26E4C0963
SHA1:	51B837DD0794AF458BA5611CDF38C71DD3EAED0E
SHA-256:	2EB784CAA300725894DF9C75F6B413F2F086B73E9D1D1C177981D0924A011A80
SHA-512:	4D00B6365A23372FF037B7BD53758AA1FDE7995187A9EA210F1F48232B25A72D79A0E712F2E5EF667BDC23E611B94457C55AAD580E587B0EAC38B0C8137F49B4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e478763545114e56ac52e26119307ce1.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:76639hQys9n

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4417134934638804
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmvpSd8cgB8YTjs2ALAXA:SbFuFyLVIg1BAf+MhS6cgBdjNALyAZD
MD5:	039E06810DCA76402F116F40CAB35E60
SHA1:	CCE209C52D5824151CAF3B148408973B6E88942F
SHA-256:	C701E17C14971DF5B3C923D3BAF692C5A33BE3C679F4BBABFA89AE1D13DF8EB7
SHA-512:	586D2CCB2A8FDE4A280DA9E69406CE655C76852615C1F17EDAFF77885C2FE33489F58DADB3B1B34ECB8F82DE2474F120AEDEE35B08BBAE382F74C22891256C2D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e443cb85e78349b58e69bebed4b6092f.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76862q8RuCo

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.353266593166844
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmp1EigeXbJ5Uhwsjst:SbFuFyLVIg1BG+f+MkeoDjdCLKzK
MD5:	FC3738A36AB09FFF05E932CE948908D4
SHA1:	2011167EAA635C7159A26057AA0232D7776E2DC0
SHA-256:	656AC941F9737263AC1C0E0B6D732B5294B5B7999BD039BF74191770039DD215
SHA-512:	4B7DD2E2064DF869975C1AE1A7C28FD90CCE5758987F114CEB5119F82F645D93E2E8C040AB5780709260F58DBF438465FF8845E7A967A727B6F4B1EDABE0C7AB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c71dfa74be0a42a186f0d511c411cd4c.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:76865MMpK2k

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.31084207278541
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoEDrj2+sjshQJWL0:SbFuFyLVIg1BG+f+MoEXqTjtWL0
MD5:	4D29C6660E0276013FCE22E0D4F5D94A
SHA1:	FDF8E621DE48758D8FB99ABCBDA9408600A1CDE0
SHA-256:	E14E99EA9C890B95A23109A2B1DE4BA7E9AD7608AA96D2AEDCF8CD0776F5B44A
SHA-512:	D0D549D78E8B39659F5D8611C87E599C93581D87700CF21E4567FE5BED5BBD28B52D1CDE2C87412B772117E0A8B88FAE09973785279B20BEE8BB001D7E68D1D1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b2181a9a06f649b3841bef89e0110f40.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:76928jOBlxm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.468432693341056
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M6VXkoy2jZcHcljX+:qgFq6g10+f+M+XPmAu
MD5:	C6DB56865751B46CBA5AE1A6E01F6147
SHA1:	D0DEEA4530F393D945CCCA5B8A6E4BCD4A64FF19
SHA-256:	E3E8F0EA8A40C8506E6BBC10A3788FE02EE660E98A80EDF8C5020C0FC4FB9AB5
SHA-512:	07A7C4B15BCB9DBC1B4CFD19AA9FFC7CEB42287FF63DCB47208185596F99504A6FF9B46771A9C1C2B1E27F577F92F09EFE662C04BE61113A36925CBE495ED8B0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=55208085271445d9a0fdaf8f57c55efb.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:76930PbP32n

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.4002915971568894
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmu7c0SEdGUMAxGsZja:SbFuFyLVIg1BG+f+Mu78EEUj7ZjNE
MD5:	B2D198A483E3B9F659439321DF7C0907
SHA1:	010045CE49AC1DEF6564C56822AF95A116A3CD15
SHA-256:	421AE39DC151058D78B38E3E4B393541F3C6FFB91E0C7B8B33CB3FB19E12D1F6
SHA-512:	846C32234E6F051EF47B67FA9658EE9C58A722AE04EB64E42E6B36FED900B88AF2E8FBF454C548A79B7ED9B662E4F905C83F78A99F4198E6C54AC2BA0F0B0005
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dafe997efbc048cab7c2a38be3f31e3f.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:76947RsLlfm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.393126928434764
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6gZkOSgSsvsZjshKe:SbFuFyLVIg1BG+f+M6fmSNjbVC
MD5:	65D959229E23F11F1768514A63548313
SHA1:	A447DCDB9C3C54DED9114D81ACB9DFBFF30D0DC7
SHA-256:	34E4BAE0A9EF2A597F0C68149F524F4C609DC4447C8000C7DB99E86ACC780521
SHA-512:	DA9367C9D50F08EF991014C0F6A32117A34F9671F6528809D56789F6EFE865B62BAA99DB58716F6EB5F00CAF04E7BA7505736F724F6EAAC7A3FB31D3174588E2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0cd3e741b74e4cebadc82407765e4398.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:76972K5Z0Ul

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.4102900039043895
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuW0+c7pNJS9jswkCM:SbFuFyLVIg1BG+f+MuWw7jJS9jLkGq
MD5:	E397DE3A2C0F6400A543CF73EA1CEDF4
SHA1:	1FA049D31B5B16A8C0DD1A77A3357E347DC7BC83
SHA-256:	0326A00D305AE38C94798C5BE7B959E96E099F357D6CB74DE60B3D8A25FF458A
SHA-512:	CF67064488A018B4B963087ADA592408BB17A6FADCBA7D2EA53B1F55F43C8494B196DBB19B412CB767031AB37444F320CB475EBE01B4B32BB3538EABAE99FBA2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d4c63b464cd9496895ef0afeeef41579.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:77423b8hhOl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.384302132735526
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm8OVNSYXUeVTsVANrqjr:SbFuFyLVIg1BAf+M8yjD5s0rqjNTZD
MD5:	0FF93F3D5622AABB05157447FCDFE469
SHA1:	DEA52E5E39C28BE2134EB93296CFF39144E60B0B
SHA-256:	1C135EA6FB5F0513233CA8E33B557A2D2189B0D96CFF1FB58BDE0861A5604737
SHA-512:	7BAA5689D264421A2BD02B99BC46E4ABCA07F87F139ED27EA688916DC6CA099BA8D928B7A1CFBD9B67B5E6EA9E2B4FCF69446F97D668E49A9EAEF91B80F277F4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=68f7ee8b55d84d79a735106e0684580e.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77540aF8Bun

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.397010849144309
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmp+BLkEhEMxsjswxJm:SbFuFyLVIg1BG+f+MwljEMqjLTTIWTIL
MD5:	A0CBFFD8D353DBBECF06FCB13FF5C227
SHA1:	D8EBE321AB6C1A16091341A0D2F118FFF028C9F6
SHA-256:	BAEB6B6DF848E94FC8D5074A83BF643878FBF77E2552CA2CCC1CB76CAE8C670E
SHA-512:	46839EF600601B0A0CE9AF4EE9D5EF139202DC085ACF1C9F070BB1096B02E82B8F90289E3BC1036F257D674806BCB9CA227BC53F8254FD500BCCFA75710169AC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c7cd8fe98eff408bad32a286dad08983.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:77571fuRurl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.4108450859167325
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm8GUhe4RXBXUHAH9:SbFuFyLVK6g7/+BG+f+M8h7UHlTA0jNq
MD5:	8CA356FFAE1C0676299DC12690040704
SHA1:	38B916DCFEEF2F67E7F334B7BB7B730C39D57D69
SHA-256:	CE3B994217695ABD6409F9BD138C6749517E9CEC46C5DA71E284060DD82538E3
SHA-512:	AC67659892146B993CC16DA8402CCE05A03CBB0F03D407ED63764E14D49857E53D4B7AC105E3C690348E32258D98EEA37F54E6AEFD009808EAD90AC16C5BE8DC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6c5d5ab8e8e8426a8c1f1021bebc6b94.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:77572PFfMbn

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.4069738679569195
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm7IqZvBAGc6EVYgF:SbFuFyLVI6g7/+BG+f+M0kv2B68YTjNq
MD5:	D003D9C3A4D7F7FF55472EFB143A2FA2
SHA1:	8563BD9162658CF4EDEE6ECE077E7A6741B26D16
SHA-256:	855A4242AC06B9A7AD4423DE04E9F8D4AFA8388D492FD699E51E885D668987C1
SHA-512:	8D81BF9421167774F87CD15AE2A3A43964646ED12BD9B79FDE956A3E489648DB94ADD2545AC5E6056C6A834397422DE1A5840B937108AC4CB1E56128D5886AB7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1f192a25bc1e49f5befdec77a97ba6a0.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:77586SpyPAl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.5316424496212715
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MyEMAMS6jFQMzKaBu:qgFqo6g7/+0+f+MLITmh
MD5:	01233DA8E16BC8C61C9C472692A7E44A
SHA1:	AB1D4A0E6E7DBBE61329A7D1A14A6B82E063179C
SHA-256:	7C21500994E87906C8989D3A6F9F67FB8C1322242DAA862337D4E4E75C4BE337
SHA-512:	BA3367D62C5AC35195C61F57FCA7C65AF123A660783827903822AC25FF2549EFA7926AE5A8804CC02A7AA8458A540057F709300411BC006D5A38C300B2A15DB5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=83ff5cb0a1f94288b4950c90f5f14dc8.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:77587O1tH1n

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.551241868198001
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MXchVBWif0ZjFQMzKaBu:qgFqdg7/+0+f+MXXif0vTmh
MD5:	A37F9220B8438E8FC912536657296F5E
SHA1:	11D2C79E93BC721C48B2EAAC80A2ACB5BF7B9920
SHA-256:	942FBE63C2AD4B085B94D2EA22FD2DF3656090C61A9DC13FA0A42D2FABA03609
SHA-512:	DE70D495EAFB92DC33E43E736D3833A18E0E0966F748351366CE34B499FD055D44B095A24AE2BA2969591B63CF6F35A245C26E60B9EF8C5E91AAD2B39889AB5D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cd4723bddf8943108ffbf3962501ce77.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:77840OtZKYk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.483050906693821
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmpLVzfWWyx1d6ATjs2BI:SbFuFyLVIg1BAf+MtVz8xX68jNdQIeXD
MD5:	D79FD8B3FECDE2E9D08700C7B1AEC22C
SHA1:	5AF5F9CA65A0FB164DE51AE87FFD283FBAEBE28B
SHA-256:	7F0B0656B66A367B4772FBCED1E8B9E1F6781971A0DDA53234F46337046FC42C
SHA-512:	7F9A5488A4F1C1BD99D8599C98904AB9803D31C362ABB96AAF7BFABDF72B447B0F0A6BDFC3617421491A0687CB96C03D7365DD12350FBE7214FDE143F6B31968
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c9d5403d9b01461b833a62bca9e24f85.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/seats/.#seat0GL75OU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0Luyb8T

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/users/.#1278EsdkR

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.309605873131462
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gDigscvbqTyQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+gDcvT8thQHtPYq9M
MD5:	6504DE7E66BB065B13328813C0B2EFDB
SHA1:	E43A59F08BBC86DF1B2BFD84E158046EB7E21A07
SHA-256:	BE71E446304E81B4562F73DE382E9FDC9B22F4C99BA88C676EF71278DDB7E369
SHA-512:	8105D412056E284DCC4584C9C0B83B6B89849FF114C4FD44CDE885241C7F82BC5626EB05126C801B58983A71276E4BD544386D864AE34AEBF6BFCFF65FDC3FD1
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1736447057979989.MONOTONIC=475040561.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127M9UkgT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.309605873131462
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gDigscvbqTyQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+gDcvT8thQHtPYq9M
MD5:	6504DE7E66BB065B13328813C0B2EFDB
SHA1:	E43A59F08BBC86DF1B2BFD84E158046EB7E21A07
SHA-256:	BE71E446304E81B4562F73DE382E9FDC9B22F4C99BA88C676EF71278DDB7E369
SHA-512:	8105D412056E284DCC4584C9C0B83B6B89849FF114C4FD44CDE885241C7F82BC5626EB05126C801B58983A71276E4BD544386D864AE34AEBF6BFCFF65FDC3FD1
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1736447057979989.MONOTONIC=475040561.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127gcyN3U

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.321978271332948
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgDijcscv3rqWiV8H206qod5Jh:SbFuFyL3BVgdL87iesnAiRJgDigscvbW
MD5:	8FB7C2ABC014E00F97A9E82467A8E565
SHA1:	84D3274F27F7A75E1FC323188B3E17220F6A90D0
SHA-256:	B2C57D64D768855E0A205436909ACD1B57F952B1AE82821C0496616A3E485C73
SHA-512:	88CC05DF4C1090B7954DFDC35E8F3668FB5271CE326E85BF7D3588E115CA3E707C93BF693EA6E76CB4AE85DF771FA7CA51C18D996902C4B54448142FF7F638BA
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1736447057979989.MONOTONIC=475040561.LAST_SESSION_TIMESTAMP=475115893.

/run/systemd/users/.#127hbniJQ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127pN923R

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.481177831346124
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6lgTgDigscvbqTOt6ph:qgFq30dABibB3TgDcvTOIT
MD5:	808D760C4B59AAAAFB0799B90CF80F9F
SHA1:	FD79C4911B77C806E6B2325895754F1B57D2A38E
SHA-256:	A21AD70D83163E178292AE532EA4D872243BF701AFC5BD61F7645708A6B8D69D
SHA-512:	FDA9D870376F4EE6611EFA75357C0FF2F4DDA75E53AE3B6B217BCA72A2FC30DCD251B59234342462051FA2B50FF24C24A23904B558029269FD252B8532876A4F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12412.REALTIME=1736447057979989.MONOTONIC=475040561.LAST_SESSION_TIMESTAMP=475115893.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:bFn:pn
MD5:	4E488FFC8D8789124E8099C2BEA2F296
SHA1:	EC1CD84974C447F9F5174C2975F6F6BFA9AA8AA1
SHA-256:	3BE17987A5BA5935B2C1BD017DE8380B96EC44ED2F75D6215F21418AEBFEAEC8
SHA-512:	44CAF4EE2A6760CB2ED9F1133636FAB981B6F3D014CD3B229FF57E644AB51F2CC192D6F813DE4F864142AA7006C655E985B8BEE27076A6ED487F9D6FA1F3D532
Malicious:	false
Preview:	6350.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6412628876151888
Encrypted:	false
SSDEEP:	3:/CsXlXEWtl/j5RPt:/f+ylrPP
MD5:	C1460E480D1A198C9794C73A9E3161CC
SHA1:	BF70CE2560466C42E4EB6B52E7E471A656E24067
SHA-256:	260F9F137B0B51F92326114E9B0BFE46E26F054B74CCACF05428F78B30AA9621
SHA-512:	90231A94E517E074CCEB60BA8190173197FFD0938906AF9DF08CD6DD5E55E54F2CB54B5343C358FBB53A0AD9A6F34B087CFD39547B1533315A72970429C434F5
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................;..g........................................

/tmp/qemu-open.SoqY43 (deleted)

Download File

Process:	/tmp/Fantazy.mips.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	3.6060876892368667
Encrypted:	false
SSDEEP:	6:URgDF6EEM///VUmVbsDF6EE3cdtSY/VR/VDM/V+4D/VH:IYNdumV4N0ktSWMfF
MD5:	6F7A5C35DF66BDC015A843858AF4B0BC
SHA1:	E3CFD07618A1D11899F895B5CA135B54F6668746
SHA-256:	98E2498E838F3477DFB7C1C31D4981CC0FAB18FC6AC1777A0087B64C5536C115
SHA-512:	6AC4C6852DDF57C5C0F32F320E64A8EB9268FA09F5C21106198F9CF55186C71299536E5401CEE4BC995D6F4A0202F9187394017CA5F93379CDA5129BADDDD7A0
Malicious:	false
Preview:	400000-418000 r-xp 00000000 fd:00 531606 /tmp/Fantazy.mips.elf.457000-458000 rw-p 00017000 fd:00 531606 /tmp/Fantazy.mips.elf.458000-459000 rw-p 00000000 00:00 0 .459000-45b000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/var/lib/AccountsService/users/gdm.BRYC02

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1881
Entropy (8bit):	4.87990680416558
Encrypted:	false
SSDEEP:	24:yqk7wZ4IJZed3ZLnCLSAvxA2+VC0pYr4cJr4w/YrCQU:HG4vGfV9Yr4Cr4w/YrCn
MD5:	DE48976A8CB2D3B5DF8CF854B027AE98
SHA1:	C28B408C6C18CBC1CF2D21037BF19C4E620E9BE5
SHA-256:	D49C6BA717B72FEB34EBC01BEDD07DD243829E1F9B357378A1B0605E69A7BCAB
SHA-512:	10B6106C667EA8198C85A499B2A2AEA19E906102B785DAA31399EC67648B166640F3F0CF489350AA16FC1CB85C7712366BFB0E074991BD473CC7493410D12224
Malicious:	false
Preview:	Jan 9 12:23:55 galassia gdm-password]: pam_systemd(gdm-password:session): Failed to release session: No session '2' known.Jan 9 12:23:55 galassia gdm-launch-environment]: pam_systemd(gdm-launch-environment:session): Failed to release session: No session 'c2' known.Jan 9 12:23:55 galassia systemd-logind[6357]: Failed to add user by file name 127, ignoring: Invalid argument.Jan 9 12:23:55 galassia systemd-logind[6357]: Failed to add user by file name 1000, ignoring: Invalid argument.Jan 9 12:23:55 galassia systemd-logind[6357]: User enumeration failed: Invalid argument.Jan 9 12:23:55 galassia systemd-logind[6357]: User of session c2 not known..Jan 9 12:23:55 galassia systemd-logind[6357]: User of session 2 not known..Jan 9 12:23:55 galassia systemd-logind[6357]: User of session c1 not known..Jan 9 12:23:55 galassia systemd-logind[6357]: Session enumeration failed: No such file or directory.Jan 9 12:23:55 galassia systemd-logind[6357]: Watching system buttons on /dev/input/event

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.448047321524811
Encrypted:	false
SSDEEP:	3:F31HlQ/MMklI/MM8ll:F3gDY/
MD5:	DB133A5CD6C2C14B2395828EEB28377E
SHA1:	DC75828989829362C7074607208C495F4D4E3464
SHA-256:	E9987A3E1217227D6A053E95F3FA783D9A63BEEE8CF75FDE7C4ABD4723C5A7B5
SHA-512:	30BC52CEF5156326326929DABA50484920344A4FE09F2FA95EF214C901A9BAB0EFD2F28D985916C5A73128E1BCA725409BB117906889950E313034131A0495F6
Malicious:	false
Preview:	LPKSHHRH.................2R.N.G..Y...~...................................2R.N.G..Y...~..........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.448047321524811
Encrypted:	false
SSDEEP:	3:F31Hl95tllT5:F31
MD5:	33E6B5342BB525C456D92EBD3E7BDC53
SHA1:	C03FC7D9FBE615BF6ABECF8B2E37DD71DB48AA54
SHA-256:	DA7BD2C0542C5488FD07671EFFC208388BB996B9EA60D45C7ECE9E8AB7B8D7F1
SHA-512:	A2812104C019DE488F44185927E41B27D336D1515679239F653E0424931A070A792BD0B1A35EA952568D0D782982042573114542A2D7D3F55D43E9EDEC9D239F
Malicious:	false
Preview:	LPKSHHRH.................,Z5+SJd.M.......................................,Z5+SJd.M..............................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	11058
Entropy (8bit):	4.972506130930238
Encrypted:	false
SSDEEP:	96:JlTm3Y79vLClVQdBdKXtbsuTjqiUWOr8MuOr9YJIufnZZKAtStuisIdvcInYxCJ:vqQdBIFyr8803MVNP
MD5:	7A164E88717F0FF0C197102E44E5A3DD
SHA1:	41B0DD3CAAABE553673D69BFEF108BF2ACD8C616
SHA-256:	148FFE04BD349205BE076CA4E8CD467747099BE470D6E6039E52D88DF1652065
SHA-512:	06B1372EA669191CDE07783308E3048D40A0F087A413D48EF3D486BC3E56FCC6E8E68DEBF62DD8E0B8C173F522315F5A632708DF527C4FD372206812CD8571E8
Malicious:	false
Preview:	Jan 9 12:23:55 galassia kernel: [ 451.706923] New task spawned: old: (tgid 6349, tid 6349), new (tgid: 6349, tid: 6424).Jan 9 12:23:55 galassia kernel: [ 452.093109] Reached call limit: pid 6284, name read.Jan 9 12:23:55 galassia kernel: [ 452.434822] New task spawned: old: (tgid 6428, tid 6428), new (tgid: 6428, tid: 6430).Jan 9 12:23:55 galassia kernel: [ 452.435667] New task spawned: old: (tgid 6428, tid 6428), new (tgid: 6428, tid: 6431).Jan 9 12:23:56 galassia kernel: [ 452.439841] New task spawned: old: (tgid 6428, tid 6430), new (tgid: 6428, tid: 6432).Jan 9 12:23:56 galassia kernel: [ 453.670847] New task spawned: old: (tgid 6433, tid 6433), new (tgid: 6436, tid: 6436).Jan 9 12:23:57 galassia kernel: [ 453.706892] New task spawned: old: (tgid 6436, tid 6436), new (tgid: 6437, tid: 6437).Jan 9 12:23:57 galassia kernel: [ 453.875083] New task spawned: old: (tgid 6433, tid 6433), new (tgid: 6438, tid: 6438).Jan 9 12:23:57 galassia kernel: [ 453.928493] New task s

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	35805
Entropy (8bit):	5.051449301423297
Encrypted:	false
SSDEEP:	768:oGIcMAahZ2bro7pp1f4etw3SyY3ENCf09AuSYk6mIRLdBPt/OnjhmgkGTQcS1X7g:qzGB/8
MD5:	94C7ADAFB2C34D8AB8D6E998D6D21F9C
SHA1:	8CC9C795704DA30E98AF625D0AF1911315ACB936
SHA-256:	CC039E391696C2A7B4CA085B43BCA3D64240DCAF4A7A6F2CF4B5583543CC32D3
SHA-512:	CFE1C29CC4C77387DB141EA47FE92E274BFD8E4922CDE89C7E11F62BA08AC372D27453429DA482273DF906BE6BFF26E33DB13ECDF430F7643FDB646CFD139A04
Malicious:	false
Preview:	Jan 9 12:23:55 galassia [2156]: xfce4-notifyd: Fatal IO error 11 (Resource temporarily unavailable) on X server :1..Jan 9 12:23:55 galassia dbus-daemon[6342]: [system] Successfully activated service 'org.freedesktop.login1'.Jan 9 12:23:55 galassia [2114]: evolution-alarm-notify: Fatal IO error 11 (Resource temporarily unavailable) on X server :1.0..Jan 9 12:23:55 galassia systemd[1]: polkit.service: Succeeded..Jan 9 12:23:55 galassia systemd[1]: colord.service: Succeeded..Jan 9 12:23:55 galassia gdm3: GdmLocalDisplayFactory: Failed to issue method call: The connection is closed.Jan 9 12:23:55 galassia [2083]: wrapper-2.0: Fatal IO error 11 (Resource temporarily unavailable) on X server :1..Jan 9 12:23:55 galassia gdm3: Child process 1389 was already dead..Jan 9 12:23:55 galassia [2063]: xfce4-panel: Fatal IO error 11 (Resource temporarily unavailable) on X server :1..Jan 9 12:23:55 galassia gdm3: Unable to kill session worker process.Jan 9 12:23:55 galassia systemd[1860]: ob

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6412628876151888
Encrypted:	false
SSDEEP:	3:/CsXlXEWtl/j5RPt:/f+ylrPP
MD5:	C1460E480D1A198C9794C73A9E3161CC
SHA1:	BF70CE2560466C42E4EB6B52E7E471A656E24067
SHA-256:	260F9F137B0B51F92326114E9B0BFE46E26F054B74CCACF05428F78B30AA9621
SHA-512:	90231A94E517E074CCEB60BA8190173197FFD0938906AF9DF08CD6DD5E55E54F2CB54B5343C358FBB53A0AD9A6F34B087CFD39547B1533315A72970429C434F5
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................;..g........................................

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.5375132160995815
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Fantazy.mips.elf
File size:	97'508 bytes
MD5:	88541ed76411e259c0b44706211ae4fa
SHA1:	c8cef923f1cd2380d7cb1c5a97d537a74191abd6
SHA256:	37e6bed205fff2ee6a700142008d3cfb4a0350da259ad2e65790a8a5758af708
SHA512:	fdf2322a10f3f3279913f47f0d2e20a509246458de302a14cecd632a1f47cbcbab5d902643a8f299594f5c35f9279910570d4e5427bc39673ad5ea9a0b263961
SSDEEP:	1536:jvW+e7A26T90WlWGTd06/+vTf9l36nntYLls9adCNyB:K+eA26TShGTd06WTH36nntYLls9akNyB
TLSH:	2A93524D3E314F7DFBAC823987B75B209209339626E1C584C1ACFE021E7479A745B7A6
File Content Preview:	.ELF.....................@.`...4..z......4. ...(.............@...@....tp..tp..............tt.Ett.Ett.......t........dt.Q............................<...'..L...!'.......................<...'..(...!... ....'9... ......................<...'......!........'9`

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	96948
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x15fb0	0x0	0x6	AX	16
.fini	PROGBITS	0x4160d0	0x160d0	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x416130	0x16130	0x1340	0x0	0x2	A	16
.ctors	PROGBITS	0x457474	0x17474	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x45747c	0x1747c	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x457488	0x17488	0x4	0x0	0x3	WA	4
.data	PROGBITS	0x457490	0x17490	0x258	0x0	0x3	WA	16
.got	PROGBITS	0x4576f0	0x176f0	0x360	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x457a50	0x17a50	0x20	0x0	0x10000003	WAp	4
.bss	NOBITS	0x457a70	0x17a50	0x578	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x678	0x17a50	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x17a50	0x64	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x17470	0x17470	5.5466	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x17474	0x457474	0x457474	0x5dc	0xb74	4.0552	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 19:23:54.469245911 CET	192.168.2.23	8.8.8.8	0xacd0	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:23:54.469310045 CET	192.168.2.23	8.8.8.8	0x9bd2	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Jan 9, 2025 19:23:55.632846117 CET	192.168.2.23	8.8.8.8	0xf44e	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 19:23:54.655771971 CET	8.8.8.8	192.168.2.23	0xacd0	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:23:54.655771971 CET	8.8.8.8	192.168.2.23	0xacd0	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2025-01-09 18:23:59 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2025-01-09 18:23:59 UTC	25	IN	HTTP/1.1 100 Continue
2025-01-09 18:23:59 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2025-01-09 18:23:59 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2025-01-09 18:23:59 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2025-01-09 18:23:59 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2025-01-09 18:23:59 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2025-01-09 18:23:59 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2025-01-09 18:23:59 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2025-01-09 18:23:59 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2025-01-09 18:23:59 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2025-01-09 18:23:59 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2025-01-09 18:24:00 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Thu, 09 Jan 2025 18:24:00 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	18:23:16
Start date (UTC):	09/01/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	18:23:24
Start date (UTC):	09/01/2025
Path:	/tmp/Fantazy.mips.elf
Arguments:	/tmp/Fantazy.mips.elf
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Start time (UTC):	18:23:31
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:23:34
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:23:50
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:23:51
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:23:52
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:23:53
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:23:55
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:23:56
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:23:57
Start date (UTC):	09/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	18:23:58
Start date (UTC):	09/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	18:23:59
Start date (UTC):	09/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Fantazy.mips.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6496/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:74612BFRSGk

/run/systemd/journal/streams/.#9:74613NpsQfo

/run/systemd/journal/streams/.#9:75785GTu8xo

/run/systemd/journal/streams/.#9:76535aOmJPk

/run/systemd/journal/streams/.#9:76639hQys9n

/run/systemd/journal/streams/.#9:76862q8RuCo

/run/systemd/journal/streams/.#9:76865MMpK2k

/run/systemd/journal/streams/.#9:76928jOBlxm

/run/systemd/journal/streams/.#9:76930PbP32n

/run/systemd/journal/streams/.#9:76947RsLlfm

/run/systemd/journal/streams/.#9:76972K5Z0Ul

/run/systemd/journal/streams/.#9:77423b8hhOl

/run/systemd/journal/streams/.#9:77540aF8Bun

/run/systemd/journal/streams/.#9:77571fuRurl

/run/systemd/journal/streams/.#9:77572PFfMbn

/run/systemd/journal/streams/.#9:77586SpyPAl

/run/systemd/journal/streams/.#9:77587O1tH1n

/run/systemd/journal/streams/.#9:77840OtZKYk

/run/systemd/seats/.#seat0GL75OU

/run/systemd/seats/.#seat0Luyb8T

/run/systemd/users/.#1278EsdkR

/run/systemd/users/.#127M9UkgT

/run/systemd/users/.#127gcyN3U

/run/systemd/users/.#127hbniJQ

/run/systemd/users/.#127pN923R

/run/user/1000/pulse/pid

/run/utmp

/tmp/qemu-open.SoqY43 (deleted)

Linux Analysis Report
Fantazy.mips.elf

Start time (UTC):	18:24:01
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:24:03
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:24:13
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:24:14
Start date (UTC):	09/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	18:24:16
Start date (UTC):	09/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	18:24:18
Start date (UTC):	09/01/2025
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	18:24:19
Start date (UTC):	09/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	18:24:34
Start date (UTC):	09/01/2025
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre