Edit tour

Linux Analysis Report
Fantazy.sh4.elf

Overview

General Information

Sample name:	Fantazy.sh4.elf
Analysis ID:	1586958
MD5:	9d600777d4c0bdba2103b48d5df7c6b7
SHA1:	295344e2537b7d24f7bc9cada61f795f3bde4ceb
SHA256:	d0769a3ea55c3bebd5e4ab09058e1914e125013b83978be090ee5459ad24c0b3
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1586958
Start date and time:	2025-01-09 19:52:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Fantazy.sh4.elf
Detection:	MAL
Classification:	mal68.spre.troj.linELF@0/44@3/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing network information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Fantazy.sh4.elf

Runtime Messages

Command:	/tmp/Fantazy.sh4.elf
PID:	6221
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	VegaSec-KATANA001
Standard Error:

Process Tree

system is lnxubuntu20

Fantazy.sh4.elf (PID: 6221, Parent: 6137, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/Fantazy.sh4.elf

Fantazy.sh4.elf New Fork (PID: 6223, Parent: 6221)

Fantazy.sh4.elf New Fork (PID: 6224, Parent: 6221)

Fantazy.sh4.elf New Fork (PID: 6227, Parent: 6224)

Fantazy.sh4.elf New Fork (PID: 6228, Parent: 6224)

Fantazy.sh4.elf New Fork (PID: 6230, Parent: 6224)

systemd New Fork (PID: 6237, Parent: 1)

journalctl (PID: 6237, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6257, Parent: 1)

systemd-journald (PID: 6257, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6261, Parent: 1)

journalctl (PID: 6261, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6321, Parent: 1)

dbus-daemon (PID: 6321, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6325, Parent: 1860)

pulseaudio (PID: 6325, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6328, Parent: 1)

rtkit-daemon (PID: 6328, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6331, Parent: 1)

systemd-logind (PID: 6331, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6395, Parent: 1)

polkitd (PID: 6395, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6400, Parent: 1)

agetty (PID: 6400, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 6401, Parent: 1320)

Default (PID: 6401, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6402, Parent: 1320)

Default (PID: 6402, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6403, Parent: 1320)

Default (PID: 6403, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6404, Parent: 1)

rsyslogd (PID: 6404, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6408, Parent: 1)

gpu-manager (PID: 6408, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6409, Parent: 6408)

sh (PID: 6409, Parent: 6408, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6410, Parent: 6409)

grep (PID: 6410, Parent: 6409, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6411, Parent: 6408)

sh (PID: 6411, Parent: 6408, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6412, Parent: 6411)

grep (PID: 6412, Parent: 6411, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6416, Parent: 6408)

sh (PID: 6416, Parent: 6408, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6417, Parent: 6416)

grep (PID: 6417, Parent: 6416, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6418, Parent: 6408)

sh (PID: 6418, Parent: 6408, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6419, Parent: 6418)

grep (PID: 6419, Parent: 6418, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6421, Parent: 6408)

sh (PID: 6421, Parent: 6408, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6422, Parent: 6421)

grep (PID: 6422, Parent: 6421, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6423, Parent: 6408)

sh (PID: 6423, Parent: 6408, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6424, Parent: 6423)

grep (PID: 6424, Parent: 6423, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6425, Parent: 6408)

sh (PID: 6425, Parent: 6408, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6426, Parent: 6425)

grep (PID: 6426, Parent: 6425, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6427, Parent: 6408)

sh (PID: 6427, Parent: 6408, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6428, Parent: 6427)

grep (PID: 6428, Parent: 6427, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6430, Parent: 1)

generate-config (PID: 6430, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6431, Parent: 6430)

pkill (PID: 6431, Parent: 6430, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6434, Parent: 1)

gdm-wait-for-drm (PID: 6434, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6439, Parent: 1)

gdm3 (PID: 6439, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6443, Parent: 6439)

plymouth (PID: 6443, Parent: 6439, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6459, Parent: 6439)

gdm-session-worker (PID: 6459, Parent: 6439, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6466, Parent: 6459)

gdm-wayland-session (PID: 6466, Parent: 6459, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6468, Parent: 6466)

dbus-daemon (PID: 6468, Parent: 6466, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6470, Parent: 6468)

dbus-daemon New Fork (PID: 6471, Parent: 6470)

false (PID: 6471, Parent: 6470, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6472, Parent: 6466)

dbus-run-session (PID: 6472, Parent: 6466, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6473, Parent: 6472)

dbus-daemon (PID: 6473, Parent: 6472, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6474, Parent: 6439)

Default (PID: 6474, Parent: 6439, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6475, Parent: 6439)

Default (PID: 6475, Parent: 6439, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6445, Parent: 1)

accounts-daemon (PID: 6445, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6454, Parent: 6445)

language-validate (PID: 6454, Parent: 6445, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6455, Parent: 6454)

language-options (PID: 6455, Parent: 6454, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6456, Parent: 6455)

sh (PID: 6456, Parent: 6455, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6457, Parent: 6456)

locale (PID: 6457, Parent: 6456, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6458, Parent: 6456)

grep (PID: 6458, Parent: 6456, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

gvfsd-fuse New Fork (PID: 6487, Parent: 2038)

fusermount (PID: 6487, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6529, Parent: 1860)

dbus-daemon (PID: 6529, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6404)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /tmp/Fantazy.sh4.elf (PID: 6221)	Socket: 127.0.0.1:59025	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6257)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6439)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6468)	Socket: unknown address family	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 171.207.133.250
Source: unknown	TCP traffic detected without corresponding DNS query: 82.85.111.251
Source: unknown	TCP traffic detected without corresponding DNS query: 202.79.63.103
Source: unknown	TCP traffic detected without corresponding DNS query: 116.71.237.191
Source: unknown	TCP traffic detected without corresponding DNS query: 101.7.67.192
Source: unknown	TCP traffic detected without corresponding DNS query: 197.74.47.1
Source: unknown	TCP traffic detected without corresponding DNS query: 69.40.19.181
Source: unknown	TCP traffic detected without corresponding DNS query: 169.36.204.15
Source: unknown	TCP traffic detected without corresponding DNS query: 40.102.247.61
Source: unknown	TCP traffic detected without corresponding DNS query: 217.87.165.21
Source: unknown	TCP traffic detected without corresponding DNS query: 71.80.166.67
Source: unknown	TCP traffic detected without corresponding DNS query: 192.200.225.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.175.78.92
Source: unknown	TCP traffic detected without corresponding DNS query: 8.163.127.213
Source: unknown	TCP traffic detected without corresponding DNS query: 111.139.156.20
Source: unknown	TCP traffic detected without corresponding DNS query: 164.233.44.196
Source: unknown	TCP traffic detected without corresponding DNS query: 88.162.44.144
Source: unknown	TCP traffic detected without corresponding DNS query: 62.3.225.4
Source: unknown	TCP traffic detected without corresponding DNS query: 5.14.28.55
Source: unknown	TCP traffic detected without corresponding DNS query: 177.222.115.163
Source: unknown	TCP traffic detected without corresponding DNS query: 19.112.236.100
Source: unknown	TCP traffic detected without corresponding DNS query: 216.45.159.20
Source: unknown	TCP traffic detected without corresponding DNS query: 115.31.20.122
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.115.98
Source: unknown	TCP traffic detected without corresponding DNS query: 209.248.44.244
Source: unknown	TCP traffic detected without corresponding DNS query: 67.27.250.48
Source: unknown	TCP traffic detected without corresponding DNS query: 170.138.1.249
Source: unknown	TCP traffic detected without corresponding DNS query: 2.31.44.136
Source: unknown	TCP traffic detected without corresponding DNS query: 44.158.218.222
Source: unknown	TCP traffic detected without corresponding DNS query: 184.117.112.197
Source: unknown	TCP traffic detected without corresponding DNS query: 18.51.183.215
Source: unknown	TCP traffic detected without corresponding DNS query: 34.87.251.237
Source: unknown	TCP traffic detected without corresponding DNS query: 124.35.120.69
Source: unknown	TCP traffic detected without corresponding DNS query: 61.217.171.208
Source: unknown	TCP traffic detected without corresponding DNS query: 218.199.81.187
Source: unknown	TCP traffic detected without corresponding DNS query: 34.206.44.147
Source: unknown	TCP traffic detected without corresponding DNS query: 189.172.76.47
Source: unknown	TCP traffic detected without corresponding DNS query: 9.68.50.201
Source: unknown	TCP traffic detected without corresponding DNS query: 70.174.238.120
Source: unknown	TCP traffic detected without corresponding DNS query: 119.220.234.39
Source: unknown	TCP traffic detected without corresponding DNS query: 107.194.133.118
Source: unknown	TCP traffic detected without corresponding DNS query: 191.143.167.171
Source: unknown	TCP traffic detected without corresponding DNS query: 101.239.125.207
Source: unknown	TCP traffic detected without corresponding DNS query: 97.169.232.237
Source: unknown	TCP traffic detected without corresponding DNS query: 42.167.150.134
Source: unknown	TCP traffic detected without corresponding DNS query: 161.182.53.124
Source: unknown	TCP traffic detected without corresponding DNS query: 38.2.247.144

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.45.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38186
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 6046, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 6198, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 6199, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 6224, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 6228, result: unknown	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 6046, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 6198, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 6199, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 6224, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6228)	SIGKILL sent: pid: 6228, result: unknown	Jump to behavior

Source: classification engine

Classification label: mal68.spre.troj.linELF@0/44@3/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6321)	File: /proc/6321/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6468)	File: /proc/6468/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6473)	File: /proc/6473/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6487)	File: /proc/6487/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6529)	File: /proc/6529/mounts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6257)	File: /run/systemd/journal/streams/.#9:76226jyrSvl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6257)	File: /run/systemd/journal/streams/.#9:762273UhZAl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6257)	File: /run/systemd/journal/streams/.#9:76690OHUb1l	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6257)	File: /run/systemd/journal/streams/.#9:76703KUzc4i	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6257)	File: /run/systemd/journal/streams/.#9:76709eBOuul	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6257)	File: /run/systemd/journal/streams/.#9:76715rMmk6i	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6257)	File: /run/systemd/journal/streams/.#9:76719ZhsN2h	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6257)	File: /run/systemd/journal/streams/.#9:75303cjt56k	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6257)	File: /run/systemd/journal/streams/.#9:75306ykSrkm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6257)	File: /run/systemd/journal/streams/.#9:75410YdUVSl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6257)	File: /run/systemd/journal/streams/.#9:75543HF9bWl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6257)	File: /run/systemd/journal/streams/.#9:75590eQsvOi	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6257)	File: /run/systemd/journal/streams/.#9:77479Vuxzvk	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6257)	File: /run/systemd/journal/streams/.#9:77488wrHH1h	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6257)	File: /run/systemd/journal/streams/.#9:77919Ob4Qmi	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6257)	File: /run/systemd/journal/streams/.#9:78042zEKGZk	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6257)	File: /run/systemd/journal/streams/.#9:7808785ruuk	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6257)	File: /run/systemd/journal/streams/.#9:78088GFvc2k	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6257)	File: /run/systemd/journal/streams/.#9:781275EwZAi	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6257)	File: /run/systemd/journal/streams/.#9:78129k0G6yk	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6257)	File: /run/systemd/journal/streams/.#9:79200HeWSRi	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	File: /run/systemd/seats/.#seat01wsarU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	File: /run/systemd/users/.#127pqfKUW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	File: /run/systemd/users/.#127Ra5SvX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	File: /run/systemd/seats/.#seat0cJ6iBU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	File: /run/systemd/users/.#127rOhjhT	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	File: /run/systemd/users/.#127QL38US	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6331)	File: /run/systemd/users/.#127PUI76W	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6395)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6466)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6445)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6445)	Directory: /root/.cache	Jump to behavior

Source: /usr/bin/dbus-daemon (PID: 6321)	File opened: /proc/6395/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6321)	File opened: /proc/6331/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6321)	File opened: /proc/6322/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6321)	File opened: /proc/6322/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6321)	File opened: /proc/6321/status	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6321)	File opened: /proc/6321/attr/current	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6321)	File opened: /proc/6445/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6321)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6321)	File opened: /proc/6466/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6321)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6321)	File opened: /proc/1389/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6321)	File opened: /proc/6325/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6321)	File opened: /proc/6325/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6321)	File opened: /proc/6325/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6321)	File opened: /proc/6328/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6321)	File opened: /proc/6459/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6321)	File opened: /proc/6459/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6321)	File opened: /proc/6439/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/6230/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/6230/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/6234/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/6234/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/3088/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/230/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/230/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/231/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/231/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/232/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/232/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/233/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/233/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/234/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/234/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/1335/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/1334/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/2302/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/236/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/236/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/237/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/237/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/910/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/910/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/6228/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/6228/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/2307/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/13/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/14/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/14/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/15/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/15/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/16/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/16/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/17/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/17/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/18/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/18/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/120/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/120/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/121/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/121/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/1/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/122/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/122/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/243/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/243/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/123/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/123/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/2/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/2/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/124/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	File opened: /proc/124/cmdline	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6409)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6411)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6416)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6418)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6421)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6423)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6425)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6427)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6456)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Source: /bin/sh (PID: 6410)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6412)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6417)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6419)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6422)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6424)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6426)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6428)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6458)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6431)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6257)

Reads from proc file: /proc/meminfo

Jump to behavior

Source: /sbin/agetty (PID: 6400)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6439)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6439)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6445)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6445)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6404)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6404)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 6408)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 6408)

Truncated file: /var/log/gpu-manager.log

Jump to behavior

Source: /usr/bin/pulseaudio (PID: 6325)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pkill (PID: 6431)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /tmp/Fantazy.sh4.elf (PID: 6221)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6257)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6325)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6400)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6404)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6408)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6459)	Queries kernel information via 'uname':	Jump to behavior

Source: Fantazy.sh4.elf, 6228.1.00007ffe7974f000.00007ffe79770000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.FTDgN8
Source: Fantazy.sh4.elf, 6221.1.00007ffe7974f000.00007ffe79770000.rw-.sdmp, Fantazy.sh4.elf, 6223.1.00007ffe7974f000.00007ffe79770000.rw-.sdmp, Fantazy.sh4.elf, 6224.1.00007ffe7974f000.00007ffe79770000.rw-.sdmp, Fantazy.sh4.elf, 6227.1.00007ffe7974f000.00007ffe79770000.rw-.sdmp, Fantazy.sh4.elf, 6228.1.00007ffe7974f000.00007ffe79770000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/Fantazy.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Fantazy.sh4.elf
Source: Fantazy.sh4.elf, 6221.1.0000565355f47000.0000565355faa000.rw-.sdmp, Fantazy.sh4.elf, 6223.1.0000565355f47000.0000565355faa000.rw-.sdmp, Fantazy.sh4.elf, 6224.1.0000565355f47000.0000565355faa000.rw-.sdmp, Fantazy.sh4.elf, 6227.1.0000565355f47000.0000565355faa000.rw-.sdmp, Fantazy.sh4.elf, 6228.1.0000565355f47000.0000565355faa000.rw-.sdmp	Binary or memory string: USV5!/etc/qemu-binfmt/sh4
Source: Fantazy.sh4.elf, 6221.1.00007ffe7974f000.00007ffe79770000.rw-.sdmp, Fantazy.sh4.elf, 6223.1.00007ffe7974f000.00007ffe79770000.rw-.sdmp, Fantazy.sh4.elf, 6224.1.00007ffe7974f000.00007ffe79770000.rw-.sdmp, Fantazy.sh4.elf, 6227.1.00007ffe7974f000.00007ffe79770000.rw-.sdmp, Fantazy.sh4.elf, 6228.1.00007ffe7974f000.00007ffe79770000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: Fantazy.sh4.elf, 6221.1.0000565355f47000.0000565355faa000.rw-.sdmp, Fantazy.sh4.elf, 6223.1.0000565355f47000.0000565355faa000.rw-.sdmp, Fantazy.sh4.elf, 6224.1.0000565355f47000.0000565355faa000.rw-.sdmp, Fantazy.sh4.elf, 6227.1.0000565355f47000.0000565355faa000.rw-.sdmp, Fantazy.sh4.elf, 6228.1.0000565355f47000.0000565355faa000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4
Source: Fantazy.sh4.elf, 6228.1.00007ffe7974f000.00007ffe79770000.rw-.sdmp	Binary or memory string: RSV/tmp/qemu-open.FTDgN8

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6445)

Logged in records file read: /var/log/wtmp

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Fantazy.sh4.elf	61%	ReversingLabs	Linux.Trojan.Mirai
Fantazy.sh4.elf	100%	Avira	EXP/ELF.Gafgyt.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.45.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
60.3.74.239	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
188.101.106.73	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
20.11.48.27	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
78.188.42.93	unknown	Turkey	9121	TTNETTR	false
175.183.47.162	unknown	Taiwan; Republic of China (ROC)	18049	TINP-TWTaiwanInfrastructureNetworkTechnologieTW	false
27.48.146.129	unknown	India	23772	ORTELNET-ASMsOrtelCommunicationsLtdIN	false
14.3.132.65	unknown	Japan	4685	ASAHI-NETAsahiNetJP	false
216.35.164.134	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
65.126.206.35	unknown	United States	27235	CVC-INET-33US	false
223.56.81.199	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
216.224.240.63	unknown	United States	39948	INIT-PHXUS	false
8.214.203.178	unknown	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
145.88.107.159	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
126.104.203.9	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
113.27.194.201	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
79.132.186.164	unknown	Lithuania	24852	VINITALT	false
151.158.121.9	unknown	unknown	205664	VATTENFALL-ABSE	false
82.224.207.229	unknown	France	12322	PROXADFR	false
98.8.113.28	unknown	United States	11351	TWC-11351-NORTHEASTUS	false
102.127.89.211	unknown	Sudan	36972	MTNSD	false
46.155.144.156	unknown	Turkey	15897	VODAFONETURKEYTR	false
76.174.222.161	unknown	United States	20001	TWC-20001-PACWESTUS	false
192.49.201.130	unknown	Finland	375	TIETOTIE-ASPOBox38FI-00441HelsinkiFinlandEU	false
111.219.185.242	unknown	Korea Republic of	18302	SKG_NW-AS-KRSKTelecomKR	false
17.57.22.214	unknown	United States	714	APPLE-ENGINEERINGUS	false
40.241.85.240	unknown	United States	4249	LILLY-ASUS	false
174.76.225.44	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
59.108.23.70	unknown	China	18245	FOUNDERBNCNNICCN	false
59.253.248.246	unknown	China	37937	CNNIC-EGOVNET-APChinaeGovNetInformationCenterCN	false
168.228.140.206	unknown	Argentina	264689	LucianoGabrielChersanazUbnetDatacenterAR	false
171.239.43.102	unknown	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	false
48.33.169.193	unknown	United States	2686	ATGS-MMD-ASUS	false
161.193.32.196	unknown	United States	263740	CorporacionLaceibanetsocietyHN	false
183.240.170.242	unknown	China	56040	CMNET-GUANGDONG-APChinaMobilecommunicationscorporation	false
65.152.206.112	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
222.80.154.32	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
104.181.33.18	unknown	United States	7018	ATT-INTERNET4US	false
92.163.219.78	unknown	France	3215	FranceTelecom-OrangeFR	false
168.231.90.204	unknown	Chile	264894	DREAMNETPROVEDORDEINTERNETLTDA-MEBR	false
136.49.17.29	unknown	United States	16591	GOOGLE-FIBERUS	false
165.104.225.199	unknown	United States	26305	ASN-SSMUS	false
43.5.65.15	unknown	Japan	4249	LILLY-ASUS	false
118.53.221.219	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
203.13.195.225	unknown	Australia	136247	VICUNI-AS-APVictoriaUniversityAU	false
151.65.106.131	unknown	Italy	1267	ASN-WINDTREIUNETEU	false
96.149.2.217	unknown	United States	7922	COMCAST-7922US	false
212.112.184.88	unknown	Sweden	12552	IPO-EUSE	false
170.230.85.169	unknown	United States	19524	COMERICA-INCUS	false
44.69.7.103	unknown	United States	7377	UCSDUS	false
4.237.10.120	unknown	United States	3356	LEVEL3US	false
133.168.2.26	unknown	Japan	385	AFCONC-BLOCK1-ASUS	false
111.141.167.165	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
13.8.153.76	unknown	United States	26662	XEROX-WVUS	false
44.238.202.199	unknown	United States	16509	AMAZON-02US	false
77.98.100.100	unknown	United Kingdom	5089	NTLGB	false
168.22.191.209	unknown	United States	3479	PEACHNET-AS1US	false
154.5.79.175	unknown	Canada	852	ASN852CA	false
194.97.51.171	unknown	Germany	5430	FREENETDEfreenetDatenkommunikationsGmbHDE	false
13.2.208.105	unknown	United States	7018	ATT-INTERNET4US	false
40.128.47.117	unknown	United States	7029	WINDSTREAMUS	false
94.69.226.201	unknown	Greece	6799	OTENET-GRAthens-GreeceGR	false
148.26.55.137	unknown	United States	6400	CompaniaDominicanadeTelefonosSADO	false
116.70.1.92	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
60.181.164.62	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
4.122.195.137	unknown	United States	3356	LEVEL3US	false
190.206.148.167	unknown	Venezuela	8048	CANTVServiciosVenezuelaVE	false
158.126.137.25	unknown	Sweden	31756	COLORADOSPRINGS-GOVUS	false
198.230.235.173	unknown	United States	6614	USCC-ASNUS	false
222.19.12.254	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
73.194.150.125	unknown	United States	7922	COMCAST-7922US	false
146.170.67.85	unknown	United States	32448	METROCAST-1US	false
114.71.42.185	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
53.97.129.167	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
95.239.64.30	unknown	Italy	3269	ASN-IBSNAZIT	false
93.169.206.173	unknown	Saudi Arabia	39891	ALJAWWALSTC-ASSA	false
74.249.51.157	unknown	United States	19108	SUDDENLINK-COMMUNICATIONSUS	false
91.120.103.80	unknown	Hungary	5588	GTSCEGTSCentralEuropeAntelGermanyCZ	false
186.141.72.83	unknown	Argentina	11315	TelefonicaMovilesArgentinaSAMovistarArgentinaAR	false
101.88.97.41	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
87.198.27.212	unknown	Ireland	34245	MAGNET-ASIE	false
167.179.249.0	unknown	Thailand	136952	NETCORE-AS-APSpectrumLifeCompanyLimitedMM	false
14.181.118.230	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
87.152.87.201	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
14.205.16.48	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
12.239.94.84	unknown	United States	7018	ATT-INTERNET4US	false
168.94.117.38	unknown	United States	11596	BESTBUYUS	false
44.110.212.43	unknown	United States	54489	CORESPACE-DALUS	false
82.207.52.173	unknown	Ukraine	6849	UKRTELNETUA	false
71.104.107.93	unknown	United States	701	UUNETUS	false
101.200.103.109	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
139.242.78.130	unknown	United States	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
59.26.27.72	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
24.250.170.168	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
165.173.254.209	unknown	United States	2639	ZOHO-ASUS	false
181.24.7.200	unknown	Argentina	22927	TelefonicadeArgentinaAR	false
180.114.175.180	unknown	China	137702	CHINATELECOM-JIANGSU-NANJING-IDCNanjingJiangsuProvince	false
150.208.100.118	unknown	United States	21852	DISNW1US	false
182.21.112.139	unknown	Japan	10010	TOKAITOKAICommunicationsCorporationJP	false
121.211.23.211	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
167.58.179.18	unknown	Uruguay	6057	AdministracionNacionaldeTelecomunicacionesUY	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
98.8.113.28	TagVX302R8	Get hash	malicious	Mirai	Browse
111.219.185.242	SL71PJLYwl.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	Fantazy.ppc.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Fantazy.mips.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	.i.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Fantazy.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	2.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Fantazy.i486.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Fantazy.x86_64.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Fantazy.arm5.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	Fantazy.ppc.elf	Get hash	malicious	Unknown	Browse	104.209.250.77
	Fantazy.mips.elf	Get hash	malicious	Unknown	Browse	20.88.226.216
	Fantazy.x86.elf	Get hash	malicious	Unknown	Browse	20.76.25.102
	Fantazy.x86_64.elf	Get hash	malicious	Unknown	Browse	20.199.179.37
	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	40.71.160.224
	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	20.2.198.143
	sora.ppc.elf	Get hash	malicious	Unknown	Browse	20.196.136.5
	sora.sh4.elf	Get hash	malicious	Unknown	Browse	20.135.246.71
	sora.arm7.elf	Get hash	malicious	Unknown	Browse	20.21.172.65
	sora.x86.elf	Get hash	malicious	Unknown	Browse	20.235.211.182
TTNETTR	Fantazy.ppc.elf	Get hash	malicious	Unknown	Browse	95.1.42.27
	4.elf	Get hash	malicious	Unknown	Browse	78.180.143.139
	miori.x86.elf	Get hash	malicious	Unknown	Browse	88.245.9.191
	miori.mips.elf	Get hash	malicious	Unknown	Browse	88.233.205.155
	botnet.spc.elf	Get hash	malicious	Mirai, Moobot	Browse	95.3.174.171
	miori.m68k.elf	Get hash	malicious	Unknown	Browse	78.185.140.168
	miori.arm.elf	Get hash	malicious	Unknown	Browse	88.252.86.135
	sora.mips.elf	Get hash	malicious	Mirai	Browse	95.14.203.67
	miori.sh4.elf	Get hash	malicious	Unknown	Browse	78.188.221.153
	miori.ppc.elf	Get hash	malicious	Unknown	Browse	95.10.178.95
CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	Fantazy.ppc.elf	Get hash	malicious	Unknown	Browse	60.20.243.124
	Fantazy.mips.elf	Get hash	malicious	Unknown	Browse	39.69.244.197
	Fantazy.x86.elf	Get hash	malicious	Unknown	Browse	39.69.192.240
	Fantazy.arm7.elf	Get hash	malicious	Mirai	Browse	153.15.74.170
	6.elf	Get hash	malicious	Unknown	Browse	157.9.113.89
	4.elf	Get hash	malicious	Unknown	Browse	60.29.222.70
	Fantazy.i486.elf	Get hash	malicious	Unknown	Browse	42.54.46.241
	Fantazy.x86_64.elf	Get hash	malicious	Unknown	Browse	60.5.80.198
	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	182.54.69.185
	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	124.92.81.75
VODANETInternationalIP-BackboneofVodafoneDE	Fantazy.i486.elf	Get hash	malicious	Unknown	Browse	188.97.99.47
	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	188.110.169.89
	sora.m68k.elf	Get hash	malicious	Unknown	Browse	2.205.253.121
	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	47.83.1.90
	QUOTATION#070125-ELITE MARINE .exe	Get hash	malicious	FormBook	Browse	47.83.1.90
	4.elf	Get hash	malicious	Unknown	Browse	109.85.248.172
	6.elf	Get hash	malicious	Unknown	Browse	2.203.91.80
	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	47.83.1.90
	3.elf	Get hash	malicious	Unknown	Browse	94.217.14.130
	ORDER REF 47896798 PSMCO.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	47.83.1.90

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/6471/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Vn:Vn
MD5:	5C0AC23864201B4D66B272D6F8EEB3BE
SHA1:	17B9810EBBE364C9D9B60E1923B506FC8756F0B1
SHA-256:	5BEAA032BC3FA01BC752D5ABA2C8EBBFBCF9115576A7E7D5F0204CE7FB2F7E0C
SHA-512:	878D65042EFE717BA014C98C03C0C62DF007F1599B10BD9E60D3242B75ACC2A06D1918183C2ADEBF730CF96881D5F301444668752A854BD13F9927501C749703
Malicious:	false
Reputation:	low
Preview:	6439.

/run/systemd/journal/streams/.#9:75303cjt56k

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.406505643477667
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvARBTRoBV2jsjOdlE:SbFuFyLVIg1BG+f+MoR/AMjNE
MD5:	891A44DFF225315E8F14F7EA50F424F0
SHA1:	B6FC0376C53166B16F2333D60C718DC96125977C
SHA-256:	5E6D29436EDD1E1866274D1D4EEE2CE1D21D03B781DE7E88C2FFAF28D7E06980
SHA-512:	E83A4ADBE9DA664FF1E65CA0130132D896133634267359ABACF6C27477978CF3FE2A9E21A2A2A693FD44B775CBB7A797EB468359A5DE2F39DA95F98ABB5DF16B
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e504d379e69e4cb09ef33c14081c90a8.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:75306ykSrkm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.4711141723711
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/W1iELRcEQvH6osw9:SbFuFyLVIg1BG+f+Mois6kjZcHcljX+
MD5:	F843FC58E486EB23ADB796FF44749F32
SHA1:	C436D99F5B2A18815591AAA9E5716814074E999B
SHA-256:	BE64858F829BE9F8E503C4AA88FF71DB702C21595E937D0E93BD319F0CB957A7
SHA-512:	9040C864C9AC1F0E72BB1B2CE8111694C27C7047FDC298BD544B318F6E08068ED15D46C2D48B6C18BE30BFA56B327028C30D3FAD37FE9BB16168A4EC14699EBD
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5bb5fa996a6b4d49a5acd4b2c204f292.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:75410YdUVSl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.43086028206164
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrSdJkxcEHc9WYUVxL:SbFuFyLVIg1BG+f+Me6cu6WtdAg2jbVC
MD5:	AE381E1E097850F9A1D17C9C2DC8F9BC
SHA1:	EB02BEBFAA015B31BC3D5C0350C62851C96ECEA9
SHA-256:	FFC8CB7438837870509BCA3E582F35016EEA2E79B1586F2465C68142926A8F38
SHA-512:	164E5E52D8E415DF96BB293A6D76432AD937B4D4247728C315C2672166A0DE69452EABA5EF97F81B412032543E71673D1FB802DA5DD6F20B80A25AC1A275A3F1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a858151637db4229ab9b831d103e4f60.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:75543HF9bWl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.374729229549233
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyNQ+HE0HuQyxdVM2S:SbFuFyLVIg1BG+f+MyY0OQYVM2jLkGq
MD5:	7E530770B7F4F17C662BF3AA9C065ED7
SHA1:	7C0AD5D3F9B1293E09934B4ED2F5E286F25C28E2
SHA-256:	DBF04AFFA829E9BFEA2369DCEAF2290ABA296ADE37CC3799322DEBA365052F35
SHA-512:	0C144AE48F83024E1B418CCD07A0B507E797F079DF7BC886FBD449D84411A88528B5FF41F2860BA5F3A0813AE2569371AE957235BDC36235B56B6A3A7D0544B4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8916f501bbe240bda8b0a5418621a08e.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:75590eQsvOi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.4721698390076225
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuo/CTqpjsmNz0t955:SbFuFyLVIg1BG+f+Muo6upjdCt/rRMtq
MD5:	1A43D0795B57E5FDA6D11154E746BED0
SHA1:	60C4F693D32801EE45C4B89FFD21E503DCBBE24B
SHA-256:	2429027C4D9068B3A983BB13F13E5CB24E2407B88B7AD61C753B7CCF31D02AC5
SHA-512:	5F0CC6B0490F9627AA67C540A862B337B003E610CBA360A1529A066D2FEFE8DDFF1C1B849205EA49E294DE4310596297C8DE9FD17D400A0AD2B9292E6F8B0DAD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dc4d25715e554136bc7620a6b88b96a7.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:76226jyrSvl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.4920065836114516
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9kScJRFfxIovsjs77:SbFuFyLVIg1BG+f+MeScJRJxIo0ji4s
MD5:	6C0ED2E3DEC2DDD6B7E391835EA3F0DB
SHA1:	D0EB8CB716F57B7F29BF5F73B4D2E6CAE6B975FB
SHA-256:	41E713ED1F467DC069959B19B982880E986CC800C3C446B9A56B12A125ED61FF
SHA-512:	7949CE7C5ECAA4E28434AE0D156E299F937A3377E016F61C4E8FFF0720406BD4ED7DE846C0F7CDB53214493EED2C86B35688C5D85179375067A49578593ED346
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7ba795abbb974a019f2baeef8b46aaec.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:762273UhZAl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.55031841131392
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyRcldQXKXVQtL2ls+:SbFuFyLVIg1BG+f+MyoyXR22ji4s
MD5:	2A6E05E4E9650C0025A8D8318DF91F94
SHA1:	63D08934D8F1E477574253D32458D23B0C08BE96
SHA-256:	20C1835490879B4BA9BC124A3886DD38C51F5D26725FAB76E5E532D880DEE118
SHA-512:	5334D50F7D21B4C75C97C03C0FDF70EA6FF1234024C47BAC7A849CF114FD5CB3DD7BBB1694902BAE6042EA671B7B28252706E891154D4F248F484A6FF95290C0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8cc94f84bc07447fb864506350524d81.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76690OHUb1l

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.406686015243851
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MouPMprqjFmzXvn:qgFqo6g7/+0+f+Mo4QXvn
MD5:	FD897586B62FAD6CD840B4D80C9AE1C9
SHA1:	BFFBFDED1B0920B9349CB3380D9E52034BB4D12D
SHA-256:	3E0D7746E3BFD7823D02A662402D8CF505B9EE849C01D2C649CFBA24544F277B
SHA-512:	AF907DB2EAA0FB0C09A2407321692C02CC78F8CC44EEFCEA9D49A3C6944AA7A08E89E1999D78E5FED26F4A18CA696861A9AAD68F3CF331496E8F0160917F51B4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b6f39c0076cd47d6b04dbdeadc26d841.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:76703KUzc4i

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.4085086551268535
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmzCYGI6cqITrqjsn:SbFuFyLVI6g7/+BG+f+MiTS2jFmzXvn
MD5:	F3441B833465D98A135DEF01007C733F
SHA1:	2CE9DE7694C9514BA3DDE988F6FDFA6F0D21D5F8
SHA-256:	B688C34AEAC782353283B7BC4C5E0426C198E7763D56E319D0D43805907D1316
SHA-512:	6AEE014E6ECE1F9F0C5A26E4BC51B86E082A93714716B081F117A05638C141A2C1289E6A2CC4CB37443F5F5E394ECAE83D9D526CCA49B1F501E417A00F124CC4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9dba07bd6c1e4c67addaf99cdcf8834d.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:76709eBOuul

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.4322777761246055
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoUCayTBAR2rxsjs16:SbFuFyLVIg1BG+f+MoUC7ByZjosQu
MD5:	9799DA91B9523BCF906891B28DA136C0
SHA1:	120050F01F6AB9958E8EBC60E4DD5AEB1269A3EA
SHA-256:	91AD46E7446E5D1A7A6DF55B734E75D9019D123180608B8F7C3F7DCBFCBA1DA7
SHA-512:	6E28EF5F43DBEE0F7646049EDA71ED10122AB09F8B12B87F35D13CFA197280100C825AC26C2B68AE9CE0132007BE91461BF3CA0A11B5E91FE12491902DA52156
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b2ba30b7384341c1b65fed2497de5c5b.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76715rMmk6i

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.405139940891985
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9VFdJZbcnRXY+sjst:SbFuFyLVIg1BG+f+MfYkjdCLKzK
MD5:	EE5AE3686EAE96579D9D2BE93F6795A7
SHA1:	CB1FEDF75683BD38772C7A513C636E0F13D3707B
SHA-256:	3E93C129F65C09A88B1A9E32BA69C58DD2B66E7BF86C37638AD295C1198CD230
SHA-512:	DDEADDE0ABB995A8BD0C5EE0296A546C2DDC627142D902071DDECB3DB67D292491E14B81B58482B31CDF139B217C38FCD2D742BBAA3CA7096C39137371599ED3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=782ba7b3395f4814a21e7d5ce5799342.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:76719ZhsN2h

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.368802694871792
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9bKUycWW3QFAZjshQ:SbFuFyLVIg1BG+f+MdKX/F4jtWL0
MD5:	FFB46105168C33D77F366ADEECF68AC9
SHA1:	4BCDE1486A39A1DCA70F31BF2EA7C43E287A5756
SHA-256:	7965D7520196249111635997865F0B1D30F93D4420F0F5ED8DC21085B111E0E8
SHA-512:	5E35B94A043A084D6EB5E6A4705F5D30F374668AD872F6D749CEB67D6DE4498A3214305A9EA4B76AC283E27CA788D454FC2260A5B584EA1F9E0E79EA0672D95B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=778a570433594660be97cc3c34451926.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:77479Vuxzvk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.425000279157561
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MQZVRgUs5qjNALyAZD:qgFq6g1af+MQZ7RowIZD
MD5:	B2E685B93091CF1537469141362CBB89
SHA1:	D9688C4D1B2E81F810AE2AD31A8024B0B3F22B18
SHA-256:	E51568F8746163BDE8BDA71DE9DBFCF73FECDCFE69E7C472217282D596D68296
SHA-512:	406331C993067AC875D9AFB589FD115215797FC269594C5F5AF8DC4F24368378A775F6726040A57B166D39FB8C898D4EDEB5E55E2AB129F13CB04DB9B0998A5F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e19490de3db04a09b43314d6ff12f575.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77488wrHH1h

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.46629447753131
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm/nzkRQRlE6vRqjs2BbM:SbFuFyLVIg1BAf+MfQjNdQIeXD
MD5:	CA7EF4D1CDEC32764C67FB2F43F70544
SHA1:	B3DF8C6497100E444B417D195673EB734AEDF78B
SHA-256:	C546D0CC011B80E6B62814B4603E5CAE9B055B02F5BB23CBBF83A91773D618F1
SHA-512:	5F9731257C638E0E16B5F56D78288A895D8866604C0BC9F389D8240F7C6A82AB84556E3486ACFDE3224F98FE6709DE5FA4FD3FCE785729D386620E9CFB8E5581
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5828202e5f25454383863331f6bea7a6.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77919Ob4Qmi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.4317636575498796
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmuPAc9GH4D5WWhvF2jsa:SbFuFyLVIg1BAf+MuPAc9P5F2jNTZD
MD5:	2C904182F1827CB48FBC84D1DE944152
SHA1:	E11B592B61D8255E3D15C94A723C523113453E75
SHA-256:	4CC8379FD6050B1884E25C2ED66C26499190F7499055C878F690EC7BC860AE3F
SHA-512:	3BB0CBA3CB4F41A74479B69EBEB25021FBEBEB91F1B02D09B93CCDBFCC728A2134D6D55C3ABB61C737E930115E1053A1D86E170B0D262D1DC974BAEA233FD166
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=db252b47f99e4ac4be8f067ad530c9d8.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78042zEKGZk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.450712166233139
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MoGxGQb2jLTTIWTIL:qgFq6g10+f+MbxGc6EWEL
MD5:	E2386769BF7B082B2FAFBEE40EBABB67
SHA1:	C28185FCC3A71531EF29D15A6D5B3DCF467ABC5A
SHA-256:	8DE9AF72ED85849857CDC9D5780B31A1A01591770F67A33940D97B948F73D5B9
SHA-512:	D3BF38C606A707D57509D5C4F4C539620C4BAF90566A7EDE4B508F6B3B0475E25BDFC6AB5F3C50E02516BB6079496C1426074A6E91B40CBD9FB16E335C524F77
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a9acb5e2cccb4564878b3621607c8ff8.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:7808785ruuk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.4433186143035
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmzXhESgqovsZjs2q:SbFuFyLVK6g7/+BG+f+MD9jNq
MD5:	B91A650039F58D6C5B6D23F474004B94
SHA1:	6817044D291B02D640DC892028FE945507699964
SHA-256:	636DBA97EDB709714549D2088BD1D4C41C008D4DB4A482904CE4313DC3D892E1
SHA-512:	40D522457C9B4DC61E5BFE7E3BFE3D23BCB467B42852C8AB8F452867CAEB2F10D8E401F4CAB07D59FD3166793BFFF024E13F65D3FDB307BF9CA0AD796C4F89F0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9458bedb8fcb479c9ff233973f0b9cf5.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78088GFvc2k

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.414716303876546
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm6qkAGRgXSbZVBzz:SbFuFyLVI6g7/+BG+f+M6qkA7X2BojNq
MD5:	D2D0A362CA81E4EEE2E62DB8459EAF51
SHA1:	022DA9040897601993DA64320EDEEED5221A4778
SHA-256:	78CC85BF437637065C9619EFF7495852EDAFC4D5A37F4ADA0FC832A2BBB9FC7C
SHA-512:	50F791DFC806C136BFABA4FA6C09D027244EF71795FB0B4115CE2DA78A5BBC9A5A5CFEEBC349519F8BDBCE7CCDF294EA26C001245B50FF59925C66712758EC18
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=021fb62fac2c4f21b5077a94600d86ea.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:781275EwZAi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.554484028107603
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M2wQRTjFQMzKaBu:qgFqo6g7/+0+f+M2wQ/Tmh
MD5:	337F119CE9D56B4FCF5F88CFF79D9F4A
SHA1:	40EFD7BD0AD8D4095B965C7FC167C59D48A14F27
SHA-256:	37509E962F8AAB97A9D97A5A5EF691386F7848EE9E0BEA443ACEA43761AB71DB
SHA-512:	8EF18C038FE7D62BCCA3EADB417D7D7E44AD1DF07434A0F9B718583786A224B1DAC80E57503B6555608E8B16378027634B627C0B776B9EAFDF0564356FA983BE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e17958092f36451a98d28c97169572c2.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:78129k0G6yk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.512471823197637
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M6NWyYqjFQMzKaBu:qgFqdg7/+0+f+M2Wf4Tmh
MD5:	828024DC2EA206E486BB0FF61C63D43F
SHA1:	E3D96EB66BAA819B1F8C0CFEE19BAE5D032BEA96
SHA-256:	2D9A5E2F7D2031E28C145BDF11BD6CAE8DE72772AE907D43EA6B0DF072D9B236
SHA-512:	8B7C276909A3094FE526F50CF9A39D0260AE6FC1A4D0CBBA29EFC22927DE7867BEE6875E07733B6A0DD83DB8D693FD8E3570CE30FED49EDBCB1193B617C05CDC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=064c0f76c9cd41898d6c5905941ccbce.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:79200HeWSRi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.35047456511018
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoE5VFUBfBHc7sjs16:SbFuFyLVIg1BG+f+MoEWHcojoa
MD5:	E9FF31CF71A06C83CB00BF8F860E7764
SHA1:	06795E1FAA6402054B746C4D4F6B3D6D9385110D
SHA-256:	7790DC1CC4E96AFE45F3B628BFE18C1E5C7CF14902990FF51DF597215C9FE2FC
SHA-512:	D710CB73622A80FBA86FD9C02E020FDABB4C7476F9624819E05757592D4C4805C06AB82509DDA28AC7F9698868E640C781F2C0D8C1B3A78CDA8304BFF3A67490
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b72dff5a2ad546d0bee1d66db993b943.IDENTIFIER=dbus-daemon.

/run/systemd/seats/.#seat01wsarU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0cJ6iBU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/users/.#127PUI76W

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.447385873708053
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6lgTgDvisit6Nyv:qgFq30dABibB3TgDvisiIK
MD5:	32933963E07FA73E5391849DAB11D384
SHA1:	3E4C235ECB74FA56E232BDE08DEE58E5824CF627
SHA-256:	CE01CF4A13DD3F6C9C53142D7DA8236A16E40E00218D9DC49EE5E2146294B0CD
SHA-512:	6EB15EE9C9F8FC66AC8146450DB4258A3DA29BE088A97BDB096D63999DC56C2BCC44BBB2C78B5E0BB1B7A792AC63B3A0FB310A95A742D47554F4B850EB35A228
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12412.REALTIME=1736448822821603.MONOTONIC=464136700.LAST_SESSION_TIMESTAMP=464254861.

/run/systemd/users/.#127QL38US

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.300137644552602
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgDt5voOnUSVT56H206qoduARyv:SbFuFyL3BVgdL87iesnAiRJgDvisit6K
MD5:	30AD0C8997CB83AF732BE17A89EA0370
SHA1:	4D2AF5D90041B44CE2931F39CAAACE46779C1EF6
SHA-256:	0FB813394F13C32340A2D071D66F57D607B7B31E73A29CCEA7D61584A50A1AF4
SHA-512:	46E3DC6D01A9D433539F22FBC5E4524EADE7C2878065F925508FBB4AAB41B2B433E487481F26E147A50F0267BBEBAE32CC1E48219B328E4E87005200E50FA697
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1736448822821603.MONOTONIC=464136700.LAST_SESSION_TIMESTAMP=464254861.

/run/systemd/users/.#127Ra5SvX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.295569858876023
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gDvi3asQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+gDvi3jthQHtPYq9M
MD5:	A5B7D326CA725B4BC4FBD318F4845CAB
SHA1:	1FFDBE6C464F23ED7DAAC386D17063EDC3A22676
SHA-256:	FBE0549B95DD7294806A314F9B20D64598BF13F4A9B8D44D8A5683BA75982E4E
SHA-512:	751F4A2EB8B2A0F2F04BF5D861E4F66B03B091D10FCD0238C51B864E7EDA408CDDBF25A02B2FA54FF2745D205DA31CB9B2B0FCA521EC492CFFE5DB854403BE1E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1736448822821603.MONOTONIC=464136700.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127pqfKUW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127rOhjhT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.295569858876023
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gDvi3asQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+gDvi3jthQHtPYq9M
MD5:	A5B7D326CA725B4BC4FBD318F4845CAB
SHA1:	1FFDBE6C464F23ED7DAAC386D17063EDC3A22676
SHA-256:	FBE0549B95DD7294806A314F9B20D64598BF13F4A9B8D44D8A5683BA75982E4E
SHA-512:	751F4A2EB8B2A0F2F04BF5D861E4F66B03B091D10FCD0238C51B864E7EDA408CDDBF25A02B2FA54FF2745D205DA31CB9B2B0FCA521EC492CFFE5DB854403BE1E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1736448822821603.MONOTONIC=464136700.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:c6:c6
MD5:	EECFCEBBE2BFEB882B4A9985759B6DD3
SHA1:	A77C41C91AF8CE5F06FB64BD92971B08F3745F0D
SHA-256:	B91B75CBC42D078630D8032195BE2E7688C62AF30BEB8D5A145220C1F5484FED
SHA-512:	557A053D9B36CABBC5369496F2DEE9B63930CFF70C164230B8F392BB21C752F48E344D1E80B87D1E68224C8AE838CA6F0AB1F1771701E4696CFC5EAE190201F8
Malicious:	false
Preview:	6325.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6310533750257332
Encrypted:	false
SSDEEP:	3:QlSsXlXEWtl/imXl:Qh+ylF1
MD5:	1F8DB64531F43845C8D3078A99081617
SHA1:	C615851716794036FF67C4B49338F206555929CE
SHA-256:	32ACA2CC50220DF4AC1271C5E41381F0D80FC61D6383074690DE82595E58BA3E
SHA-512:	F8BB937995E6A38108CEECC3890353E93FBAB54A45C59364A1FBE7A989BCA9D05A02480F9D68DEC1574C59923D2BEFF85BC31E32C006995F689403392790C2D0
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN......................................................................................................................................................................................................................................................................................................g}.......................................

/tmp/qemu-open.FTDgN8 (deleted)

Download File

Process:	/tmp/Fantazy.sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	3.5796258815476407
Encrypted:	false
SSDEEP:	6:URN3dDF6EcSSmb/VUMVbsDF6EcSNj/VWL/VDM/V+4D/VH:IldN4JUbENLeMfF
MD5:	3D3E41982A63F45B2BF1E00F60115FF7
SHA1:	D47EFB716D1DE305EA6D99E88117D14B99A7324D
SHA-256:	4E9673EF0B43B0B677339B63EA341AA222BABA79783936F690122B6C9DE39E52
SHA-512:	BBBE546929D3780D4FF0E78DB467559B94BC5AC96C5A6B33187B96DFFC679234EC4EBE9BA65E04B0411326088DDFE484E80F377C241B9B028C0A06BE778D6004
Malicious:	false
Preview:	400000-411000 r-xp 00000000 fd:00 531606 /tmp/Fantazy.sh4.elf.421000-422000 rw-p 00011000 fd:00 531606 /tmp/Fantazy.sh4.elf.422000-423000 rw-p 00000000 00:00 0 .423000-425000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/var/lib/AccountsService/users/gdm.TC8C02

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1881
Entropy (8bit):	4.857473168019668
Encrypted:	false
SSDEEP:	24:n7HqhjZ4IijZedipZi1G131/OIGNAvvGNA2+V9+uGj0pYr4P7Jr406rCQU:7KFSveSfVYudYr4PNr4brCn
MD5:	3E42341E2415AA7A4BAA74240079FD15
SHA1:	69FFFCB021B4F7D22B3260211653D46A47F554F5
SHA-256:	80FDDA26C0240CE0BEDEEC5C5304499863A476164CB392DBE289ACCD204E7EBA
SHA-512:	F489DBE205759836A3A991B54459022E2F419D8D7C652DBEC187190611D23FD9865FD499248FCDD4D9A99D7C1B84FC3F53458D6D3918C7E25B6B9304D08611DF
Malicious:	false
Preview:	Jan 9 12:53:19 galassia gdm-launch-environment]: pam_systemd(gdm-launch-environment:session): Failed to release session: No session 'c2' known.Jan 9 12:53:19 galassia gdm-password]: pam_systemd(gdm-password:session): Failed to release session: No session '2' known.Jan 9 12:53:19 galassia systemd-logind[6331]: Failed to add user by file name 127, ignoring: Invalid argument.Jan 9 12:53:19 galassia systemd-logind[6331]: Failed to add user by file name 1000, ignoring: Invalid argument.Jan 9 12:53:19 galassia systemd-logind[6331]: User enumeration failed: Invalid argument.Jan 9 12:53:19 galassia systemd-logind[6331]: User of session c2 not known..Jan 9 12:53:19 galassia systemd-logind[6331]: User of session 2 not known..Jan 9 12:53:19 galassia systemd-logind[6331]: User of session c1 not known..Jan 9 12:53:19 galassia systemd-logind[6331]: Session enumeration failed: No such file or directory.Jan 9 12:53:19 galassia systemd-logind[6331]: Watching system buttons on /dev/input/event

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31HlKFrp6FrpV:F3g9g9
MD5:	CC36743CDF66896B5426C4BCA4F2F974
SHA1:	DAB881CF12F4607FF63797425DB644B61D728B3B
SHA-256:	F15B9E4507E3AAC70BBE3D7CA502937E2629F050ECDDA13C06DE7E2823042916
SHA-512:	3E3C3E66689E4F33A4BEA3F48706891660861F157582D9D5051D38AA56A1355276D511987472B7EE171573A8211BBC987AD21A161E160741F8874D8C09B07C11
Malicious:	false
Preview:	LPKSHHRH................M....GJ...N.;..2................................M....GJ...N.;..2........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4428593527838256
Encrypted:	false
SSDEEP:	3:F31HlgdgUrj1dgUrjUlll:F3zyQy4/
MD5:	9DCD0D74A2CD188E25B2B7A117AC0129
SHA1:	18C558B299E8CB3BB28799215AB39EF36E50DADB
SHA-256:	01B930B233558A7316192A6525807A7AF6DD42D987D7E39EA2A529E55AE142E6
SHA-512:	1929B770C2D5AB081B88AFA6F72BEBD910AFC35F970E56B674CB8A035CB0BFC6322E3CDC42E103002124FCBEF4CDB874A63E476015AAC26C3B5CB171F8CE8FC2
Malicious:	false
Preview:	LPKSHHRH................u.....@...j\|....................................u.....@...j\|............................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	6815
Entropy (8bit):	4.697913099127959
Encrypted:	false
SSDEEP:	48:MSHbmNpXAXisN8XJtyJwi2gsayyLNx/9dS5k/9V2S0s3BQGDZ2hOLZS4ZN3hGYsE:1viXerJ+nKzmHSg50u0OggeF1EHJjW
MD5:	A6D8DFA6D5E641EC1D12134E71DFE5BD
SHA1:	F8DDF2802A00B65D91B771B18638A784D2A169EE
SHA-256:	29D05F645C7D4CB132708CCA8722C4D7DB2C525B090C6F0937A8BB6C0453F377
SHA-512:	0CB6B0BD202EF361278130CA16626FAEB7DEDD27455A1436CBF32D02928B6CAE5E247077A0D3C1C4A7698A40E8DA52B542FACD2E0167C9B555266185FA3503EB
Malicious:	false
Preview:	Jan 9 12:53:19 galassia kernel: [ 439.105441] New task spawned: old: (tgid 6322, tid 6322), new (tgid: 6322, tid: 6399).Jan 9 12:53:19 galassia kernel: [ 440.813192] New task spawned: old: (tgid 6404, tid 6404), new (tgid: 6404, tid: 6405).Jan 9 12:53:19 galassia kernel: [ 440.813679] New task spawned: old: (tgid 6404, tid 6404), new (tgid: 6404, tid: 6406).Jan 9 12:53:20 galassia kernel: [ 440.816751] New task spawned: old: (tgid 6404, tid 6405), new (tgid: 6404, tid: 6407).Jan 9 12:53:20 galassia kernel: [ 441.648880] blocking signal 0: 6257 -> 1860.Jan 9 12:53:20 galassia kernel: [ 441.946157] New task spawned: old: (tgid 6408, tid 6408), new (tgid: 6409, tid: 6409).Jan 9 12:53:21 galassia kernel: [ 442.036762] New task spawned: old: (tgid 6409, tid 6409), new (tgid: 6410, tid: 6410).Jan 9 12:53:21 galassia kernel: [ 442.440311] New task spawned: old: (tgid 6408, tid 6408), new (tgid: 6411, tid: 6411).Jan 9 12:53:21 galassia kernel: [ 442.501900] New task spawned:

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (317)
Category:	dropped
Size (bytes):	30571
Entropy (8bit):	4.991157391092261
Encrypted:	false
SSDEEP:	768:4hsgOKkI7fxDd9ZTZosGhswGUZFTh7v16Oagjl5r7QM+I2qcdD/Jt/TxYqGkZAkX:2r
MD5:	87942287E1AD369C243EF7EAA02375C2
SHA1:	ADBA1F961DA0F566EC1E1ABC8B56218774B43CEB
SHA-256:	A56C7D31FAED073F3EEE21789E68AD5E2456FB9E0AC8CCB8B80444A89F1D28FF
SHA-512:	E03F4C73B3848FD40D78A0D776E19D306B328AD5F23D00D41B758AE080D5B2528002791B501E8E1391F0582EAE54778B8A16BE1EC79F4FD03B9C29145C75F901
Malicious:	false
Preview:	Jan 9 12:53:19 galassia [2156]: xfce4-notifyd: Fatal IO error 11 (Resource temporarily unavailable) on X server :1..Jan 9 12:53:19 galassia [2114]: evolution-alarm-notify: Fatal IO error 11 (Resource temporarily unavailable) on X server :1.0..Jan 9 12:53:19 galassia gdm3: GdmLocalDisplayFactory: Failed to issue method call: The connection is closed.Jan 9 12:53:19 galassia systemd[1860]: xfce4-notifyd.service: Main process exited, code=exited, status=1/FAILURE.Jan 9 12:53:19 galassia gdm3: Child process 1389 was already dead..Jan 9 12:53:19 galassia systemd[1860]: xfce4-notifyd.service: Failed with result 'exit-code'..Jan 9 12:53:19 galassia gdm3: Unable to kill session worker process.Jan 9 12:53:19 galassia systemd[1]: Started D-Bus System Message Bus..Jan 9 12:53:19 galassia gdm3: Child process -1463 was already dead..Jan 9 12:53:19 galassia systemd[1]: whoopsie.service: Scheduled restart job, restart counter is at 1..Jan 9 12:53:19 galassia gdm3: Failed to contact accounts

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6310533750257332
Encrypted:	false
SSDEEP:	3:QlSsXlXEWtl/imXl:Qh+ylF1
MD5:	1F8DB64531F43845C8D3078A99081617
SHA1:	C615851716794036FF67C4B49338F206555929CE
SHA-256:	32ACA2CC50220DF4AC1271C5E41381F0D80FC61D6383074690DE82595E58BA3E
SHA-512:	F8BB937995E6A38108CEECC3890353E93FBAB54A45C59364A1FBE7A989BCA9D05A02480F9D68DEC1574C59923D2BEFF85BC31E32C006995F689403392790C2D0
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN......................................................................................................................................................................................................................................................................................................g}.......................................

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.696663619397217
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Fantazy.sh4.elf
File size:	70'648 bytes
MD5:	9d600777d4c0bdba2103b48d5df7c6b7
SHA1:	295344e2537b7d24f7bc9cada61f795f3bde4ceb
SHA256:	d0769a3ea55c3bebd5e4ab09058e1914e125013b83978be090ee5459ad24c0b3
SHA512:	946d53a36b5b62bf8dfb61a09705fa88624c0363114326e430743360e3d9f3022469dddbaf34782a1e52ec0b8665c5bdff4eba6088c89da9f8094ef79d1141d8
SSDEEP:	1536:n/THhka1wt+nxjYraYtfNSmJemJjQQjSY2LC0py:nbH+Grx0rnv9emHjSY2Lfy
TLSH:	28638D76D578ACA0C04889B576A8D9B44703A804A6F77EF1CAC19F59080BEFCF1497F6
File Content Preview:	.ELF.....................@.4...h.......4. ...(...............@...@...........................B...B.(...............Q.td............................././"O.n........#.@........#.*@.....o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	70248
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x30	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0xf600	0x0	0x6	AX	32
.fini	PROGBITS	0x40f6e0	0xf6e0	0x24	0x0	0x6	AX	4
.rodata	PROGBITS	0x40f704	0xf704	0x1294	0x0	0x2	A	4
.ctors	PROGBITS	0x421000	0x11000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x421008	0x11008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x421014	0x11014	0x214	0x0	0x3	WA	4
.bss	NOBITS	0x421228	0x11228	0x558	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x11228	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x10998	0x10998	6.8211	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x11000	0x421000	0x421000	0x228	0x780	3.0141	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 19:53:18.734617949 CET	192.168.2.23	8.8.8.8	0xce87	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:53:18.734617949 CET	192.168.2.23	8.8.8.8	0x4658	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Jan 9, 2025 19:53:19.002129078 CET	192.168.2.23	8.8.8.8	0xb5b2	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 19:53:18.741338015 CET	8.8.8.8	192.168.2.23	0xce87	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:53:18.741338015 CET	8.8.8.8	192.168.2.23	0xce87	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2025-01-09 18:53:24 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2025-01-09 18:53:24 UTC	25	IN	HTTP/1.1 100 Continue
2025-01-09 18:53:24 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2025-01-09 18:53:24 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2025-01-09 18:53:24 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2025-01-09 18:53:24 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2025-01-09 18:53:24 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2025-01-09 18:53:24 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2025-01-09 18:53:24 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2025-01-09 18:53:24 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2025-01-09 18:53:24 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2025-01-09 18:53:24 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2025-01-09 18:53:24 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Thu, 09 Jan 2025 18:53:24 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	18:52:48
Start date (UTC):	09/01/2025
Path:	/tmp/Fantazy.sh4.elf
Arguments:	/tmp/Fantazy.sh4.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	18:52:55
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:52:58
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:53:15
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:53:17
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:53:18
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:53:19
Start date (UTC):	09/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	18:53:20
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:53:21
Start date (UTC):	09/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	18:53:22
Start date (UTC):	09/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	18:53:23
Start date (UTC):	09/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	18:53:25
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:53:27
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Fantazy.sh4.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6471/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:75303cjt56k

/run/systemd/journal/streams/.#9:75306ykSrkm

/run/systemd/journal/streams/.#9:75410YdUVSl

/run/systemd/journal/streams/.#9:75543HF9bWl

/run/systemd/journal/streams/.#9:75590eQsvOi

/run/systemd/journal/streams/.#9:76226jyrSvl

/run/systemd/journal/streams/.#9:762273UhZAl

/run/systemd/journal/streams/.#9:76690OHUb1l

/run/systemd/journal/streams/.#9:76703KUzc4i

/run/systemd/journal/streams/.#9:76709eBOuul

/run/systemd/journal/streams/.#9:76715rMmk6i

/run/systemd/journal/streams/.#9:76719ZhsN2h

/run/systemd/journal/streams/.#9:77479Vuxzvk

/run/systemd/journal/streams/.#9:77488wrHH1h

/run/systemd/journal/streams/.#9:77919Ob4Qmi

/run/systemd/journal/streams/.#9:78042zEKGZk

/run/systemd/journal/streams/.#9:7808785ruuk

/run/systemd/journal/streams/.#9:78088GFvc2k

/run/systemd/journal/streams/.#9:781275EwZAi

/run/systemd/journal/streams/.#9:78129k0G6yk

/run/systemd/journal/streams/.#9:79200HeWSRi

/run/systemd/seats/.#seat01wsarU

/run/systemd/seats/.#seat0cJ6iBU

/run/systemd/users/.#127PUI76W

/run/systemd/users/.#127QL38US

/run/systemd/users/.#127Ra5SvX

/run/systemd/users/.#127pqfKUW

/run/systemd/users/.#127rOhjhT

Linux Analysis Report
Fantazy.sh4.elf

Start time (UTC):	18:53:37
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:53:40
Start date (UTC):	09/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	18:53:43
Start date (UTC):	09/01/2025
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	18:53:44
Start date (UTC):	09/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	18:53:45
Start date (UTC):	09/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	18:53:38
Start date (UTC):	09/01/2025
Path:	/usr/lib/accountsservice/accounts-daemon
Arguments:	-
File size:	203192 bytes
MD5 hash:	01a899e3fb5e7e434bea1290255a1f30

Start time (UTC):	18:53:58
Start date (UTC):	09/01/2025
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Start time (UTC):	18:55:28
Start date (UTC):	09/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre