Edit tour

Linux Analysis Report
debvps.elf

Overview

General Information

Sample name:	debvps.elf
Analysis ID:	1588026
MD5:	42ffc12eea8c33daf7cd708e02002e16
SHA1:	2fc97ab3ec2bc563b39d6e3acf54edf378aab95a
SHA256:	49576a80267abe5303a939184d9be72fb7bc25a605705892ae4ad87913a66b6d
Tags:	elfMiraiuser-abuse_ch
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sample deletes itself

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588026
Start date and time:	2025-01-10 20:41:49 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	debvps.elf
Detection:	MAL
Classification:	mal64.spre.evad.linELF@0/81@12/0

Warnings

VT rate limit hit for: ofewu.eye-network.ru

Runtime Messages

Command:	/tmp/debvps.elf
PID:	5483
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

debvps.elf (PID: 5483, Parent: 5408, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/debvps.elf

debvps.elf New Fork (PID: 5485, Parent: 5483)

debvps.elf New Fork (PID: 5487, Parent: 5485)

debvps.elf New Fork (PID: 5489, Parent: 5485)

debvps.elf New Fork (PID: 5491, Parent: 5485)

systemd New Fork (PID: 5513, Parent: 1)

rsyslogd (PID: 5513, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

xfce4-panel New Fork (PID: 5515, Parent: 3172)

wrapper-2.0 (PID: 5515, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 5516, Parent: 3172)

wrapper-2.0 (PID: 5516, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 5517, Parent: 3172)

wrapper-2.0 (PID: 5517, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 5518, Parent: 3172)

wrapper-2.0 (PID: 5518, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

wrapper-2.0 New Fork (PID: 5541, Parent: 5518)

xfpm-power-backlight-helper (PID: 5541, Parent: 5518, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness

xfce4-panel New Fork (PID: 5519, Parent: 3172)

wrapper-2.0 (PID: 5519, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 5520, Parent: 3172)

wrapper-2.0 (PID: 5520, Parent: 3172, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

systemd New Fork (PID: 5523, Parent: 1)

rsyslogd (PID: 5523, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

dbus-daemon New Fork (PID: 5540, Parent: 5539)

xfconfd (PID: 5540, Parent: 5539, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

systemd New Fork (PID: 5563, Parent: 1)

rsyslogd (PID: 5563, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5571, Parent: 1)

rsyslogd (PID: 5571, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5575, Parent: 1)

rsyslogd (PID: 5575, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5582, Parent: 1)

rsyslogd (PID: 5582, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5588, Parent: 1)

rsyslogd (PID: 5588, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5594, Parent: 1)

rsyslogd (PID: 5594, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5598, Parent: 1)

rsyslogd (PID: 5598, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5604, Parent: 1)

rsyslogd (PID: 5604, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5608, Parent: 1)

rsyslogd (PID: 5608, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5614, Parent: 1)

rsyslogd (PID: 5614, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5620, Parent: 1)

rsyslogd (PID: 5620, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5624, Parent: 1)

rsyslogd (PID: 5624, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5631, Parent: 1)

rsyslogd (PID: 5631, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5635, Parent: 1)

rsyslogd (PID: 5635, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5643, Parent: 1)

rsyslogd (PID: 5643, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5649, Parent: 1)

rsyslogd (PID: 5649, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5653, Parent: 1)

rsyslogd (PID: 5653, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5659, Parent: 1)

rsyslogd (PID: 5659, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5665, Parent: 1)

rsyslogd (PID: 5665, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5669, Parent: 1)

rsyslogd (PID: 5669, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5675, Parent: 1)

rsyslogd (PID: 5675, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5676, Parent: 1)

rsyslogd (PID: 5676, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5683, Parent: 1)

rsyslogd (PID: 5683, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5687, Parent: 1)

rsyslogd (PID: 5687, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5693, Parent: 1)

rsyslogd (PID: 5693, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5697, Parent: 1)

rsyslogd (PID: 5697, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5703, Parent: 1)

rsyslogd (PID: 5703, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5709, Parent: 1)

rsyslogd (PID: 5709, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5713, Parent: 1)

rsyslogd (PID: 5713, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5719, Parent: 1)

rsyslogd (PID: 5719, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5725, Parent: 1)

rsyslogd (PID: 5725, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5729, Parent: 1)

rsyslogd (PID: 5729, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5736, Parent: 1)

rsyslogd (PID: 5736, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5740, Parent: 1)

rsyslogd (PID: 5740, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5748, Parent: 1)

rsyslogd (PID: 5748, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5754, Parent: 1)

rsyslogd (PID: 5754, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5758, Parent: 1)

rsyslogd (PID: 5758, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5764, Parent: 1)

rsyslogd (PID: 5764, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5770, Parent: 1)

rsyslogd (PID: 5770, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5774, Parent: 1)

rsyslogd (PID: 5774, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: debvps.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: debvps.elf	Virustotal: Detection: 28%			Perma Link
Source: debvps.elf	ReversingLabs: Detection: 34%

Source: global traffic	TCP traffic: 192.168.2.14:57250 -> 89.190.156.145:7733
Source: global traffic	TCP traffic: 192.168.2.14:43286 -> 141.98.10.40:33966

Source: /usr/sbin/rsyslogd (PID: 5523)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5563)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5571)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5575)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5582)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5588)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5594)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5598)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5604)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5608)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5614)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5620)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5624)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5631)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5635)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5643)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5649)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5653)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5659)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5665)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5669)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5676)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5683)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5687)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5693)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5697)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5703)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5709)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5713)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5719)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5725)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5729)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5736)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5740)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5748)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5754)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5758)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5764)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5770)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5774)	Reads hosts file: /etc/hosts	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic

DNS traffic detected: DNS query: ofewu.eye-network.ru

Source: syslog.48.dr, syslog.84.dr, syslog.88.dr, syslog.44.dr, syslog.102.dr, syslog.86.dr, syslog.110.dr, syslog.82.dr, syslog.76.dr, syslog.100.dr, syslog.52.dr, syslog.98.dr, syslog.92.dr, syslog.62.dr, syslog.74.dr, syslog.114.dr, syslog.68.dr, syslog.104.dr, syslog.38.dr, syslog.50.dr, syslog.32.dr

String found in binary or memory: https://www.rsyslog.com

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/debvps.elf (PID: 5485)	SIGKILL sent: pid: 5489, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 782, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 791, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 806, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 853, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 917, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 928, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 3129, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 3184, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 3187, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 3188, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 3189, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 3190, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 3193, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 3207, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 3215, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 3235, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5491, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5513, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5515, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5516, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5517, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5518, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5519, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5520, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5523, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5540, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5563, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5571, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5575, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5582, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5588, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5594, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5598, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5604, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5608, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5614, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5620, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5624, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5631, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5635, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5643, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5649, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5653, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5659, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5665, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5669, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5675, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5676, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5683, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5687, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5693, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5697, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5703, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5709, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5713, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5719, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5725, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5729, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5736, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5740, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5748, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5754, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5758, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5764, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5770, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: sys_monitor_cnrbusyboxadbddockerdBlink_Cloudsystemdhttpshsshdbashmsg_centerlte_mgrmain_mgrpkarm7pkarm5pkarmpkarm6pkmipspkmpslpkx86/tmp/var/mnt/root/boot/sbin/home/dev/media/opt/../(deleted)x86armmipsmpslsh4arm5arm6%s/%s/data/local/tmp/bin/dev/null/dev/console/var/lib/dockerofewu.eye-network.ruabcdefghijklmnopqrstuvwxyz/proc/%d/cmdline/proc/%d/proc/selfhttpd/proc/self/exe

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/debvps.elf (PID: 5485)	SIGKILL sent: pid: 5489, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 782, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 791, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 806, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 853, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 917, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 928, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 3129, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 3184, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 3187, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 3188, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 3189, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 3190, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 3193, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 3207, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 3215, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 3235, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5491, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5513, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5515, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5516, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5517, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5518, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5519, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5520, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5523, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5540, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5563, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5571, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5575, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5582, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5588, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5594, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5598, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5604, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5608, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5614, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5620, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5624, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5631, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5635, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5643, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5649, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5653, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5659, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5665, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5669, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5675, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5676, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5683, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5687, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5693, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5697, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5703, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5709, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5713, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5719, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5725, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5729, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5736, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5740, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5748, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5754, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5758, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5764, result: successful	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	SIGKILL sent: pid: 5770, result: successful	Jump to behavior

Source: classification engine

Classification label: mal64.spre.evad.linELF@0/81@12/0

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5516)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5517)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5518)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5519)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5520)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5540)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5540)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5540)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5540)	Directory: /home/saturnino/.config	Jump to behavior

Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/3760/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/3760/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/3761/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/3761/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/1583/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/1583/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/1583/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/2672/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/2672/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/2672/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/1577/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/1577/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/1577/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/13/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/13/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/13/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/14/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/14/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/14/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/15/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/15/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/15/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/16/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/16/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/16/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/17/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/17/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/17/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/18/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/18/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/18/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/19/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/19/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/19/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/1593/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/1593/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/1593/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/240/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/240/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/240/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/120/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/120/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/120/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/3094/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/3094/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/3094/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/121/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/121/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/121/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/242/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/242/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/242/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/3406/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/3406/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/122/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/122/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/122/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/243/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/243/stat	Jump to behavior
Source: /tmp/debvps.elf (PID: 5487)	File opened: /proc/243/stat	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 5523)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5563)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5571)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5575)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5582)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5588)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5594)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5598)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5604)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5608)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5614)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5620)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5624)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5631)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5635)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5643)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5649)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5653)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5659)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5665)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5669)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5676)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5683)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5687)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5693)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5697)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5703)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5709)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5713)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5719)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5725)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5729)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5736)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5740)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5748)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5754)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5758)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5764)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5770)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5774)	Log file created: /var/log/kern.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/debvps.elf (PID: 5485)

File: /tmp/debvps.elf

Jump to behavior

Source: /tmp/debvps.elf (PID: 5483)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5516)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5517)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5518)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5519)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5520)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5523)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5563)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5571)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5575)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5582)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5588)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5594)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5598)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5604)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5608)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5614)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5620)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5624)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5631)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5635)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5643)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5649)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5653)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5659)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5665)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5669)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5676)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5683)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5687)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5693)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5697)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5703)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5709)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5713)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5719)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5725)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5729)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5736)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5740)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5748)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5754)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5758)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5764)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5770)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5774)	Queries kernel information via 'uname':	Jump to behavior

Source: debvps.elf, 5483.1.00007ffec3521000.00007ffec3542000.rw-.sdmp, debvps.elf, 5489.1.00007ffec3521000.00007ffec3542000.rw-.sdmp, debvps.elf, 5491.1.00007ffec3521000.00007ffec3542000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mips/tmp/debvps.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/debvps.elf
Source: debvps.elf, 5491.1.000055ba28b8d000.000055ba28c14000.rw-.sdmp	Binary or memory string: /tmp/vmware-root_726-2957583432
Source: debvps.elf, 5483.1.00007ffec3521000.00007ffec3542000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.iWKqCO
Source: debvps.elf, 5491.1.00007f94ec47d000.00007f94ec483000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.logG
Source: debvps.elf, 5491.1.00007f94ec47d000.00007f94ec483000.rw-.sdmp	Binary or memory string: $/tmp/vmware-root_726-2957583432
Source: debvps.elf, 5491.1.00007f94ec47d000.00007f94ec483000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.3.log
Source: debvps.elf, 5483.1.000055ba28b8d000.000055ba28c14000.rw-.sdmp, debvps.elf, 5489.1.000055ba28b8d000.000055ba28c14000.rw-.sdmp, debvps.elf, 5491.1.000055ba28b8d000.000055ba28c14000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mips
Source: debvps.elf, 5483.1.000055ba28b8d000.000055ba28c14000.rw-.sdmp, debvps.elf, 5489.1.000055ba28b8d000.000055ba28c14000.rw-.sdmp, debvps.elf, 5491.1.000055ba28b8d000.000055ba28c14000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: debvps.elf, 5491.1.000055ba28b8d000.000055ba28c14000.rw-.sdmp	Binary or memory string: U1/tmp/vmware-root_726-2957583432a/tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-fwupd.service-Kkp3rg/tmp`
Source: debvps.elf, 5483.1.00007ffec3521000.00007ffec3542000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.iWKqCO\d
Source: debvps.elf, 5491.1.00007f94ec47d000.00007f94ec483000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.1.log
Source: debvps.elf, 5483.1.00007ffec3521000.00007ffec3542000.rw-.sdmp, debvps.elf, 5489.1.00007ffec3521000.00007ffec3542000.rw-.sdmp, debvps.elf, 5491.1.00007ffec3521000.00007ffec3542000.rw-.sdmp	Binary or memory string: %s/qemu-op
Source: debvps.elf, 5491.1.00007f94ec47d000.00007f94ec483000.rw-.sdmp	Binary or memory string: $/tmp/vmware-root_726-2957583432
Source: debvps.elf, 5491.1.00007f94ec47d000.00007f94ec483000.rw-.sdmp	Binary or memory string: vmware-vmtoolsd-root.loglog
Source: debvps.elf, 5483.1.00007ffec3521000.00007ffec3542000.rw-.sdmp, debvps.elf, 5489.1.00007ffec3521000.00007ffec3542000.rw-.sdmp, debvps.elf, 5491.1.00007ffec3521000.00007ffec3542000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips
Source: debvps.elf, 5491.1.00007f94ec47d000.00007f94ec483000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.2.logsysteogsyste
Source: debvps.elf, 5491.1.00007f94ec47d000.00007f94ec483000.rw-.sdmp	Binary or memory string: vmware-vmtoolsd-root.log
Source: syslog.32.dr	Binary or memory string: Jan 10 13:42:36 galassia kernel: [ 117.323544] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel parport_pc ppdev lp drm parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi scsi_transport_spi mptscsih vmxnet3 libahci mptbase
Source: debvps.elf, 5491.1.00007f94ec47d000.00007f94ec483000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.log
Source: debvps.elf, 5483.1.00007ffec3521000.00007ffec3542000.rw-.sdmp, debvps.elf, 5489.1.00007ffec3521000.00007ffec3542000.rw-.sdmp, debvps.elf, 5491.1.00007ffec3521000.00007ffec3542000.rw-.sdmp	Binary or memory string: MPDIR%s/qemu-op
Source: debvps.elf, 5491.1.00007f94ec47d000.00007f94ec483000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.2.log
Source: syslog.32.dr	Binary or memory string: Jan 10 13:42:36 galassia kernel: [ 117.323569] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
debvps.elf	29%	Virustotal		Browse
debvps.elf	34%	ReversingLabs	Linux.Backdoor.Mirai
debvps.elf	100%	Avira	EXP/ELF.Agent.J.8

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ofewu.eye-network.ru	141.98.10.40	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.48.dr, syslog.84.dr, syslog.88.dr, syslog.44.dr, syslog.102.dr, syslog.86.dr, syslog.110.dr, syslog.82.dr, syslog.76.dr, syslog.100.dr, syslog.52.dr, syslog.98.dr, syslog.92.dr, syslog.62.dr, syslog.74.dr, syslog.114.dr, syslog.68.dr, syslog.104.dr, syslog.38.dr, syslog.50.dr, syslog.32.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.190.156.145	unknown	United Kingdom		7489	HOSTUS-GLOBAL-ASHostUSHK	false
141.98.10.40	ofewu.eye-network.ru	Lithuania		209605	HOSTBALTICLT	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
89.190.156.145	wev86.elf	Get hash	malicious	Unknown	Browse
	vevhea4.elf	Get hash	malicious	Unknown	Browse
	fqkjei686.elf	Get hash	malicious	Unknown	Browse
	wrjkngh4.elf	Get hash	malicious	Unknown	Browse
	vevhea4.elf	Get hash	malicious	Unknown	Browse
	qbfwdbg.elf	Get hash	malicious	Unknown	Browse
	wlw68k.elf	Get hash	malicious	Unknown	Browse
	ivwebcda7.elf	Get hash	malicious	Mirai	Browse
	fbhervbhsl.elf	Get hash	malicious	Unknown	Browse
	ngwa5.elf	Get hash	malicious	Unknown	Browse
141.98.10.40	DOC11042024.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	vyebetsh.sa.com/nMcrGmhC252.bin

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	wev86.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	vevhea4.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	fqkjei686.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	wrjkngh4.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	vevhea4.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	qbfwdbg.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	wlw68k.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	ivwebcda7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	fbhervbhsl.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	ngwa5.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
HOSTBALTICLT	wev86.elf	Get hash	malicious	Unknown	Browse	141.98.10.40
	vevhea4.elf	Get hash	malicious	Unknown	Browse	141.98.10.40
	ivwebcda7.elf	Get hash	malicious	Mirai	Browse	141.98.10.40
	uYtea.sh4.elf	Get hash	malicious	Unknown	Browse	141.98.10.115
	uYtea.ppc.elf	Get hash	malicious	Unknown	Browse	141.98.10.115
	uYtea.x86.elf	Get hash	malicious	Unknown	Browse	141.98.10.115
	uYtea.arm.elf	Get hash	malicious	Unknown	Browse	141.98.10.115
	uYtea.mips.elf	Get hash	malicious	Unknown	Browse	141.98.10.115
	uYtea.mpsl.elf	Get hash	malicious	Unknown	Browse	141.98.10.115
	uYtea.arm7.elf	Get hash	malicious	Mirai	Browse	141.98.10.115

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.iWKqCO (deleted)

Download File

Process:	/tmp/debvps.elf
File Type:	data
Category:	dropped
Size (bytes):	26
Entropy (8bit):	4.008132025833399
Encrypted:	false
SSDEEP:	3:Tg25WCL8HJN:Tg2IBJN
MD5:	EB5CC69A3038062C3CA239186ABC1C09
SHA1:	941DA5E1114CCC4B43EFDF46400A75FF49946273
SHA-256:	60FFE9F835888E3911B3AE5E10F773CE6130B22508C724A7AE6B006BA638BBE5
SHA-512:	2ECC497A98A7DE4A9D5C92BCE048BF90A7DC4A82975BF905055335E8EB6FB91B1E52AD7BAE671208BDF7B2E371B3684F149F2B89D8AE82FAE2F4E682E22C7EF0
Malicious:	false
Reputation:	low
Preview:	/tmp/debvps.elf.nwlrbbmqbh

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	799
Entropy (8bit):	4.712969901675303
Encrypted:	false
SSDEEP:	24:xZIY/DIY5ewIYaeIYTfIYq5IYxGMIYpGDIYsJAIoIYsSAIV:xZIY7IYRIYRIYLIYuIYlIYAIYsPoIYsu
MD5:	86364EBA3E2861A34ACDD2E3D573128B
SHA1:	3F6B483CDC34DCDDE88D8EDD3ABB1A3E9CBB0A60
SHA-256:	C252302BA7D670BB60B10146604CC8AF0827E07CA1360E7AAC651FB3DBEEEE5D
SHA-512:	8DC5140238C1EF1454FF3B2C4845DDE22FC5C812ABA01760649C45227C8AEDF0A2C7041B023BA72822EC607D31D2434F3FAFB8E48E18BE7954F042562F271F44
Malicious:	false
Reputation:	low
Preview:	Jan 10 13:44:38 galassia kernel: [ 241.304554] blocking signal 9: 5487 -> 1289.Jan 10 13:44:38 galassia kernel: [ 241.354587] blocking signal 9: 5487 -> 661.Jan 10 13:44:38 galassia kernel: [ 241.365963] blocking signal 9: 5487 -> 780.Jan 10 13:44:38 galassia kernel: [ 241.374434] blocking signal 9: 5487 -> 806.Jan 10 13:44:38 galassia kernel: [ 241.381947] blocking signal 9: 5487 -> 853.Jan 10 13:44:38 galassia kernel: [ 241.389145] blocking signal 9: 5487 -> 940.Jan 10 13:44:38 galassia kernel: [ 241.396325] blocking signal 9: 5487 -> 1289.Jan 10 13:44:38 galassia kernel: [ 241.667404] New task spawned: old: (tgid 5774, tid 5774), new (tgid: 5774, tid: 5775).Jan 10 13:44:38 galassia kernel: [ 241.667779] New task spawned: old: (tgid 5774, tid 5774), new (tgid: 5774, tid: 5776).

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	2166
Entropy (8bit):	5.02363802382516
Encrypted:	false
SSDEEP:	48:xZg3XgWfOgPftWRTNIY7IYRIYRIYLIYuIYlIYAIYsPoIYs8xR6IHBt/9dZHZtZp:iYR5R
MD5:	E4CE7E2017BB982153915954EDCC9376
SHA1:	64AE4C268E84D667C6B1E4FE5C7E8044B63E8613
SHA-256:	0579B01509B9B576413531198105CCC90B6B997FC712FE43F184BDD328EB92E4
SHA-512:	E7C09FA89E5F3E1271D97B24B2F8524122C1317F63DD29AD7AC6C6320D25EA9F569F0C9389E3E64897DA8BE94D47359C0C85D1E5138709DE02D5B2E0A30A920B
Malicious:	false
Reputation:	low
Preview:	Jan 10 13:44:38 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Jan 10 13:44:38 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Jan 10 13:44:38 galassia systemd[1]: systemd-udevd.service: Got notification message from PID 5325, but reception is disabled..Jan 10 13:44:38 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 42..Jan 10 13:44:38 galassia systemd[1]: Stopped System Logging Service..Jan 10 13:44:38 galassia systemd[1]: Starting System Logging Service....Jan 10 13:44:38 galassia systemd[1]: Started System Logging Service..Jan 10 13:44:38 galassia kernel: [ 241.304554] blocking signal 9: 5487 -> 1289.Jan 10 13:44:38 galassia kernel: [ 241.354587] blocking signal 9: 5487 -> 661.Jan 10 13:44:38 galassia kernel: [ 241.365963] blocking signal 9: 5487 -> 780.Jan 10 13:44:38 galassia kernel: [ 241.374434] blocking signal 9: 5487 -> 806.Jan 10 13:44:38 galassia kernel: [ 241.381947] blocking s

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	4.985709145070229
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	debvps.elf
File size:	193'996 bytes
MD5:	42ffc12eea8c33daf7cd708e02002e16
SHA1:	2fc97ab3ec2bc563b39d6e3acf54edf378aab95a
SHA256:	49576a80267abe5303a939184d9be72fb7bc25a605705892ae4ad87913a66b6d
SHA512:	1302e121c537826bc42546920953d31ffc889f535a5600992a41aa483719ca50156fa10175eb0c4eff3eee75763b9fd80082e736fc95ff9d22fa10bc243ceff3
SSDEEP:	1536:zLBcktb4QZY2yTIfuxWYhwP79UsPTbeShpd4I9INOT6l1GT6u7CvzEu:XBcm4QLMxWYKP7msPTld4rbDGOu7Cvou
TLSH:	9A14971E6F228F7EF668873147B78A25976923D627E1D684E1ACD1101F2034E641FFB8
File Content Preview:	.ELF.....................@.`...4.........4. ...(.............@...@.....p...p...............t.F.t.F.t..X... ,........dt.Q............................<...'.h<...!'.......................<...'.h....!... ....'9... ......................<...'.g....!...$....'9a

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	193436
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x26090	0x0	0x6	AX	16
.fini	PROGBITS	0x4261b0	0x261b0	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x426210	0x26210	0x3860	0x0	0x2	A	16
.ctors	PROGBITS	0x469a74	0x29a74	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x469a80	0x29a80	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x469a8c	0x29a8c	0x474	0x0	0x3	WA	4
.data	PROGBITS	0x469f00	0x29f00	0x49e0	0x0	0x3	WA	32
.got	PROGBITS	0x46e8e0	0x2e8e0	0xa58	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x46f338	0x2f338	0x50	0x0	0x10000003	WAp	4
.bss	NOBITS	0x46f390	0x2f338	0xc710	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x1320	0x2f338	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x2f338	0x64	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x29a70	0x29a70	5.3136	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x29a74	0x469a74	0x469a74	0x58c4	0x1202c	1.4506	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:42:35.520204067 CET	51042	53	192.168.2.14	8.8.8.8
Jan 10, 2025 20:42:35.529778004 CET	53	51042	8.8.8.8	192.168.2.14
Jan 10, 2025 20:42:35.537188053 CET	37650	53	192.168.2.14	8.8.8.8
Jan 10, 2025 20:42:35.546758890 CET	53	37650	8.8.8.8	192.168.2.14
Jan 10, 2025 20:42:57.939774990 CET	58874	53	192.168.2.14	8.8.8.8
Jan 10, 2025 20:42:57.946928024 CET	53	58874	8.8.8.8	192.168.2.14
Jan 10, 2025 20:42:57.948359013 CET	51411	53	192.168.2.14	8.8.8.8
Jan 10, 2025 20:42:57.958476067 CET	53	51411	8.8.8.8	192.168.2.14
Jan 10, 2025 20:43:20.364967108 CET	58076	53	192.168.2.14	8.8.8.8
Jan 10, 2025 20:43:20.376353979 CET	53	58076	8.8.8.8	192.168.2.14
Jan 10, 2025 20:43:20.377346039 CET	58892	53	192.168.2.14	8.8.8.8
Jan 10, 2025 20:43:20.387765884 CET	53	58892	8.8.8.8	192.168.2.14
Jan 10, 2025 20:43:42.772305012 CET	46640	53	192.168.2.14	8.8.8.8
Jan 10, 2025 20:43:42.782015085 CET	53	46640	8.8.8.8	192.168.2.14
Jan 10, 2025 20:43:42.783240080 CET	36126	53	192.168.2.14	8.8.8.8
Jan 10, 2025 20:43:42.790271997 CET	53	36126	8.8.8.8	192.168.2.14
Jan 10, 2025 20:44:05.160368919 CET	55987	53	192.168.2.14	8.8.8.8
Jan 10, 2025 20:44:05.171930075 CET	53	55987	8.8.8.8	192.168.2.14
Jan 10, 2025 20:44:05.173130035 CET	60109	53	192.168.2.14	8.8.8.8
Jan 10, 2025 20:44:05.180037975 CET	53	60109	8.8.8.8	192.168.2.14
Jan 10, 2025 20:44:27.548793077 CET	51942	53	192.168.2.14	8.8.8.8
Jan 10, 2025 20:44:27.555686951 CET	53	51942	8.8.8.8	192.168.2.14
Jan 10, 2025 20:44:27.556413889 CET	36015	53	192.168.2.14	8.8.8.8
Jan 10, 2025 20:44:27.563360929 CET	53	36015	8.8.8.8	192.168.2.14

Start time (UTC):	19:42:33
Start date (UTC):	10/01/2025
Path:	/tmp/debvps.elf
Arguments:	/tmp/debvps.elf
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Start time (UTC):	19:42:34
Start date (UTC):	10/01/2025
Path:	/tmp/debvps.elf
Arguments:	-
File size:	5777432 bytes
MD5 hash:	0083f1f0e77be34ad27f849842bbb00c

Start time (UTC):	19:42:42
Start date (UTC):	10/01/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	-
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	19:42:44
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:42:48
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:42:49
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:42:52
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:42:53
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:42:56
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:42:57
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:43:00
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:43:03
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:43:06
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:43:10
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:43:13
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report debvps.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.iWKqCO (deleted)

/var/log/kern.log

/var/log/syslog

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: debvps.elf PID: 5483, Parent PID: 5408

General

Chronological Activities

Analysis Process: debvps.elf PID: 5485, Parent PID: 5483

General

Chronological Activities

Analysis Process: debvps.elf PID: 5487, Parent PID: 5485

General

Chronological Activities

Analysis Process: debvps.elf PID: 5489, Parent PID: 5485

General

Analysis Process: debvps.elf PID: 5491, Parent PID: 5485

General

Chronological Activities

Analysis Process: systemd PID: 5513, Parent PID: 1

General

Linux Analysis Report
debvps.elf

Start time (UTC):	19:43:16
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:43:19
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:43:23
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:43:26
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:43:29
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:43:32
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:43:35
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:43:38
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:43:41
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:43:42
Start date (UTC):	10/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75