Edit tour

Linux Analysis Report
Fantazy.arm4.elf

Overview

General Information

Sample name:	Fantazy.arm4.elf
Analysis ID:	1591191
MD5:	b8299420792a8b06a236971ccc84101c
SHA1:	db759f9e55661392f025f1854458fee4a16d96df
SHA256:	bff38e582d1f063e21b73387b079a75d0f8babb63e792b39450382fa449e6cd2
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591191
Start date and time:	2025-01-14 19:37:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Fantazy.arm4.elf
Detection:	MAL
Classification:	mal68.spre.troj.linELF@0/43@3/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing network information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/Fantazy.arm4.elf
PID:	6240
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	VegaSec-KATANA001
Standard Error:

Process Tree

system is lnxubuntu20

Fantazy.arm4.elf (PID: 6240, Parent: 6160, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/Fantazy.arm4.elf

Fantazy.arm4.elf New Fork (PID: 6242, Parent: 6240)

Fantazy.arm4.elf New Fork (PID: 6243, Parent: 6240)

Fantazy.arm4.elf New Fork (PID: 6246, Parent: 6243)

Fantazy.arm4.elf New Fork (PID: 6248, Parent: 6243)

Fantazy.arm4.elf New Fork (PID: 6249, Parent: 6243)

systemd New Fork (PID: 6257, Parent: 1)

journalctl (PID: 6257, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6269, Parent: 1)

systemd-journald (PID: 6269, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6275, Parent: 1)

journalctl (PID: 6275, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6329, Parent: 1)

dbus-daemon (PID: 6329, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6343, Parent: 1860)

pulseaudio (PID: 6343, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6346, Parent: 1)

rtkit-daemon (PID: 6346, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6349, Parent: 1)

systemd-logind (PID: 6349, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6411, Parent: 1)

polkitd (PID: 6411, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6416, Parent: 1)

agetty (PID: 6416, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6417, Parent: 1)

rsyslogd (PID: 6417, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

gdm3 New Fork (PID: 6418, Parent: 1320)

Default (PID: 6418, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6419, Parent: 1320)

Default (PID: 6419, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6420, Parent: 1320)

Default (PID: 6420, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6426, Parent: 1)

gpu-manager (PID: 6426, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6427, Parent: 6426)

sh (PID: 6427, Parent: 6426, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6428, Parent: 6427)

grep (PID: 6428, Parent: 6427, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6429, Parent: 6426)

sh (PID: 6429, Parent: 6426, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6430, Parent: 6429)

grep (PID: 6430, Parent: 6429, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6431, Parent: 6426)

sh (PID: 6431, Parent: 6426, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6432, Parent: 6431)

grep (PID: 6432, Parent: 6431, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6433, Parent: 6426)

sh (PID: 6433, Parent: 6426, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6434, Parent: 6433)

grep (PID: 6434, Parent: 6433, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6435, Parent: 6426)

sh (PID: 6435, Parent: 6426, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6436, Parent: 6435)

grep (PID: 6436, Parent: 6435, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6437, Parent: 6426)

sh (PID: 6437, Parent: 6426, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6438, Parent: 6437)

grep (PID: 6438, Parent: 6437, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6440, Parent: 6426)

sh (PID: 6440, Parent: 6426, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6441, Parent: 6440)

grep (PID: 6441, Parent: 6440, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6442, Parent: 6426)

sh (PID: 6442, Parent: 6426, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6443, Parent: 6442)

grep (PID: 6443, Parent: 6442, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6446, Parent: 1)

generate-config (PID: 6446, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6447, Parent: 6446)

pkill (PID: 6447, Parent: 6446, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6450, Parent: 1)

gdm-wait-for-drm (PID: 6450, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6455, Parent: 1)

gdm3 (PID: 6455, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6459, Parent: 6455)

plymouth (PID: 6459, Parent: 6455, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6477, Parent: 6455)

gdm-session-worker (PID: 6477, Parent: 6455, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6483, Parent: 6477)

gdm-wayland-session (PID: 6483, Parent: 6477, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6485, Parent: 6483)

dbus-daemon (PID: 6485, Parent: 6483, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6487, Parent: 6485)

dbus-daemon New Fork (PID: 6488, Parent: 6487)

false (PID: 6488, Parent: 6487, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6489, Parent: 6483)

dbus-run-session (PID: 6489, Parent: 6483, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6490, Parent: 6489)

dbus-daemon (PID: 6490, Parent: 6489, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6491, Parent: 6455)

Default (PID: 6491, Parent: 6455, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6492, Parent: 6455)

Default (PID: 6492, Parent: 6455, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6461, Parent: 1)

accounts-daemon (PID: 6461, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6472, Parent: 6461)

language-validate (PID: 6472, Parent: 6461, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6473, Parent: 6472)

language-options (PID: 6473, Parent: 6472, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6474, Parent: 6473)

sh (PID: 6474, Parent: 6473, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6475, Parent: 6474)

locale (PID: 6475, Parent: 6474, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6476, Parent: 6474)

grep (PID: 6476, Parent: 6474, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

gvfsd-fuse New Fork (PID: 6504, Parent: 2038)

fusermount (PID: 6504, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6546, Parent: 1860)

dbus-daemon (PID: 6546, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6417)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /tmp/Fantazy.arm4.elf (PID: 6240)	Socket: 127.0.0.1:59025	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6455)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6485)	Socket: unknown address family	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 121.9.189.98
Source: unknown	TCP traffic detected without corresponding DNS query: 160.91.172.82
Source: unknown	TCP traffic detected without corresponding DNS query: 223.42.117.125
Source: unknown	TCP traffic detected without corresponding DNS query: 88.187.129.11
Source: unknown	TCP traffic detected without corresponding DNS query: 41.205.159.39
Source: unknown	TCP traffic detected without corresponding DNS query: 74.35.135.66
Source: unknown	TCP traffic detected without corresponding DNS query: 219.98.38.0
Source: unknown	TCP traffic detected without corresponding DNS query: 156.196.176.176
Source: unknown	TCP traffic detected without corresponding DNS query: 102.226.119.247
Source: unknown	TCP traffic detected without corresponding DNS query: 58.232.215.187
Source: unknown	TCP traffic detected without corresponding DNS query: 125.187.18.152
Source: unknown	TCP traffic detected without corresponding DNS query: 41.37.229.183
Source: unknown	TCP traffic detected without corresponding DNS query: 186.92.129.154
Source: unknown	TCP traffic detected without corresponding DNS query: 220.7.30.178
Source: unknown	TCP traffic detected without corresponding DNS query: 24.205.123.116
Source: unknown	TCP traffic detected without corresponding DNS query: 89.97.207.44
Source: unknown	TCP traffic detected without corresponding DNS query: 103.239.28.30
Source: unknown	TCP traffic detected without corresponding DNS query: 155.227.94.5
Source: unknown	TCP traffic detected without corresponding DNS query: 108.62.61.39
Source: unknown	TCP traffic detected without corresponding DNS query: 174.40.209.122
Source: unknown	TCP traffic detected without corresponding DNS query: 133.168.55.43
Source: unknown	TCP traffic detected without corresponding DNS query: 207.188.15.24
Source: unknown	TCP traffic detected without corresponding DNS query: 222.25.178.254
Source: unknown	TCP traffic detected without corresponding DNS query: 190.219.104.162
Source: unknown	TCP traffic detected without corresponding DNS query: 37.111.168.111
Source: unknown	TCP traffic detected without corresponding DNS query: 81.221.143.107
Source: unknown	TCP traffic detected without corresponding DNS query: 36.50.141.249
Source: unknown	TCP traffic detected without corresponding DNS query: 19.232.207.145
Source: unknown	TCP traffic detected without corresponding DNS query: 101.140.54.173
Source: unknown	TCP traffic detected without corresponding DNS query: 60.67.6.179
Source: unknown	TCP traffic detected without corresponding DNS query: 9.61.170.188
Source: unknown	TCP traffic detected without corresponding DNS query: 166.225.154.76
Source: unknown	TCP traffic detected without corresponding DNS query: 58.59.31.205
Source: unknown	TCP traffic detected without corresponding DNS query: 177.208.241.52
Source: unknown	TCP traffic detected without corresponding DNS query: 116.127.234.212
Source: unknown	TCP traffic detected without corresponding DNS query: 178.147.81.160
Source: unknown	TCP traffic detected without corresponding DNS query: 94.11.36.218
Source: unknown	TCP traffic detected without corresponding DNS query: 159.153.87.68
Source: unknown	TCP traffic detected without corresponding DNS query: 87.202.202.91
Source: unknown	TCP traffic detected without corresponding DNS query: 82.4.38.61
Source: unknown	TCP traffic detected without corresponding DNS query: 71.231.240.227
Source: unknown	TCP traffic detected without corresponding DNS query: 82.89.64.194
Source: unknown	TCP traffic detected without corresponding DNS query: 159.64.253.243
Source: unknown	TCP traffic detected without corresponding DNS query: 203.21.41.231
Source: unknown	TCP traffic detected without corresponding DNS query: 61.78.69.16
Source: unknown	TCP traffic detected without corresponding DNS query: 184.121.208.27
Source: unknown	TCP traffic detected without corresponding DNS query: 223.31.206.163

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.39.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53712
Source: unknown	Network traffic detected: HTTP traffic on port 53712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 6072, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 6222, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 6223, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 6243, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 6248, result: unknown	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 6072, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 6222, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 6223, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 6243, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6248)	SIGKILL sent: pid: 6248, result: unknown	Jump to behavior

Source: classification engine

Classification label: mal68.spre.troj.linELF@0/43@3/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6329)	File: /proc/6329/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6485)	File: /proc/6485/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6490)	File: /proc/6490/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6504)	File: /proc/6504/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6546)	File: /proc/6546/mounts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6269)	File: /run/systemd/journal/streams/.#9:74518uKpIdg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File: /run/systemd/journal/streams/.#9:74519HcA1Ic	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File: /run/systemd/journal/streams/.#9:74729SJgLPd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File: /run/systemd/journal/streams/.#9:74742pXVeFe	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File: /run/systemd/journal/streams/.#9:74752ks7Urc	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File: /run/systemd/journal/streams/.#9:77074JCqo2e	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File: /run/systemd/journal/streams/.#9:77075tc61Ag	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File: /run/systemd/journal/streams/.#9:77089zER0zf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File: /run/systemd/journal/streams/.#9:77226iWxkbg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File: /run/systemd/journal/streams/.#9:77412WuxKFg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File: /run/systemd/journal/streams/.#9:77413Y92Nfe	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File: /run/systemd/journal/streams/.#9:77425WBclwc	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File: /run/systemd/journal/streams/.#9:77437yC3Sfg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File: /run/systemd/journal/streams/.#9:77562LAMfIf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File: /run/systemd/journal/streams/.#9:77585WmN3Xf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File: /run/systemd/journal/streams/.#9:77586wKNA4e	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File: /run/systemd/journal/streams/.#9:77602ww1xWd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File: /run/systemd/journal/streams/.#9:77603JuUBtf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File: /run/systemd/journal/streams/.#9:79337EFP6Fd	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6349)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6349)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6349)	File: /run/systemd/seats/.#seat0AbBtkg	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6349)	File: /run/systemd/users/.#127eTsaCh	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6349)	File: /run/systemd/users/.#127iZx6Ig	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6349)	File: /run/systemd/seats/.#seat0dylK9g	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6349)	File: /run/systemd/users/.#1274Ly3gg	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6349)	File: /run/systemd/users/.#127I7pNPh	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6349)	File: /run/systemd/users/.#127dXiAEf	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6349)	File: /run/systemd/users/.#127gel9xg	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6411)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6483)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6461)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6461)	Directory: /root/.cache	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/6477/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/6477/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/6477/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/6477/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/6477/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/6477/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/6477/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2078/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2078/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2078/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2078/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2078/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2078/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2078/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2077/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2077/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2077/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2077/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2077/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2077/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2077/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2033/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2033/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2033/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2033/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2033/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2033/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2033/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2074/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2074/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2074/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2074/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2074/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2074/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2074/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1532/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1532/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1532/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1532/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1532/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1532/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1532/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1576/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1576/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1576/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1576/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1576/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1576/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1334/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/1334/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2302/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2302/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2302/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2302/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2302/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2302/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2025/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2025/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2025/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2025/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2025/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2025/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2025/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2223/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2223/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2223/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2223/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2223/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2223/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	File opened: /proc/2223/cgroup	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6427)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6429)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6431)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6433)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6435)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6437)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6440)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6442)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6474)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Source: /bin/sh (PID: 6428)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6430)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6432)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6434)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6436)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6438)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6441)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6443)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6476)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6447)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6269)

Reads from proc file: /proc/meminfo

Jump to behavior

Source: /sbin/agetty (PID: 6416)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6455)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6455)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6461)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6461)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6417)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6417)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 6426)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 6426)

Truncated file: /var/log/gpu-manager.log

Jump to behavior

Source: /usr/bin/pulseaudio (PID: 6343)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pkill (PID: 6447)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /tmp/Fantazy.arm4.elf (PID: 6240)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6269)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6343)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6416)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6417)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6426)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6477)	Queries kernel information via 'uname':	Jump to behavior

Source: Fantazy.arm4.elf, 6240.1.00007ffc232a7000.00007ffc232c8000.rw-.sdmp, Fantazy.arm4.elf, 6242.1.00007ffc232a7000.00007ffc232c8000.rw-.sdmp, Fantazy.arm4.elf, 6243.1.00007ffc232a7000.00007ffc232c8000.rw-.sdmp, Fantazy.arm4.elf, 6246.1.00007ffc232a7000.00007ffc232c8000.rw-.sdmp, Fantazy.arm4.elf, 6248.1.00007ffc232a7000.00007ffc232c8000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/Fantazy.arm4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Fantazy.arm4.elf
Source: Fantazy.arm4.elf, 6240.1.000055a479a09000.000055a479b37000.rw-.sdmp, Fantazy.arm4.elf, 6242.1.000055a479a09000.000055a479b37000.rw-.sdmp, Fantazy.arm4.elf, 6243.1.000055a479a09000.000055a479b37000.rw-.sdmp, Fantazy.arm4.elf, 6246.1.000055a479a09000.000055a479b37000.rw-.sdmp, Fantazy.arm4.elf, 6248.1.000055a479a09000.000055a479b37000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: kern.log.39.dr	Binary or memory string: Jan 14 12:38:46 galassia kernel: [ 471.258406] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: Fantazy.arm4.elf, 6248.1.00007ffc232a7000.00007ffc232c8000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.zCIKmD
Source: kern.log.39.dr	Binary or memory string: Jan 14 12:38:46 galassia kernel: [ 471.258431] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: Fantazy.arm4.elf, 6240.1.000055a479a09000.000055a479b37000.rw-.sdmp, Fantazy.arm4.elf, 6242.1.000055a479a09000.000055a479b37000.rw-.sdmp, Fantazy.arm4.elf, 6243.1.000055a479a09000.000055a479b37000.rw-.sdmp, Fantazy.arm4.elf, 6246.1.000055a479a09000.000055a479b37000.rw-.sdmp, Fantazy.arm4.elf, 6248.1.000055a479a09000.000055a479b37000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: Fantazy.arm4.elf, 6240.1.00007ffc232a7000.00007ffc232c8000.rw-.sdmp, Fantazy.arm4.elf, 6242.1.00007ffc232a7000.00007ffc232c8000.rw-.sdmp, Fantazy.arm4.elf, 6243.1.00007ffc232a7000.00007ffc232c8000.rw-.sdmp, Fantazy.arm4.elf, 6246.1.00007ffc232a7000.00007ffc232c8000.rw-.sdmp, Fantazy.arm4.elf, 6248.1.00007ffc232a7000.00007ffc232c8000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: Fantazy.arm4.elf, 6248.1.00007ffc232a7000.00007ffc232c8000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.zCIKmD

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6461)

Logged in records file read: /var/log/wtmp

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Fantazy.arm4.elf	57%	Virustotal		Browse
Fantazy.arm4.elf	68%	ReversingLabs	Linux.Trojan.Mirai
Fantazy.arm4.elf	100%	Avira	EXP/ELF.Gafgyt.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.39.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
88.97.58.84	unknown	United Kingdom	13037	ZEN-ASZenInternet-UKGB	false
42.202.54.45	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
93.248.103.214	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
149.92.145.158	unknown	United States	174	COGENT-174US	false
97.211.187.132	unknown	United States	6167	CELLCO-PARTUS	false
97.191.206.109	unknown	United States	6167	CELLCO-PARTUS	false
170.200.195.212	unknown	United States	17044	TRUENORTHCOMMUS	false
4.121.109.34	unknown	United States	3356	LEVEL3US	false
100.205.101.145	unknown	United States	21928	T-MOBILE-AS21928US	false
80.67.177.33	unknown	France	20766	GITOYEN-MAIN-ASThemainAutonomousSystemofGitoyenParis	false
81.116.64.110	unknown	Italy	20959	TELECOM-ITALIA-DATA-COMIT	false
139.190.98.59	unknown	Pakistan	38547	WITRIBE-AS-APWITRIBEPAKISTANLIMITEDPK	false
109.87.252.164	unknown	Ukraine	13188	TRIOLANUA	false
76.55.57.108	unknown	United States	11426	TWC-11426-CAROLINASUS	false
199.57.200.151	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
155.130.200.126	unknown	United States	22911	SINAP-TIXUS	false
150.40.56.82	unknown	Japan	9991	SHUDO-UHiroshimaShudoUniversityJP	false
12.85.167.44	unknown	United States	7018	ATT-INTERNET4US	false
223.31.206.163	unknown	India	9583	SIFY-AS-INSifyLimitedIN	false
34.43.158.177	unknown	United States	2686	ATGS-MMD-ASUS	false
84.224.117.206	unknown	Hungary	8448	PGSM-HUTorokbalintHungaryHU	false
44.161.110.199	unknown	United States	7377	UCSDUS	false
154.123.11.110	unknown	Kenya	12455	JAMBONETKE	false
4.78.223.133	unknown	United States	3356	LEVEL3US	false
79.244.123.120	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
163.102.11.158	unknown	France	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
5.246.7.141	unknown	Saudi Arabia	34400	ASN-ETTIHADETISALATSA	false
39.232.121.188	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
180.117.168.138	unknown	China	137702	CHINATELECOM-JIANGSU-NANJING-IDCNanjingJiangsuProvince	false
113.11.106.139	unknown	Bangladesh	7565	BDCOM-BDRangsNiluSquare5thFloorHouse75Road5AD	false
191.125.223.208	unknown	Chile	7418	TELEFONICACHILESACL	false
62.114.148.192	unknown	Egypt	36992	ETISALAT-MISREG	false
84.252.43.53	unknown	Bulgaria	8717	SPECTRUMNETBG	false
217.185.156.6	unknown	Germany	6805	TDDE-ASN1DE	false
18.87.50.143	unknown	United States	3	MIT-GATEWAYSUS	false
189.129.180.224	unknown	Mexico	8151	UninetSAdeCVMX	false
160.179.111.207	unknown	Morocco	36903	MT-MPLSMA	false
103.63.253.148	unknown	China	18126	CTCXChubuTelecommunicationsCompanyIncJP	false
196.167.122.148	unknown	South Africa	328065	Vast-Networks-ASZA	false
5.17.197.19	unknown	Russian Federation	41733	ZTELECOM-ASRU	false
124.50.41.20	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
113.22.162.42	unknown	Viet Nam	18403	FPT-AS-APTheCorporationforFinancingPromotingTechnolo	false
42.66.104.82	unknown	Taiwan; Republic of China (ROC)	17421	EMOME-NETMobileBusinessGroupTW	false
38.4.250.205	unknown	United States	174	COGENT-174US	false
184.1.118.74	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
203.103.217.16	unknown	Australia	703	UUNETUS	false
102.183.28.32	unknown	Liberia	37611	AfrihostZA	false
71.175.9.34	unknown	United States	701	UUNETUS	false
167.97.33.64	unknown	United States	2055	LSU-1US	false
80.140.128.213	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
89.115.85.38	unknown	Portugal	12353	VODAFONE-PTVodafonePortugalPT	false
93.0.142.119	unknown	France	15557	LDCOMNETFR	false
125.35.193.179	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
102.252.75.222	unknown	South Africa	5713	SAIX-NETZA	false
180.184.146.248	unknown	China	38841	KBRO-AS-TWkbroCOLtdTW	false
87.140.168.102	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
97.211.71.186	unknown	United States	6167	CELLCO-PARTUS	false
82.103.82.15	unknown	Bulgaria	35464	DATAMAXBG	false
58.113.198.168	unknown	Japan	9595	XEPHIONNTT-MECorporationJP	false
192.138.193.232	unknown	United States	7276	UNIVERSITY-OF-HOUSTONUS	false
120.76.196.118	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
190.110.209.136	unknown	Ecuador	22724	PUNTONETSAEC	false
68.46.98.205	unknown	United States	7922	COMCAST-7922US	false
58.38.117.214	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
69.51.221.157	unknown	Canada	4540	ASN01-SOGECA	false
86.222.100.204	unknown	France	3215	FranceTelecom-OrangeFR	false
67.22.143.104	unknown	Canada	13767	DATABANK-DFWUS	false
136.36.91.169	unknown	United States	16591	GOOGLE-FIBERUS	false
79.245.98.134	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
123.224.18.174	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
20.207.221.18	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
67.214.82.17	unknown	United States	11915	US-TELEPACIFICUS	false
39.239.155.57	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
67.23.143.42	unknown	United States	33070	RMH-14US	false
219.174.245.132	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
188.233.57.190	unknown	Russian Federation	39435	EVOLGOGRAD-ASRU	false
57.93.188.37	unknown	Belgium	51964	ORANGE-BUSINESS-SERVICES-IPSN-ASNFR	false
27.136.154.187	unknown	Japan	9824	JTCL-JP-ASJupiterTelecommunicationCoLtdJP	false
165.115.30.254	unknown	Canada	14014	CNRAIL-ASCA	false
156.109.132.128	unknown	United States	36081	STATE-OF-COLORADO-MNT-NETWORKUS	false
169.66.120.28	unknown	United States	37611	AfrihostZA	false
185.35.238.31	unknown	Sweden	200150	EMBERSE	false
175.51.192.92	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
193.136.188.222	unknown	Portugal	1930	RCCNFundacaoparaaCienciaeaTecnologiaIPPT	false
68.43.54.12	unknown	United States	7922	COMCAST-7922US	false
61.5.26.103	unknown	Indonesia	7713	TELKOMNET-AS-APPTTelekomunikasiIndonesiaID	false
40.161.250.136	unknown	United States	4249	LILLY-ASUS	false
181.120.185.134	unknown	Paraguay	23201	TelecelSAPY	false
38.81.112.7	unknown	United States	22742	CT-EDU-NETUS	false
53.252.187.65	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
133.67.133.122	unknown	Japan	24261	MIE-UMieUniversityJP	false
186.102.70.252	unknown	Colombia	3816	COLOMBIATELECOMUNICACIONESSAESPCO	false
177.186.214.86	unknown	Brazil	26615	TIMSABR	false
2.203.197.207	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
201.172.70.74	unknown	Mexico	11888	TelevisionInternacionalSAdeCVMX	false
77.164.103.99	unknown	Netherlands	1136	KPNKPNNationalEU	false
84.234.168.80	unknown	Norway	29695	ALTIBOX_ASNorwayNO	false
36.50.208.242	unknown	unknown	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
61.167.78.49	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
100.58.154.124	unknown	United States	701	UUNETUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
154.123.11.110	Mozi.m.3	Get hash	malicious	Mirai	Browse
79.244.123.120	wbzPLLs2JM	Get hash	malicious	Mirai	Browse
76.55.57.108	yourbiggestnightmare.arm7.elf	Get hash	malicious	Mirai	Browse
97.191.206.109	RHJd2syHUX.elf	Get hash	malicious	Mirai	Browse
81.116.64.110	Q1BPEcSFNH.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	Kloki.arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	a-r.m-6.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	rebirth.sh4.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	rebirth.arm4.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	s-h.4-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	rebirth.arm6.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	rebirth.spc.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	m-i.p-s.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	rebirth.mpsl.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DTAGInternetserviceprovideroperationsDE	meth1.elf	Get hash	malicious	Mirai	Browse	87.158.141.129
	arm4.elf	Get hash	malicious	Unknown	Browse	217.95.63.155
	m68k.elf	Get hash	malicious	Unknown	Browse	79.192.139.191
	x86.elf	Get hash	malicious	Unknown	Browse	87.181.123.222
	meth4.elf	Get hash	malicious	Mirai	Browse	84.143.15.193
	arm5.elf	Get hash	malicious	Unknown	Browse	129.181.212.44
	i486.elf	Get hash	malicious	Unknown	Browse	84.162.239.118
	meth14.elf	Get hash	malicious	Mirai	Browse	93.196.38.24
	meth9.elf	Get hash	malicious	Mirai	Browse	87.139.190.207
	mpsl.elf	Get hash	malicious	Unknown	Browse	87.166.40.70
ZEN-ASZenInternet-UKGB	i686.elf	Get hash	malicious	Unknown	Browse	212.22.96.48
	res.x86.elf	Get hash	malicious	Unknown	Browse	51.155.198.169
	i686.elf	Get hash	malicious	Mirai	Browse	88.97.95.25
	momo.arm.elf	Get hash	malicious	Mirai	Browse	82.70.221.169
	z0r0.spc.elf	Get hash	malicious	Mirai	Browse	88.96.235.101
	armv6l.elf	Get hash	malicious	Mirai	Browse	51.151.68.27
	armv7l.elf	Get hash	malicious	Mirai	Browse	88.97.152.216
	2.elf	Get hash	malicious	Unknown	Browse	82.70.55.86
	Hilix.m68k.elf	Get hash	malicious	Mirai	Browse	88.98.151.151
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	88.96.109.90
CHINANET-BACKBONENo31Jin-rongStreetCN	meth10.elf	Get hash	malicious	Mirai	Browse	218.0.197.161
	meth3.elf	Get hash	malicious	Mirai	Browse	42.101.123.196
	meth8.elf	Get hash	malicious	Mirai	Browse	110.155.210.172
	meth1.elf	Get hash	malicious	Mirai	Browse	113.88.63.73
	arm4.elf	Get hash	malicious	Unknown	Browse	14.155.131.244
	ppc.elf	Get hash	malicious	Unknown	Browse	101.249.106.89
	m68k.elf	Get hash	malicious	Unknown	Browse	125.82.233.51
	i686.elf	Get hash	malicious	Unknown	Browse	61.150.155.184
	x86.elf	Get hash	malicious	Unknown	Browse	106.42.32.243
	meth4.elf	Get hash	malicious	Mirai	Browse	122.238.160.68

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/6488/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:T:T
MD5:	B2A9E464D4BA09AA6C1A59D44E7AFFBB
SHA1:	15D171632139B5A8EC8C830F1B03D06CC95A9A93
SHA-256:	78D22D016DBEC1300C385694EB257DED2F63DD92488A4B86CB0FDCA520D99447
SHA-512:	185EA2C46678957470F679DFBA4373DDDB67B88056C37A254CF8690B951AA700DB2F42FD329F2A723224E742E75FE9770251431A1059D1134E37BBBDEBEEA225
Malicious:	false
Reputation:	low
Preview:	6455.

/run/systemd/journal/streams/.#9:74518uKpIdg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.511913662807999
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7wjThd6x7oglsjs77:SbFuFyLVIg1BG+f+MkjVMx7og2ji4s
MD5:	54098A9686B5988597B0346A5FE8A52C
SHA1:	05E8ECA11574F6BD747EB09FB0630A9C5873447E
SHA-256:	B7FBA209A4847D94C8E4821DD38F1C50C8214BA56E3672F34715DCE8E74D1C12
SHA-512:	20C6478EF755A6440EDC6252F8B2CE2D3B6619BF6BB735F816D2F769A582A3B6F60DA79596BA49D2D76CEE379DF8539E81E48BF10D3FE8B26B7CF90439034D7C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=118408b77ea64f8d827f68acaeab9ff2.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:74519HcA1Ic

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.507110016590155
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7sZzRcedETwRTASZ+:SbFuFyLVIg1BG+f+M8z6CpRTVji4s
MD5:	85170BE8ADC1A520C189EEB58FA222D9
SHA1:	21EAE3E46A4674B58FD41ABF38E5F576C187F09B
SHA-256:	D9133CD49B0613D90AF87E4662110B3A9E751A70E989A03372B8F46680E2BFDD
SHA-512:	5273C8B6A3DAB52473FF8ED2E97AD2520B68C2C35767507ADA154CBEF63B98C33FA2B9F52897E70891123BBFCCFA51AFF35EE95FB8C6928E23D47A12148508E9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=13373f0f3d39451491bd8a6eecd484ed.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:74729SJgLPd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.449233210928117
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7WDVEkkfOswsjs1Ha:SbFuFyLVIg1BG+f+MaREksZjosQu
MD5:	85246D9BA924DF73F2A236F25078D16F
SHA1:	70BE1401CE2F6A8C706B81303D098CEE0860E43B
SHA-256:	69AD994CFC2983C6F7713C832C4CE130A5F3E369C2C0E422F4C6D82BDEB4C189
SHA-512:	EA8CD86F950FCDCB7D81C30170D524BDF39FF1757ABD201763CEC11E743C042B29ED52DA0535431DD964841FD8292E4A73790B2DB3291D490AB4B0D570F64170
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=156df729136a46a29f879091feb7800c.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:74742pXVeFe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.362972152751758
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M6N6aRGo2r5qjdCLKzK:qgFq6g10+f+MuvRGDgCLAK
MD5:	E08394DB83F9C5A83A778BD0D9C85E08
SHA1:	E568D6D371E44EF99561DB6A2AC8775236F8B0A3
SHA-256:	E570C20156ADC18636EA82123A0437AA3D32B8ABC9F46D83B674C54555389C47
SHA-512:	E6356624B70EDEEE46565C6F46A5D710F40367B494EAEA0D65EC1C8BB2D8B2A2EFBAF85E63551A0EBACBF4DE7D9C3F582236815CFE04396F18AF97CCF967ED02
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=04668c297d9c4d0c8d486cc99b3d0d91.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:74752ks7Urc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.3546802372544855
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5j4A3A8DVW4TjshQJ:SbFuFyLVIg1BG+f+MiAQSFTjtWL0
MD5:	7F5DFEE44667A70B0BC46AB76B27C812
SHA1:	B99F4476D5D421D52B59DA43FA838088A125D709
SHA-256:	8451A7EC4580CBCDF7F0982C6651E8A182C2D6E520A5AC4BB6BB886366D3966B
SHA-512:	70922CBC32E33D1B9BF4DC6FCF8F870BE9B7E24A5BB89649F8D75D42586AEBE713939A062968E57469FCA22DF2DE346655E0E9078A4DF7873D4FD6FB4E4D3393
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3ece850fb61b48acb5cde7f1451f0357.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:77074JCqo2e

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.406024015775915
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzYDwQ+WS6fQVXqAax:SbFuFyLVIg1BG+f+MawQ8RX7fjNE
MD5:	2A61E901F69CEF0F300B72A2BDF8959A
SHA1:	F4247D944083B9F3E4FA71C54F2D4E1EC70FBD9D
SHA-256:	A9CD2EEB28BCB27654EC76A9EB607D7BC2554A8F48327BCDCC26200728670918
SHA-512:	625E3A755C19CCADF529271421D45F4330D3EB55696A1782C3BE242BC87825D6D201B7CE1CA69D7D2ACA122DF21E68C290BDFC257F4FCFA64F3AC0F802D6EC00
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9070f189785e4b37840a88507120ee38.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:77075tc61Ag

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.461306345638917
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MYAUB3h5jZcHcljX+:qgFq6g10+f+MVmhmAu
MD5:	796C4D4F638F23B4FDB6592B83C1DEE7
SHA1:	4DF05D76D4C68DAA02E8B0179BCBD4EB2B3E0C33
SHA-256:	9B566CB7E106B0BB597D9BE1A3EB05F84311C797938B411444C04B3779F962BC
SHA-512:	A2F45AC9A51B3EC01A4682A82768BCCF97DF1EDB9F728AD5AE4C137B68B389609F2B296C01774CC3175927902BDB6FC5150D75A4669BE1A68172443CF9F211C2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=179da33cc5d24085af1313c651202ea5.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:77089zER0zf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.385275023681413
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4GoXPBrw4vXsjshKe:SbFuFyLVIg1BG+f+M4TKjbVC
MD5:	E52AD8772D63C4BCC73904FC0F0A4574
SHA1:	309DB68B7B7F5BF36AD9E1F3D86059E2D6CEF0E5
SHA-256:	6AD22263DE999BA46D57DA994889743B3254A269FB8D019C922042A073F970AB
SHA-512:	D62294B147EDE579EC9FEE8F9AA29CFF8868214814578CB177E46F8F19FB48BC2B9EE4B952F4FA749B261E133D44607E487C70FAB4DDD3DFB0FE424AD9448380
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2c2e8bf28ae84719894bd49edc2d1e0c.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:77226iWxkbg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.365842347664789
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrMnU5HTWqvZqjswkT:SbFuFyLVIg1BG+f+MAUZTjqjLkGq
MD5:	53DDA056896EAFD575DA2B5B60F27576
SHA1:	641B8EA85435F83753E3F30042AE498E2D6406F9
SHA-256:	5E9CDADDD169A03C9838A756FC6116A696B04014A55C152E61314304C5B24815
SHA-512:	670FA67CCEF2B9A6CD4DB3103E3BD1C04F0AFBB554BF7938A69D1F0113960F26FE3365336E75F43DEED0C80BD35481FD58D1BC16078AFA013AEE33595FD394CF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a9ea5e627e114d1fb51dd0305d7a663e.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:77412WuxKFg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.425774031339869
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M9PMHtiSxejdCt/rRMtq:qgFq6g10+f+M9siSyCDL
MD5:	2DAC5802D0B0BC1D125B73C1F9A2AFB9
SHA1:	DC3F79F55466C20CAD56207C1A52FCDEC0175B70
SHA-256:	9A5315422D2214735094F03CEFD7750BC06A79B9B8E5037C72E4D47C446763EE
SHA-512:	A2F9B1EF374395B668FE6C11E0BB95D5493EB44A3610D9F1DB1EE204FDF248B0D539049C504926F33CEB1B4EE009DDBCB5708B2481B81C39957F12B8430614DA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=94f6ba5e510946e6a574534ea71039a8.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:77413Y92Nfe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.46755200319909
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm9lyu1jSTUQUmsjs2ALl:SbFuFyLVIg1BAf+Mnyu1TjNALyAZD
MD5:	09E20261A9C57C293DA7008000C4A477
SHA1:	E11FAA182A59424BD92A59C6190FC8F082A6B425
SHA-256:	6877F06E6B6A637B47EEEA4026E255D9C402DF47C45C32EF9BF9A4A62C0D5CC5
SHA-512:	19CDC828B9F2D14FB26DCA1D2B4BDE4421D7CB54834FCB0967D93567437CF847BBB39EF7E55B16CE5247BB2DAFDEA8C52CEAEF65E36B0035731AA0A823EDED0E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7dd24fdac85d4527968fb757615816ab.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77425WBclwc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.442339577472101
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MM56hJWR/sZjNdQIeXD:qgFq6g1af+MwPkn2D
MD5:	6AD97A8ED7645E301D0AE985F207A10D
SHA1:	B45DE8E88616BECD4471134D3B4476FB95B61DB8
SHA-256:	D55471F116F146EDB7CB2F3C78F011220B40FDEFF52E3DCF8A7531FCAC9EBB44
SHA-512:	F66FE6680AAC9273A1EC4BF86B4EFCC8BD22E257CA71E73067FA0ADE16B37500135E5723620CC0DE08D48193CB2CEC83AFE64636A7CF0D6B8B8919536790CE9B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1a6b3ef7361e4cc2a1fbeff344909d7e.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77437yC3Sfg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.380168650167221
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm68dtRHEcdTkQjXTChg0:SbFuFyLVIg1BAf+M6893TR2jNTZD
MD5:	8E2145EC963E4233DD398B2C69F43DCB
SHA1:	0FF1643FC399FB61A8AA3F7425F436492CB96AEE
SHA-256:	DB2A56613A1BD5A25E221F607C189F3B0176B7A4F65609C848E2386F3FD4B463
SHA-512:	73A2AD7BBD431B3E481BE4667E07B01E2901AFC3DD55DD3DBBE282406CD5C4CBE693C9462E730CDE8571F7FAB4B4748113DF806ABD5FD64D32CBFA2740D9A0B2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0d0e82cabe4e4f40a986ed5d026f3645.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77562LAMfIf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.3875705029094
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9qGqGTBPvyNrxsjsB:SbFuFyLVIg1BG+f+MaGBErqjLTTIWTIL
MD5:	67F2890DCAFDA4E2D3FDBD438F2BDFD7
SHA1:	3B2A01254C793E371ECF4DECDDC5A4DDA0D6EBDA
SHA-256:	C0CD4C2FADD4EBECA09BD38F29680023CF432FBC15E3178928152D9DD1E7EC6F
SHA-512:	F3114491EEEE70C987787CE43A051A9770F67C875882824D90B439D063CF74861DC60EE68A90562DBEE9B2D81A28A0B17F38723CE8C87633EC06902DDE12B525
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7d58c8ee67c84e8dbc3ba4fae207efda.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:77585WmN3Xf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.380838853123794
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm4ywakwT8NgE02lb:SbFuFyLVK6g7/+BG+f+M4ywaxTfE0jNq
MD5:	2E7041947907D77C127824BCA4B91603
SHA1:	208391FACDA702A4A7579A3EC7458AF8E3A2CED3
SHA-256:	F97C4002D001E2CF60FBE0A594DADEB731DEFC112F5BE085244D61D0ABB05E43
SHA-512:	7DD05697533759690D6E5A9D813F0C20CB018BC837A08AE0A594B059EA895809BC1472FC2444291CEF332440D06E876511BE29355DCADBDCE9307B614CE90BDC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=27d7f9e7f4d74860b0e6037bde99623a.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:77586wKNA4e

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.383649527004015
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M+SMUbWMQeZjNq:qgFqdg7/+0+f+MQUbWuq
MD5:	B670B37F7B20482E147EC958F70AB1BE
SHA1:	9692F645C16EBFFC8B4DD6E4F97D9E7892754759
SHA-256:	8C0B5363936ECDEAB67B32E191E1E0E83E8F6503D62F473C34A30C6224896829
SHA-512:	4B8472D601A921E940B444BFA7247C5F1F9C76015F67855EF6785FEC88387DF4DEFE2F3B0C62F4BBA0A90C3A820374E8B75B992A889D076C401AAAFF92C58BB8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4eeb5388fbf1478781421412272eeda8.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:77602ww1xWd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.539506661308904
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MwUSWimEfqjFQMzKaBu:qgFqo6g7/+0+f+MwLWiRf4Tmh
MD5:	52918FCD1103A80C0A4DA0A9D377E9D8
SHA1:	9DC57247B9A599FDD3AD25DCBF15B09966616E82
SHA-256:	C4035A8679008F69B6B240E5595CA7D2400D6D0D8A63DB066E0E8FDCBDB8BC9D
SHA-512:	9A0C894739500535D7F8028EB7986E20DF63E9ADDCE5A1546363AFCFFAD4008C98576E53F82089BE311E2B3D194C9B0A5EDAE5CCB407E25182D4E8F23E79BB44
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9821357c2d2d4c4781b59ca9702128ce.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:77603JuUBtf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.48157905637376
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M8iVA7SJkdqjFQMzKaBu:qgFqdg7/+0+f+M8iBdTmh
MD5:	E17D94DF185AE8E3429AD31F19D752C4
SHA1:	D18C8E1919E0A32C893D9BB2506B125846CC89F7
SHA-256:	CCA66DA72844C65EB29D1A0BCA212EBC6359991F8E244B63F416E52E4C0C1C57
SHA-512:	8F45393FDE3F0326F591433C2655219CADF0C4CA9742EBFFF9BA05AD391FD539437E4475C64DE85AAA894C588830E08CC60CE7CC8D491A1052235FAF18480FE9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=60203037ee27487e85a40a0ff5e1118d.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:79337EFP6Fd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.337690485350785
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7xAE+/V02lsjs1Han:SbFuFyLVIg1BG+f+M6V0Zjoa
MD5:	33EF8E204C8FFC110182248993A52586
SHA1:	BE4933F0E5BDE19F140F12B85ADEEFA9C0BB8216
SHA-256:	5500545160EF6F651F5247CF0A965F4E6EC36F7FEC298437DE1A422665B134E9
SHA-512:	4E57B23FC4B768AE7C8867224A821918E539DDFFA4F5A942E70DA3EEAEC0BD48AA8B1922F80C36EED2CF3F95B9F4F101CDA14455E2CAF04B138FBC8F0E556973
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1b43baf2f7fc48f5a3fff403f09074e0.IDENTIFIER=dbus-daemon.

/run/systemd/seats/.#seat0AbBtkg

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0dylK9g

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/users/.#1274Ly3gg

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.319614961894202
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gDSWhM2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+gDDdthQHtPYq9M
MD5:	7D57075C6643F3D3AB6BCE2158DAAF9B
SHA1:	67C19876A0786AC5CB81E0F2EFFBAA7BEDCA3588
SHA-256:	0660A06E58CB0665B953741D4B6354BE2A061764AE31AC99DD373BD0225D44B9
SHA-512:	65E81B9ECC2544334595AACE65E7CD197030F29CCDD01340ED15B846A502D4200FDC68B0D986EFEC53C3C2DE1E4E5FDA873E3F935DF0F7CCB6E576AB1585AA25
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1736879925362664.MONOTONIC=470520997.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127I7pNPh

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.322644236281875
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgDSXJo/x4I0o206qodK3v:SbFuFyL3BVgdL87iesnAiRJgDSWh0otx
MD5:	8EF07D04ADD9D8C9654D27A96EA4A7E9
SHA1:	34DF667C289E2F2648464C8BBDC2681507E0B9B3
SHA-256:	9D5733FDCFCF5332A5F7AFAEF1933B4099A215CD876164E9DC0D29E4CF55CB7E
SHA-512:	F8989D8ED344809AA5E0C431E3C5D150EB078634205E58DA0E2B0CAAFAC486E68C9CD4378A0758FB010CB4D36CFBC0BA4133188C8A2AE44ED805B3AAFA09E960
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1736879925362664.MONOTONIC=470520997.LAST_SESSION_TIMESTAMP=470597257.

/run/systemd/users/.#127dXiAEf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.482364658729489
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6lgTgDSWh0ot6M:qgFq30dABibB3TgDDVIM
MD5:	090BC30AF8883CA42CC71B7FBB32824D
SHA1:	2EF61D1FE40152E83A41CEB57FAE61CC4FDAF7C2
SHA-256:	5440A936AFA31286D1F7B84DFD42F21656E7FF10C9545F14B99D21766A8E2534
SHA-512:	7D57C243A19ACBC1DB52874792013C19F2CC9D43C054E0979778C6B87EFCC0C4C2E53B9E6CFAE6DAC3A49D39B804EF57B24737BFD6DFF98BC61818D19BFE4E5D
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12412.REALTIME=1736879925362664.MONOTONIC=470520997.LAST_SESSION_TIMESTAMP=470597257.

/run/systemd/users/.#127eTsaCh

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127gel9xg

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.482364658729489
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6lgTgDSWh0ot6M:qgFq30dABibB3TgDDVIM
MD5:	090BC30AF8883CA42CC71B7FBB32824D
SHA1:	2EF61D1FE40152E83A41CEB57FAE61CC4FDAF7C2
SHA-256:	5440A936AFA31286D1F7B84DFD42F21656E7FF10C9545F14B99D21766A8E2534
SHA-512:	7D57C243A19ACBC1DB52874792013C19F2CC9D43C054E0979778C6B87EFCC0C4C2E53B9E6CFAE6DAC3A49D39B804EF57B24737BFD6DFF98BC61818D19BFE4E5D
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12412.REALTIME=1736879925362664.MONOTONIC=470520997.LAST_SESSION_TIMESTAMP=470597257.

/run/systemd/users/.#127iZx6Ig

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.319614961894202
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7gDSWhM2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+gDDdthQHtPYq9M
MD5:	7D57075C6643F3D3AB6BCE2158DAAF9B
SHA1:	67C19876A0786AC5CB81E0F2EFFBAA7BEDCA3588
SHA-256:	0660A06E58CB0665B953741D4B6354BE2A061764AE31AC99DD373BD0225D44B9
SHA-512:	65E81B9ECC2544334595AACE65E7CD197030F29CCDD01340ED15B846A502D4200FDC68B0D986EFEC53C3C2DE1E4E5FDA873E3F935DF0F7CCB6E576AB1585AA25
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1736879925362664.MONOTONIC=470520997.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:ao:ao
MD5:	1B27C696B13E0F1AFBEE8077ED7F32AB
SHA1:	25B913D6AF4D887655DD89A805F0A43C1CC3F4A7
SHA-256:	7E28659C877FC2611C434BF1E9BB0630468EC1C4A4765B39AED29C608A1F4A78
SHA-512:	85D97527A3B8BDA31CEA31317B4FFE44DE7BDA6F1050C39BAE603969AB18FB5F6C2F7FC4F8E016C6C75DC18C31B7981783F6ED6C71F467454D4EC85D69F782E8
Malicious:	false
Preview:	6343.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:gCsXlXEWtl/kh+YX:C+yl0
MD5:	E538D30CD8E3413471E91CEE50AA4C99
SHA1:	BB7C8A3DD396739BE26016369DCE6B4E8C0A29AB
SHA-256:	C0F7BF16E10F4E40DEA677C0F7892535CFED022F4059D2DDCCBCC2CD70DBF2D0
SHA-512:	C5881B0C6E4B5F98FDC2B272ECC869DCB8315A17960096E1874B57CCCC532A5E8F278F2DC739B695A64E2841B1178899C86A949DCC0BDFC32FB246CDC36085A2
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN......................................................................................................................................................................................................................................................................................................g}H......................................

/tmp/qemu-open.zCIKmD (deleted)

Download File

Process:	/tmp/Fantazy.arm4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	3.578868021290193
Encrypted:	false
SSDEEP:	6:OgDF6ElR0Jznj/VUX/vYDF6ElR0JzC7Y/V3Y/VjmsVot/VOArB/VH:OYNlR0JznyXQNlR0JzDl
MD5:	9F11127DAAE371FF24035CEB57B1D9BF
SHA1:	A9DA07F9CF22C981D500410ED078AAC8011CF5CD
SHA-256:	9359C739AF2FB8C563B5879E9780B427E1BEC6F4839E5C51B3A620008F380E26
SHA-512:	39A51CDA08D24C843FD0248FAD7E21C8E381EA0D31EFB1918C143F6CAED1489085EF3FF30516BA54BD00C08E4521714460074DC7EB3FD999218836B50C7AA142
Malicious:	false
Preview:	8000-1b000 r-xp 00000000 fd:00 531606 /tmp/Fantazy.arm4.elf.22000-23000 rw-p 00012000 fd:00 531606 /tmp/Fantazy.arm4.elf.23000-24000 rw-p 00000000 00:00 0 .24000-26000 rw-p 00000000 00:00 0 .ff7ef000-ff7f0000 ---p 00000000 00:00 0 .ff7f0000-ffff0000 rw-p 00000000 00:00 0 [stack].

/var/lib/AccountsService/users/gdm.ULC5Z2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1881
Entropy (8bit):	4.900340115284795
Encrypted:	false
SSDEEP:	48:5KvH89qlGkjn7DvlDfVzNo/Yr4+Er4+Li1rCn:5KvH4qlGkjn7DvlDfhNo/Ys+Es+Liu
MD5:	0C8DB6D697A0DCCE17F3525C97DF188E
SHA1:	A5F739AC8767B627FEF2D3FD667BCF1F1EC732BD
SHA-256:	9B06A92602462850F0B27DCAD3A3978C773E804CAF1F1E36F627BF31E4051D2D
SHA-512:	4BD19CCAA7FDBE65AFD55F12346115929D2F18C034279A0E3A40554E0FD8B334D778BBD048687715AF85DFB21CCF64FF7F407A41717F53FDC271607123AD2331
Malicious:	false
Preview:	Jan 14 12:38:23 galassia gdm-password]: pam_systemd(gdm-password:session): Failed to release session: No session '2' known.Jan 14 12:38:24 galassia gdm-launch-environment]: pam_systemd(gdm-launch-environment:session): Failed to release session: No session 'c2' known.Jan 14 12:38:24 galassia systemd-logind[6349]: Failed to add user by file name 127, ignoring: Invalid argument.Jan 14 12:38:24 galassia systemd-logind[6349]: Failed to add user by file name 1000, ignoring: Invalid argument.Jan 14 12:38:24 galassia systemd-logind[6349]: User enumeration failed: Invalid argument.Jan 14 12:38:24 galassia systemd-logind[6349]: User of session c2 not known..Jan 14 12:38:24 galassia systemd-logind[6349]: User of session 2 not known..Jan 14 12:38:24 galassia systemd-logind[6349]: User of session c1 not known..Jan 14 12:38:24 galassia systemd-logind[6349]: Session enumeration failed: No such file or directory.Jan 14 12:38:24 galassia systemd-logind[6349]: Watching system buttons on /dev/input/event

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4226312153993532
Encrypted:	false
SSDEEP:	3:F31Hly1K+oKalC1K+oKKl/:F3sK8alMK8Kl
MD5:	C19A9BA198D0EAF6CA00610C44F697A1
SHA1:	A853FDAB42B708F7EAFED84ECCAA1A73A5C87F68
SHA-256:	30EE6C40EE729A523802B8FB3F3713037BF1BC64560495CC80E7F57259C1C6A1
SHA-512:	6ED3A00594ED673CDD23E331FF638593E1F00E1F43575E9F3F7AB1F9EA817CFA1717A523613438A413A8AD67F067A7E8553F8BEF4FDB17A6B3CC3F3EFB5736CA
Malicious:	false
Preview:	LPKSHHRH................b.?..JH...e..................................b.?..JH...e..........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4428593527838256
Encrypted:	false
SSDEEP:	3:F31Hl8fDh54T/afDh54B:F3s7j4T/a7j4B
MD5:	0444132B5689D6D07C5FD3E86C9C3914
SHA1:	209EA93D4E915743874C8A9099A322FC4B986695
SHA-256:	C3DE95D476469EB87A8A29B65CB0F3065EFDB9AEDBBFC411E6B52ACD3C0A63CB
SHA-512:	4383C5100A66535DCC930C825CED3FEF58F253E754763DC8DC2CAE61C004A92EB2CAC7FDFBBD479F80355C178C432EB6ED2C2A8CA653AD54A8E333754C37636E
Malicious:	false
Preview:	LPKSHHRH................'.VT.E..c(.1E..................................'.VT.E..c(.1E..........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	10856
Entropy (8bit):	4.99377580454514
Encrypted:	false
SSDEEP:	96:5QoIY7vxFCw0PmIeL02OXmS+nyxDIEa17AnbJ/b45g5j5q5c5II5o1I5Ft53rp5X:TUE48Gr8lldW
MD5:	66404414E43771E9AF5F50A4B9BE8BE3
SHA1:	CB0A3AA95AA8749D020EDA70EA5D52121326E890
SHA-256:	093CEFFA4361001AA3F80C8C749837083F5776EF2F030E0FBC1339A216BF92C8
SHA-512:	4F84428D7BA2378E47B72DDE82D7969AC147D49E14A72EE544A6188C5AA280AAE346623067C2E82829955977D5F7ABBFAF497151CE062010411C054DA56EF8BB
Malicious:	false
Preview:	Jan 14 12:38:24 galassia kernel: [ 448.544305] Reached call limit: pid 6269, name read.Jan 14 12:38:24 galassia kernel: [ 449.107642] New task spawned: old: (tgid 6417, tid 6417), new (tgid: 6417, tid: 6421).Jan 14 12:38:24 galassia kernel: [ 449.108416] New task spawned: old: (tgid 6417, tid 6417), new (tgid: 6417, tid: 6422).Jan 14 12:38:25 galassia kernel: [ 449.111371] New task spawned: old: (tgid 6417, tid 6421), new (tgid: 6417, tid: 6423).Jan 14 12:38:25 galassia kernel: [ 450.356930] New task spawned: old: (tgid 6426, tid 6426), new (tgid: 6427, tid: 6427).Jan 14 12:38:25 galassia kernel: [ 450.395159] New task spawned: old: (tgid 6427, tid 6427), new (tgid: 6428, tid: 6428).Jan 14 12:38:25 galassia kernel: [ 450.570295] New task spawned: old: (tgid 6426, tid 6426), new (tgid: 6429, tid: 6429).Jan 14 12:38:25 galassia kernel: [ 450.613087] New task spawned: old: (tgid 6429, tid 6429), new (tgid: 6430, tid: 6430).Jan 14 12:38:25 galassia kernel: [ 450.779641] New task s

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	35011
Entropy (8bit):	5.074105145071456
Encrypted:	false
SSDEEP:	768:kTCNsoxmQ2chV7nsY24SuCIFjvFNXTdigaew0EAKVJtHvsQKTh9H5/jd0SuwQCGN:kTCNsox1qR
MD5:	F457CBF30D5A8D9FB60CB18592BBE5D3
SHA1:	F5F8EBFD96BFC5973D75EFFED3400C38475831EB
SHA-256:	29E28EC795A435A31A447C403A45BC8C5485EA3E591530FBA2E6475BA7265851
SHA-512:	47EDFDB1D67D86DAF3C625907544AC9B1DBAA4C005EA020FD41A814664F32E2C1788BFE86C839627E329042405B14D287518B1B604C4C2E32D038C5D44DE58FF
Malicious:	false
Preview:	Jan 14 12:38:23 galassia dbus-daemon[6329]: [system] Successfully activated service 'org.freedesktop.PolicyKit1'.Jan 14 12:38:24 galassia kernel: [ 448.544305] Reached call limit: pid 6269, name read.Jan 14 12:38:24 galassia kernel: [ 449.107642] New task spawned: old: (tgid 6417, tid 6417), new (tgid: 6417, tid: 6421).Jan 14 12:38:24 galassia kernel: [ 449.108416] New task spawned: old: (tgid 6417, tid 6417), new (tgid: 6417, tid: 6422).Jan 14 12:38:23 galassia [2078]: wrapper-2.0: Fatal IO error 11 (Resource temporarily unavailable) on X server :1..Jan 14 12:38:23 galassia [2079]: wrapper-2.0: Fatal IO error 11 (Resource temporarily unavailable) on X server :1..Jan 14 12:38:23 galassia [2083]: wrapper-2.0: Fatal IO error 11 (Resource temporarily unavailable) on X server :1..Jan 14 12:38:23 galassia dbus-daemon[6329]: [system] Successfully activated service 'org.freedesktop.login1'.Jan 14 12:38:23 galassia [2084]: wrapper-2.0: Fatal IO error 11 (Resource temporarily unavailable) on

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:gCsXlXEWtl/kh+YX:C+yl0
MD5:	E538D30CD8E3413471E91CEE50AA4C99
SHA1:	BB7C8A3DD396739BE26016369DCE6B4E8C0A29AB
SHA-256:	C0F7BF16E10F4E40DEA677C0F7892535CFED022F4059D2DDCCBCC2CD70DBF2D0
SHA-512:	C5881B0C6E4B5F98FDC2B272ECC869DCB8315A17960096E1874B57CCCC532A5E8F278F2DC739B695A64E2841B1178899C86A949DCC0BDFC32FB246CDC36085A2
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN......................................................................................................................................................................................................................................................................................................g}H......................................

Source: Fantazy.arm4.elf	Virustotal: Detection: 56%			Perma Link
Source: Fantazy.arm4.elf	ReversingLabs: Detection: 68%

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	6.11779799840167
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Fantazy.arm4.elf
File size:	76'452 bytes
MD5:	b8299420792a8b06a236971ccc84101c
SHA1:	db759f9e55661392f025f1854458fee4a16d96df
SHA256:	bff38e582d1f063e21b73387b079a75d0f8babb63e792b39450382fa449e6cd2
SHA512:	751431cb364553d9edc80c3643e969d16ee040ee0fd2c41e58993628129e5ad531c159944811d2a8326f622c89635b39964b7d109d7f28b0b5391f82a1c5373d
SSDEEP:	1536:iKt99e9By3CuMDyHMA3OKSXDtuTktGXfU2/h0BcBr2y:iK09By3CscXmktOM2qcBr2y
TLSH:	34730786BC40AA16D7C04777FE6F108E3314A7D9E1EA32429C255FA07B8EC2B0D67755
File Content Preview:	.ELF...a..........(.........4....)......4. ...(......................&...&...............&...&...&..,...............Q.td..................................-...L."....D..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	76052
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x11350	0x0	0x6	AX	16
.fini	PROGBITS	0x19400	0x11400	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x19414	0x11414	0x1290	0x0	0x2	A	4
.ctors	PROGBITS	0x226a8	0x126a8	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x226b0	0x126b0	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x226bc	0x126bc	0x218	0x0	0x3	WA	4
.bss	NOBITS	0x228d4	0x128d4	0x558	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x128d4	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x126a4	0x126a4	6.1380	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x126a8	0x226a8	0x226a8	0x22c	0x784	2.9630	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 19:38:22.915693045 CET	192.168.2.23	1.1.1.1	0x9603	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 14, 2025 19:38:22.915796041 CET	192.168.2.23	1.1.1.1	0x4cb5	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Jan 14, 2025 19:38:24.014724970 CET	192.168.2.23	1.1.1.1	0x455e	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 19:38:22.923393011 CET	1.1.1.1	192.168.2.23	0x9603	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Jan 14, 2025 19:38:22.923393011 CET	1.1.1.1	192.168.2.23	0x9603	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2025-01-14 18:38:28 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2025-01-14 18:38:28 UTC	25	IN	HTTP/1.1 100 Continue
2025-01-14 18:38:28 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2025-01-14 18:38:28 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2025-01-14 18:38:28 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2025-01-14 18:38:28 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2025-01-14 18:38:28 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2025-01-14 18:38:28 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2025-01-14 18:38:28 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2025-01-14 18:38:28 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2025-01-14 18:38:28 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2025-01-14 18:38:28 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2025-01-14 18:38:29 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Tue, 14 Jan 2025 18:38:29 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	18:37:52
Start date (UTC):	14/01/2025
Path:	/tmp/Fantazy.arm4.elf
Arguments:	/tmp/Fantazy.arm4.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	18:37:59
Start date (UTC):	14/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:38:00
Start date (UTC):	14/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:38:02
Start date (UTC):	14/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:38:19
Start date (UTC):	14/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:38:21
Start date (UTC):	14/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:38:22
Start date (UTC):	14/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:38:23
Start date (UTC):	14/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:38:24
Start date (UTC):	14/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	18:38:25
Start date (UTC):	14/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:38:26
Start date (UTC):	14/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	18:38:27
Start date (UTC):	14/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Fantazy.arm4.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6488/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:74518uKpIdg

/run/systemd/journal/streams/.#9:74519HcA1Ic

/run/systemd/journal/streams/.#9:74729SJgLPd

/run/systemd/journal/streams/.#9:74742pXVeFe

/run/systemd/journal/streams/.#9:74752ks7Urc

/run/systemd/journal/streams/.#9:77074JCqo2e

/run/systemd/journal/streams/.#9:77075tc61Ag

/run/systemd/journal/streams/.#9:77089zER0zf

/run/systemd/journal/streams/.#9:77226iWxkbg

/run/systemd/journal/streams/.#9:77412WuxKFg

/run/systemd/journal/streams/.#9:77413Y92Nfe

/run/systemd/journal/streams/.#9:77425WBclwc

/run/systemd/journal/streams/.#9:77437yC3Sfg

/run/systemd/journal/streams/.#9:77562LAMfIf

/run/systemd/journal/streams/.#9:77585WmN3Xf

/run/systemd/journal/streams/.#9:77586wKNA4e

/run/systemd/journal/streams/.#9:77602ww1xWd

/run/systemd/journal/streams/.#9:77603JuUBtf

/run/systemd/journal/streams/.#9:79337EFP6Fd

/run/systemd/seats/.#seat0AbBtkg

/run/systemd/seats/.#seat0dylK9g

/run/systemd/users/.#1274Ly3gg

/run/systemd/users/.#127I7pNPh

/run/systemd/users/.#127dXiAEf

/run/systemd/users/.#127eTsaCh

/run/systemd/users/.#127gel9xg

/run/systemd/users/.#127iZx6Ig

/run/user/1000/pulse/pid

Linux Analysis Report
Fantazy.arm4.elf

Start time (UTC):	18:38:29
Start date (UTC):	14/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:38:31
Start date (UTC):	14/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:38:41
Start date (UTC):	14/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:38:42
Start date (UTC):	14/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	18:38:43
Start date (UTC):	14/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	18:38:45
Start date (UTC):	14/01/2025
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	18:38:46
Start date (UTC):	14/01/2025
Path:	/usr/bin/dbus-run-session
Arguments:	dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4

Start time (UTC):	18:38:47
Start date (UTC):	14/01/2025
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	18:39:02
Start date (UTC):	14/01/2025
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Start time (UTC):	18:40:32
Start date (UTC):	14/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75