Create Interactive Tour

Linux Analysis Report
Fantazy.arm4.elf

Overview

General Information

Sample name:	Fantazy.arm4.elf
Analysis ID:	1597396
MD5:	3f1b22621624a788f5226ff34b4e1601
SHA1:	d2933fe7305b3573e19472c8732c0a6da83dcad9
SHA256:	c49d046462acb70c1f1c4d31a0e7f68da11d17b1cf247f27d3f62958378562c2
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1597396
Start date and time:	2025-01-23 08:46:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Fantazy.arm4.elf
Detection:	MAL
Classification:	mal68.spre.troj.linELF@0/44@3/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing network information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/Fantazy.arm4.elf
PID:	6220
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	VegaSec-KATANA001
Standard Error:

Process Tree

system is lnxubuntu20

Fantazy.arm4.elf (PID: 6220, Parent: 6136, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/Fantazy.arm4.elf

Fantazy.arm4.elf New Fork (PID: 6222, Parent: 6220)

Fantazy.arm4.elf New Fork (PID: 6223, Parent: 6220)

Fantazy.arm4.elf New Fork (PID: 6226, Parent: 6223)

Fantazy.arm4.elf New Fork (PID: 6229, Parent: 6223)

Fantazy.arm4.elf New Fork (PID: 6231, Parent: 6223)

systemd New Fork (PID: 6239, Parent: 1)

journalctl (PID: 6239, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6256, Parent: 1)

systemd-journald (PID: 6256, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6259, Parent: 1)

journalctl (PID: 6259, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6321, Parent: 1)

dbus-daemon (PID: 6321, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gdm3 New Fork (PID: 6325, Parent: 1320)

Default (PID: 6325, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6327, Parent: 1320)

Default (PID: 6327, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6328, Parent: 1320)

Default (PID: 6328, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6329, Parent: 1860)

pulseaudio (PID: 6329, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6334, Parent: 1)

systemd-logind (PID: 6334, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6393, Parent: 1)

rtkit-daemon (PID: 6393, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6397, Parent: 1)

polkitd (PID: 6397, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6398, Parent: 1)

gpu-manager (PID: 6398, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6401, Parent: 6398)

sh (PID: 6401, Parent: 6398, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6403, Parent: 6401)

grep (PID: 6403, Parent: 6401, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6409, Parent: 6398)

sh (PID: 6409, Parent: 6398, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6410, Parent: 6409)

grep (PID: 6410, Parent: 6409, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6411, Parent: 6398)

sh (PID: 6411, Parent: 6398, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6415, Parent: 6411)

grep (PID: 6415, Parent: 6411, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6416, Parent: 6398)

sh (PID: 6416, Parent: 6398, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6417, Parent: 6416)

grep (PID: 6417, Parent: 6416, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6418, Parent: 6398)

sh (PID: 6418, Parent: 6398, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6419, Parent: 6418)

grep (PID: 6419, Parent: 6418, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6420, Parent: 6398)

sh (PID: 6420, Parent: 6398, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6421, Parent: 6420)

grep (PID: 6421, Parent: 6420, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6422, Parent: 6398)

sh (PID: 6422, Parent: 6398, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6423, Parent: 6422)

grep (PID: 6423, Parent: 6422, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6424, Parent: 6398)

sh (PID: 6424, Parent: 6398, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6425, Parent: 6424)

grep (PID: 6425, Parent: 6424, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6407, Parent: 1)

agetty (PID: 6407, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6408, Parent: 1)

rsyslogd (PID: 6408, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6430, Parent: 1)

generate-config (PID: 6430, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6432, Parent: 6430)

pkill (PID: 6432, Parent: 6430, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6435, Parent: 1)

gdm-wait-for-drm (PID: 6435, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6440, Parent: 1)

gdm3 (PID: 6440, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6444, Parent: 6440)

plymouth (PID: 6444, Parent: 6440, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6461, Parent: 6440)

gdm-session-worker (PID: 6461, Parent: 6440, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6467, Parent: 6461)

gdm-wayland-session (PID: 6467, Parent: 6461, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6469, Parent: 6467)

dbus-daemon (PID: 6469, Parent: 6467, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6471, Parent: 6469)

dbus-daemon New Fork (PID: 6472, Parent: 6471)

false (PID: 6472, Parent: 6471, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6473, Parent: 6467)

dbus-run-session (PID: 6473, Parent: 6467, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6474, Parent: 6473)

dbus-daemon (PID: 6474, Parent: 6473, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6475, Parent: 6440)

Default (PID: 6475, Parent: 6440, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6476, Parent: 6440)

Default (PID: 6476, Parent: 6440, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6446, Parent: 1)

accounts-daemon (PID: 6446, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6456, Parent: 6446)

language-validate (PID: 6456, Parent: 6446, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6457, Parent: 6456)

language-options (PID: 6457, Parent: 6456, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6458, Parent: 6457)

sh (PID: 6458, Parent: 6457, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6459, Parent: 6458)

locale (PID: 6459, Parent: 6458, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6460, Parent: 6458)

grep (PID: 6460, Parent: 6458, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

gvfsd-fuse New Fork (PID: 6483, Parent: 2038)

fusermount (PID: 6483, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6524, Parent: 1860)

dbus-daemon (PID: 6524, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6408)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /tmp/Fantazy.arm4.elf (PID: 6220)	Socket: 127.0.0.1:59025	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6440)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6469)	Socket: unknown address family	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 101.111.247.54
Source: unknown	TCP traffic detected without corresponding DNS query: 155.97.31.54
Source: unknown	TCP traffic detected without corresponding DNS query: 109.119.41.48
Source: unknown	TCP traffic detected without corresponding DNS query: 170.250.26.179
Source: unknown	TCP traffic detected without corresponding DNS query: 23.213.80.139
Source: unknown	TCP traffic detected without corresponding DNS query: 92.111.133.141
Source: unknown	TCP traffic detected without corresponding DNS query: 40.65.31.54
Source: unknown	TCP traffic detected without corresponding DNS query: 76.206.18.91
Source: unknown	TCP traffic detected without corresponding DNS query: 35.40.244.143
Source: unknown	TCP traffic detected without corresponding DNS query: 73.199.137.153
Source: unknown	TCP traffic detected without corresponding DNS query: 47.88.31.191
Source: unknown	TCP traffic detected without corresponding DNS query: 164.86.181.171
Source: unknown	TCP traffic detected without corresponding DNS query: 197.253.68.6
Source: unknown	TCP traffic detected without corresponding DNS query: 65.231.236.157
Source: unknown	TCP traffic detected without corresponding DNS query: 63.186.224.73
Source: unknown	TCP traffic detected without corresponding DNS query: 75.238.76.231
Source: unknown	TCP traffic detected without corresponding DNS query: 102.44.146.164
Source: unknown	TCP traffic detected without corresponding DNS query: 37.32.20.87
Source: unknown	TCP traffic detected without corresponding DNS query: 202.240.64.16
Source: unknown	TCP traffic detected without corresponding DNS query: 72.241.120.205
Source: unknown	TCP traffic detected without corresponding DNS query: 94.136.239.94
Source: unknown	TCP traffic detected without corresponding DNS query: 219.80.38.164
Source: unknown	TCP traffic detected without corresponding DNS query: 45.12.99.236
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 206.190.166.121
Source: unknown	TCP traffic detected without corresponding DNS query: 80.121.143.62
Source: unknown	TCP traffic detected without corresponding DNS query: 189.131.152.129
Source: unknown	TCP traffic detected without corresponding DNS query: 23.93.58.14
Source: unknown	TCP traffic detected without corresponding DNS query: 223.185.62.41
Source: unknown	TCP traffic detected without corresponding DNS query: 161.120.212.240
Source: unknown	TCP traffic detected without corresponding DNS query: 149.26.76.178
Source: unknown	TCP traffic detected without corresponding DNS query: 72.226.124.31
Source: unknown	TCP traffic detected without corresponding DNS query: 197.194.75.230
Source: unknown	TCP traffic detected without corresponding DNS query: 81.13.11.166
Source: unknown	TCP traffic detected without corresponding DNS query: 152.254.167.101
Source: unknown	TCP traffic detected without corresponding DNS query: 159.14.37.42
Source: unknown	TCP traffic detected without corresponding DNS query: 38.72.6.43
Source: unknown	TCP traffic detected without corresponding DNS query: 113.237.127.191
Source: unknown	TCP traffic detected without corresponding DNS query: 195.128.122.174
Source: unknown	TCP traffic detected without corresponding DNS query: 181.108.144.70
Source: unknown	TCP traffic detected without corresponding DNS query: 32.102.203.217
Source: unknown	TCP traffic detected without corresponding DNS query: 60.169.242.58
Source: unknown	TCP traffic detected without corresponding DNS query: 8.215.56.119
Source: unknown	TCP traffic detected without corresponding DNS query: 133.232.56.51
Source: unknown	TCP traffic detected without corresponding DNS query: 122.107.17.117
Source: unknown	TCP traffic detected without corresponding DNS query: 120.14.2.125
Source: unknown	TCP traffic detected without corresponding DNS query: 76.136.114.68

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.49.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53684
Source: unknown	Network traffic detected: HTTP traffic on port 53684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 6047, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 6202, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 6205, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 6223, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 6229, result: unknown	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 6047, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 6202, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 6205, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 6223, result: successful	Jump to behavior
Source: /tmp/Fantazy.arm4.elf (PID: 6229)	SIGKILL sent: pid: 6229, result: unknown	Jump to behavior

Source: classification engine

Classification label: mal68.spre.troj.linELF@0/44@3/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6321)	File: /proc/6321/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6469)	File: /proc/6469/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6474)	File: /proc/6474/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6483)	File: /proc/6483/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6524)	File: /proc/6524/mounts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:75927nOONpg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:759299HGate	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:76846LAwc4f	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:76870E7XFMg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:768805929ld	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:76884Fix5of	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:76890GYgDMg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:76451HNVvvh	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:764520KgJLh	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:76468GTdqQf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:76516MeArLd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:76613I7c1Fh	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:76614t9mJDh	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:76618iJGOWe	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:779925vmQYg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:78124MSnTgd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:781726dciLd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:78174xXN4Pe	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:78218xgTLId	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:78220nqiy4e	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File: /run/systemd/journal/streams/.#9:78793bcrtod	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6334)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6334)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6334)	File: /run/systemd/seats/.#seat0eRTvh7	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6334)	File: /run/systemd/users/.#12786b3Da	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6334)	File: /run/systemd/users/.#127BvmLs9	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6334)	File: /run/systemd/seats/.#seat0dP50J7	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6334)	File: /run/systemd/users/.#127WYrgb7	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6334)	File: /run/systemd/users/.#127Iexci9	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6334)	File: /run/systemd/users/.#127EDv2U9	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6397)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6467)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6446)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6446)	Directory: /root/.cache	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6397/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6397/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6397/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6397/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6397/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6397/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6397/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6431/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6431/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6431/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6431/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6431/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6431/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6431/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2078/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2078/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2078/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2078/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2078/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2078/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2078/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2077/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2077/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2077/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2077/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2077/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2077/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2077/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2033/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2033/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2033/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2033/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2033/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2033/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2033/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2074/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2074/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2074/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2074/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2074/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2074/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2074/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6393/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6393/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6393/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6393/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6393/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6393/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/6393/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1532/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1532/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1532/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1532/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1532/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1532/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1532/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1334/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1334/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/1334/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2302/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2302/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2302/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2302/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2302/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/2302/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/797/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/797/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/797/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/797/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/797/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/797/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	File opened: /proc/797/cgroup	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6401)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6409)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6411)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6416)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6418)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6420)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6422)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6424)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6458)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Source: /bin/sh (PID: 6403)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6410)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6415)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6417)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6419)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6421)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6423)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6425)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6460)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6432)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6256)

Reads from proc file: /proc/meminfo

Jump to behavior

Source: /sbin/agetty (PID: 6407)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6440)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6440)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6446)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6446)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6398)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6408)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6408)	Log file created: /var/log/auth.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 6398)

Truncated file: /var/log/gpu-manager.log

Jump to behavior

Source: /usr/bin/pulseaudio (PID: 6329)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pkill (PID: 6432)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /tmp/Fantazy.arm4.elf (PID: 6220)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6256)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6329)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6398)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6407)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6408)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6461)	Queries kernel information via 'uname':	Jump to behavior

Source: Fantazy.arm4.elf, 6229.1.00007ffec926e000.00007ffec928f000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.g6x89e
Source: Fantazy.arm4.elf, 6220.1.00007ffec926e000.00007ffec928f000.rw-.sdmp, Fantazy.arm4.elf, 6222.1.00007ffec926e000.00007ffec928f000.rw-.sdmp, Fantazy.arm4.elf, 6223.1.00007ffec926e000.00007ffec928f000.rw-.sdmp, Fantazy.arm4.elf, 6226.1.00007ffec926e000.00007ffec928f000.rw-.sdmp, Fantazy.arm4.elf, 6229.1.00007ffec926e000.00007ffec928f000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/Fantazy.arm4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Fantazy.arm4.elf
Source: Fantazy.arm4.elf, 6220.1.0000561f5ab3e000.0000561f5ac6c000.rw-.sdmp, Fantazy.arm4.elf, 6222.1.0000561f5ab3e000.0000561f5ac6c000.rw-.sdmp, Fantazy.arm4.elf, 6223.1.0000561f5ab3e000.0000561f5ac6c000.rw-.sdmp, Fantazy.arm4.elf, 6226.1.0000561f5ab3e000.0000561f5ac6c000.rw-.sdmp, Fantazy.arm4.elf, 6229.1.0000561f5ab3e000.0000561f5ac6c000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: Fantazy.arm4.elf, 6220.1.0000561f5ab3e000.0000561f5ac6c000.rw-.sdmp, Fantazy.arm4.elf, 6222.1.0000561f5ab3e000.0000561f5ac6c000.rw-.sdmp, Fantazy.arm4.elf, 6223.1.0000561f5ab3e000.0000561f5ac6c000.rw-.sdmp, Fantazy.arm4.elf, 6226.1.0000561f5ab3e000.0000561f5ac6c000.rw-.sdmp, Fantazy.arm4.elf, 6229.1.0000561f5ab3e000.0000561f5ac6c000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/arm
Source: Fantazy.arm4.elf, 6220.1.00007ffec926e000.00007ffec928f000.rw-.sdmp, Fantazy.arm4.elf, 6222.1.00007ffec926e000.00007ffec928f000.rw-.sdmp, Fantazy.arm4.elf, 6223.1.00007ffec926e000.00007ffec928f000.rw-.sdmp, Fantazy.arm4.elf, 6226.1.00007ffec926e000.00007ffec928f000.rw-.sdmp, Fantazy.arm4.elf, 6229.1.00007ffec926e000.00007ffec928f000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: Fantazy.arm4.elf, 6229.1.00007ffec926e000.00007ffec928f000.rw-.sdmp	Binary or memory string: V/tmp/qemu-open.g6x89e

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6446)

Logged in records file read: /var/log/wtmp

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Fantazy.arm4.elf	68%	ReversingLabs	Linux.Trojan.Mirai
Fantazy.arm4.elf	100%	Avira	EXP/ELF.Gafgyt.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.49.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
136.76.26.165	unknown	United States	60311	ONEFMCH	false
96.6.172.197	unknown	United States	35994	AKAMAI-ASUS	false
187.150.212.8	unknown	Mexico	8151	UninetSAdeCVMX	false
44.108.74.184	unknown	United States	7377	UCSDUS	false
206.9.29.94	unknown	United States	5006	VOYANTUS	false
42.219.253.29	unknown	China	4249	LILLY-ASUS	false
166.70.225.18	unknown	United States	6315	XMISSIONUS	false
159.105.109.248	unknown	United States	11577	GOVNET-ASNUS	false
218.55.150.109	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
217.171.118.252	unknown	Germany	31723	WB-NET-ASDessauerStrasse280DE	false
122.214.58.99	unknown	Japan	17506	UCOMARTERIANetworksCorporationJP	false
62.64.33.46	unknown	France	8362	20rueDenisPapinFR	false
89.234.217.40	unknown	Poland	206412	INFO-NET-ASPL	false
107.0.159.169	unknown	United States	7015	COMCAST-7015US	false
4.190.163.102	unknown	United States	3356	LEVEL3US	false
5.130.59.62	unknown	Russian Federation	31200	NTKIPv6customersRU	false
206.139.219.216	unknown	United States	701	UUNETUS	false
14.56.224.137	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
181.20.187.98	unknown	Argentina	22927	TelefonicadeArgentinaAR	false
23.25.234.112	unknown	United States	7922	COMCAST-7922US	false
90.252.84.233	unknown	United Kingdom	5378	VodafoneGB	false
163.125.130.198	unknown	China	17623	CNCGROUP-SZChinaUnicomShenzennetworkCN	false
166.23.160.127	unknown	United States	7834	L3HARRIS-TECHNOLOGIESUS	false
172.115.150.135	unknown	United States	20001	TWC-20001-PACWESTUS	false
212.62.123.217	unknown	Saudi Arabia	43766	MTC-KSA-ASSA	false
34.10.9.170	unknown	United States	2686	ATGS-MMD-ASUS	false
191.117.168.180	unknown	Chile	27995	CLAROCHILESACL	false
182.35.113.150	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
18.68.128.101	unknown	United States	3	MIT-GATEWAYSUS	false
14.33.95.152	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
219.231.29.245	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
100.13.50.231	unknown	United States	701	UUNETUS	false
124.119.248.171	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
126.157.2.216	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
122.171.161.94	unknown	India	24560	AIRTELBROADBAND-AS-APBhartiAirtelLtdTelemediaServices	false
39.237.35.183	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
191.186.71.122	unknown	Brazil	28573	CLAROSABR	false
172.181.16.121	unknown	United States	7018	ATT-INTERNET4US	false
219.158.152.245	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
77.141.181.202	unknown	France	15557	LDCOMNETFR	false
198.140.43.37	unknown	United States	393226	INTERCONTINENTAL-EXCHANGE-MULTI-ISP-SITESUS	false
154.246.76.108	unknown	Algeria	36947	ALGTEL-ASDZ	false
36.54.103.53	unknown	Japan	10013	FBDCFreeBitCoLtdJP	false
98.166.220.16	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
190.160.46.175	unknown	Chile	22047	VTRBANDAANCHASACL	false
174.82.196.110	unknown	United States	20115	CHARTER-20115US	false
193.169.72.40	unknown	Germany	42652	DELUNETDE	false
158.198.246.63	unknown	Japan	17511	OPTAGEOPTAGEIncJP	false
139.182.251.120	unknown	United States	2152	CSUNET-NWUS	false
57.52.186.132	unknown	Belgium	2686	ATGS-MMD-ASUS	false
117.179.90.229	unknown	China	132525	CMNET-HEILONGJIANG-CNHeiLongJiangMobileCommunicationComp	false
9.100.97.128	unknown	United States	3356	LEVEL3US	false
153.16.182.163	unknown	United States	3943	DMMUS	false
18.188.126.118	unknown	United States	16509	AMAZON-02US	false
83.105.33.142	unknown	United Kingdom	2529	DEMON-INTERNETNowmaintainedbyCableWirelessWorldwide	false
119.47.58.27	unknown	Japan	7679	QTNETQTnetIncJP	false
156.173.216.166	unknown	Egypt	36992	ETISALAT-MISREG	false
19.30.236.127	unknown	United States	3	MIT-GATEWAYSUS	false
166.222.34.190	unknown	United States	6614	USCC-ASNUS	false
217.206.218.223	unknown	United Kingdom	4589	EASYNETEasynetGlobalServicesEU	false
148.57.62.53	unknown	United States	10753	LVLT-10753US	false
206.191.229.43	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.196.205.9	unknown	United States	7018	ATT-INTERNET4US	false
175.90.33.120	unknown	China	9394	CTTNETChinaTieTongTelecommunicationsCorporationCN	false
24.175.56.234	unknown	United States	11427	TWC-11427-TEXASUS	false
117.226.179.171	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
158.55.74.173	unknown	United States	11757	WHIRLPOOL-ASNUS	false
117.89.208.31	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
13.186.116.241	unknown	United States	7018	ATT-INTERNET4US	false
146.220.202.113	unknown	Luxembourg	204590	SWISS-ASCH	false
103.204.207.171	unknown	India	134983	BDPEER-AS-APBDPEERBD	false
197.4.212.64	unknown	Tunisia	5438	ATI-TN	false
102.87.132.241	unknown	Uganda	37075	ZAINUGASUG	false
117.43.234.172	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
100.186.28.222	unknown	United States	21928	T-MOBILE-AS21928US	false
188.0.61.51	unknown	Estonia	57201	EDF-ASEE	false
95.163.129.201	unknown	Russian Federation	12695	DINET-ASRU	false
193.184.243.29	unknown	Finland	719	ELISA-ASHelsinkiFinlandEU	false
23.64.221.253	unknown	United States	16625	AKAMAI-ASUS	false
216.66.184.169	unknown	Canada	26546	NUCLEUS-INCCA	false
157.97.64.178	unknown	Germany	25259	MDCLOUD-ES	false
63.104.56.181	unknown	United States	701	UUNETUS	false
1.189.116.185	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
8.123.33.108	unknown	United States	3356	LEVEL3US	false
122.151.64.211	unknown	Australia	38285	VOCUS-RETAIL-AUVocusRetailAU	false
85.110.90.196	unknown	Turkey	9121	TTNETTR	false
160.88.130.218	unknown	United States	1226	CTA-42-AS1226US	false
71.52.232.15	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
218.78.107.211	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
57.230.28.104	unknown	Belgium	2686	ATGS-MMD-ASUS	false
9.112.112.218	unknown	United States	3356	LEVEL3US	false
152.176.126.164	unknown	United States	701	UUNETUS	false
18.119.168.241	unknown	United States	3	MIT-GATEWAYSUS	false
148.105.157.157	unknown	United States	14782	THEROCKETSCIENCEGROUPUS	false
86.164.241.101	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
211.206.162.18	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
13.27.92.90	unknown	United States	26662	XEROX-WVUS	false
184.112.231.95	unknown	United States	7922	COMCAST-7922US	false
159.253.158.20	unknown	Netherlands	36351	SOFTLAYERUS	false
58.173.104.193	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
14.56.224.137	G0CRKCNbYu	Get hash	malicious	Mirai	Browse
14.56.224.137	2pPPNW1XSo	Get hash	malicious	Mirai	Browse
166.70.225.18	rfPNd4LGRl	Get hash	malicious	Mirai	Browse
5.130.59.62	adP3nMyzQr	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	arm.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	armv7l.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Fantazy.x86.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Fantazy.ppc.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	krfk64.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	krfk64.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	154.213.187.188-boatnet.mips-2025-01-21T21_33_18.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	armv5l.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	arm5.elf	Get hash	malicious	Moobot	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ONEFMCH	armv6l.elf	Get hash	malicious	Unknown	Browse	136.5.78.84
	Fantazy.x86.elf	Get hash	malicious	Unknown	Browse	136.111.209.200
	jaws	Get hash	malicious	Unknown	Browse	136.95.98.194
	arm7	Get hash	malicious	Unknown	Browse	136.95.98.160
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	136.91.218.213
	main_x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	136.18.5.216
	frosty.arm.elf	Get hash	malicious	Mirai	Browse	136.71.254.106
	armv6l.elf	Get hash	malicious	Mirai	Browse	136.138.208.82
	arm.elf	Get hash	malicious	Mirai	Browse	136.4.122.225
	https://bringintontoneville.shop/?gwxaxppu&qrc=dG9waWNhbEB2ZXJpem9uLm5ldA==	Get hash	malicious	Unknown	Browse	136.0.7.55
UninetSAdeCVMX	armv7l.elf	Get hash	malicious	Unknown	Browse	148.221.182.208
	armv6l.elf	Get hash	malicious	Unknown	Browse	187.206.41.240
	Fantazy.mips.elf	Get hash	malicious	Unknown	Browse	189.178.202.23
	Fantazy.x86.elf	Get hash	malicious	Unknown	Browse	189.255.191.20
	jaws	Get hash	malicious	Unknown	Browse	201.155.131.154
	armv7l.elf	Get hash	malicious	Unknown	Browse	187.157.59.250
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	187.171.203.255
	87.121.79.19-mips-2025-01-22T04_20_52.elf	Get hash	malicious	Mirai, Moobot	Browse	189.137.228.244
	154.213.189.141-x86-2025-01-21T03_19_07.elf	Get hash	malicious	Mirai, Moobot	Browse	201.147.42.230
	star.ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	187.144.40.37
AKAMAI-ASUS	Full Adobe Photoshop 2024 + CDkey.exe	Get hash	malicious	LummaC Stealer	Browse	104.102.49.254
	Free YouTube Downloader 2024.exe	Get hash	malicious	LummaC Stealer	Browse	104.102.49.254
	SET_UP.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	ChatGPT-5 Version 2024 .exe	Get hash	malicious	LummaC Stealer	Browse	104.102.49.254
	Bootstrapp.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	mal2.exe	Get hash	malicious	LummaC Stealer	Browse	104.102.49.254
	Fantazy.x86.elf	Get hash	malicious	Unknown	Browse	104.101.138.182
	http://skml.fly.dev/zPII8/	Get hash	malicious	Unknown	Browse	2.19.126.211
	https://lute-kumquat-bdag.squarespace.com/	Get hash	malicious	Unknown	Browse	2.19.126.206
	http://www.amazonrelay-setup.com/	Get hash	malicious	Unknown	Browse	104.102.43.30

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	high, very likely benign file
Preview:	auto_null.monitor.

/proc/6472/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:Rn:R
MD5:	64C95F27F37ED1B41299EBBBA5ED8612
SHA1:	133E96A6A229F8AC2429D2804A5A87E3AB193D70
SHA-256:	376E40F3F7A4C7FDFA3CD15854615FD6C0531FE02976D5420AEFAECFA45E48E7
SHA-512:	88CCE926957127A635AEB7A53169A36937C9B63AA5973AC0DB071A011D914AB3323F2A83DECB47A7722FA7DDE6F01C1597F339C5906F796E3AD13A86A1CCACC6
Malicious:	false
Reputation:	low
Preview:	6440.

/run/systemd/journal/streams/.#9:75927nOONpg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.51976724991344
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M+bxcSIXtSBLBv8ji4s:qgFq6g10+f+MT1cLBUs
MD5:	F6D5589EE7777FC98ABA2F70CC335D0B
SHA1:	618025FF07862FB1C5D868EFF1C0B8855E92B831
SHA-256:	5F75A205445B70D3F59C92DFB0A5D468D819A516759B6E025636B37B554C6AA7
SHA-512:	A804154FF75BE23F7555E7E7D6405479A29D2B7239CC41C670442C40FB064BC56EC24EF23063D009ADBD8B59041DED6876FA3EE22FDFBED5C15CE45FD7184FF7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4c1baab41a9745a7b2bf45bc3b0dce86.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:759299HGate

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.482590146525758
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9pKTdm0VEBt1Nrqjq:SbFuFyLVIg1BG+f+MzKDEBlqji4s
MD5:	788028599E42F30C279E7B61710E4A60
SHA1:	A2D894E97530879B5FA4E05C889A22A7BEC0BF21
SHA-256:	7B435E998ECEAE40BC4908A1AC4DC6877769CC8BD6423C6203EC39A5C4E7D5DC
SHA-512:	B28F99958399E429BCE59D1EB29AC79B82053DC08D9FC42200234F752EDAEDCE989FD1C6A289D6D1BAB81E0E60D13996D5C3504435B0F77A485F40C6DEE25E1D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7cfe26c3da8e4aa791570a6f3771aae5.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76451HNVvvh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.4818744993677315
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M6Y7rZPUFjZcHcljX+:qgFq6g10+f+MzcnmAu
MD5:	1CD5D8DFE2089642BAC996116FCD443C
SHA1:	1F4DB9D5D82D4F3974BBF77A8040772A7E53E6E4
SHA-256:	18C19F86E10686A5099BF54421276408D8F3A13EEE84E8FAD7CD7EF9A8AC010F
SHA-512:	D2738EC268C3EF4074A6773318DA82D7F8EA638C0A79027EDE027584722FCD0ECB58547D2BC057B35EB69FCDFC1FFC3346DA610A1D66F534AEB20EF3BD9D9592
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0ec6e547d81940a9b4105783327e60b1.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:764520KgJLh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.464986821467247
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9NNKViWc2WTUMPRx5:SbFuFyLVIg1BG+f+MPNOsTajNE
MD5:	868B06509F29C112C8F41A71B96204F3
SHA1:	CF8D3FC80C2CA35563543241F523AD420FF3785C
SHA-256:	D01B4FEAFC0C31A19805406EC31AC0B24B78605B187060D5F5FCE89053AB9BAF
SHA-512:	ADCD0EF2B0A571ECD4EB2DCE8D3AB29D4930B5034CB0FC02BB187C0D4B2A7567D385B1DBDA16DCEEADED653B53E85CBF6DD478375C05468D53F8DA52F9D15F90
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=72b811c804a549a6b94534d84728265b.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:76468GTdqQf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.395314152901626
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Motf+aYbyKcYg2jbVC:qgFq6g10+f+Mot25uHNz
MD5:	489C1107543A00459649F87DE86AC3C9
SHA1:	890FE47B5128DE5D93D8958E82DF763F7BA64A64
SHA-256:	54DFB5594DBE1CC247FF2C5123C6A5303AA348C2351783F30132B5E3994AD072
SHA-512:	86B51964D3E89B1B8C36689B3F13C80969FB3AC2951D138E55985D1CBC9780B7CB91CECE1F26A9F0280D0910C9A59F71CF0F38937B9264F81816B9ABD5466F17
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b5521fc9eba2429fa28ffdc260ade909.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:76516MeArLd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.401433691213299
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5KGWHAv3vl+vFrqj+:SbFuFyLVIg1BG+f+MfWHAvwv8jLkGq
MD5:	BCE0496CA5CD80B924C898A37B39E5AC
SHA1:	3891745D9128ABFAE3DD84B46EB54A7A8B58C9DD
SHA-256:	0F1A10427E252CCF7A40AEA71B152990D049B723BC34F2296AD481211B840773
SHA-512:	428A3BF771603AC1566F42D8EA40C219BD6C615000D597190E78A1848F566013A1C30DC447A652F6A2B748F4F73BC3AF5015060DF01313EBA083C7360E4D3A8E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3bd9c3a4b9f44949a1a800f7e39156af.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:76613I7c1Fh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.460561855464039
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm9DYQydvIjs2ALAXaGKX:SbFuFyLVIg1BAf+M+dwjNALyAZD
MD5:	F36B207DCB7822F9AAECE4C51AADB69C
SHA1:	39718F02D0989DA6AF708F401ADC23A76DEC948C
SHA-256:	94DF607F9BEC425EC45CE65200679BDD4E010415EF5AFCCA540E30941F172B92
SHA-512:	F48575F06BAFE009AB5B566CB71195E31F50AD222186C37FBA6096EF7964710697C592B040985D51D04CBE472D63E04D070FC8577D1A0CF64355673F47537A78
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=71bf4c6abc654058be99052b52879dae.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76614t9mJDh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.411874920943791
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M+vABPHwiRwATjdCt/rRMtq:qgFq6g10+f+M7v2AVCDL
MD5:	723604DC55680F2BA76679D0B8E1AC5B
SHA1:	A7B9255B52766B0EDDCE12BBD68C416A57329221
SHA-256:	5F2F432196594EB057F21C6803B0AA1010585662388FEBB460BEE83BBC45F24F
SHA-512:	DAB2ADBBCE1988E50A8D360462AB298EC7982ABC295829002F12BF015C30DD9C70CE14B0EBE516E2BDF4AC9B274125EEFCC61792590A4A50FB1F26B6D7281669
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=44b343ed3a064bb79c656e16ab8e4e9e.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:76618iJGOWe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.459933178928051
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm8HoHzGLRGKdZ5N2js2y:SbFuFyLVIg1BAf+M8HaSgKN0jNdQIeXD
MD5:	63E586BEC67B176CBE4AA4CF5C5CE680
SHA1:	0FA2AD25EB45077AEBD69A3FF53D6E05E06363D5
SHA-256:	118B9270EA08D9661636DB80459C77E778401BB2E365CD53A49488D813CA2D30
SHA-512:	2A3091B0FC05E6FD0FCE0F17CE17ADAC305B2E63ADE27B9C4014F4EBC7F64D07182CD9382069EE876730C9161A04974CAD9735AE3F5BF27F56A78079B247A925
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6bd01b0336a24c9a9b2f6b4ca9e860a5.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76846LAwc4f

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.416678258893529
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9gmiRUHY+sjs1Had9:SbFuFyLVIg1BG+f+Mymj4TjosQu
MD5:	BD2EA55D87827F1F5E313C1D712A1009
SHA1:	3A857DE23AED0CB4ACC4DFC10813BF331671C07A
SHA-256:	7FC14B0BE4606B107B8F1B5489E0B4DCCB34B337BBCAE4871411F128737D28B2
SHA-512:	D28EBC2D17B352484B78F1AD79B0381BD6D647D7E617C08F67367DA3F6AF5A58FE7B5DCAF0CCCD254C3AB6247512E2FE0749BB8ACD0174154AC0EF74C78A35C0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7306248ca1024e7f96d30eb70cc38d1b.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76870E7XFMg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.384618779684514
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M64BMBLuqjFmzXvn:qgFqo6g7/+0+f+MVMbQXvn
MD5:	5B9902C553B16D9878A07AF3E173EB23
SHA1:	2E470D982F47F2144CEF07E7560181A1144B04F0
SHA-256:	49221335A3566E61DF5D26F95A93C21C3DA7098146095956DB7F59C979A4F604
SHA-512:	4327677DFD5C04CB2AED13628B322A18E83E6A015B698FC1D46E07734AD340A2F8931F250B72E1579ED2653805CA9827CFD1735DD3AE0C6C926D0FF791BD11C5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0fa0d1173a4649a79e6caed53bbd9eda.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:768805929ld

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.440041187559137
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+Mxt6iVUoHYTjFmzXvn:qgFqdg7/+0+f+MS2U7NQXvn
MD5:	ECC7BC3269FF81409BEB82D878278445
SHA1:	C59EBBEE64C7DE478CA1367D29C06AA7E88EABC5
SHA-256:	92DB28E7370E6DD75B7ADB648471D1F53C4159C870B61B34FC2045103F67BF3B
SHA-512:	B3ED2693C93B4B8A3C85A43BAAF7E018032730248F2948BADB68DE336ADAE4B4DEB4725E9763A5BCD7EDD0A69A00F3FE2758D059EA07FF3C0669821A707FECBA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ed7562b5e3be4126bdc5856c47016b9b.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:76884Fix5of

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.360336352339179
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MyJXTDCkN0ZjdCLKzK:qgFq6g10+f+M8PCxCLAK
MD5:	A60A2F6E62ACAFB75CE19D8953742371
SHA1:	C63B0A4A63BA44656C610AAB05F606B246ED0230
SHA-256:	7822333B204BD2CAF6D7999909BFAA0372BDBFE134496348C88D381558B0EB0D
SHA-512:	EA71111C570F468AEB9EC09AC8B8F338CB680E6BB7DE1AF96E292F814A1FB1E2ADB7FFA0C7974E1CBEE6DBDBAE9C4E8A67CCCCEF9B93820646CBC373AEC2A7C1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=80033d8f631d4854a8eeeb393ced167f.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:76890GYgDMg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.380454974581066
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsvRTJtvU6WGXI022h:SbFuFyLVIg1BG+f+MstWIjtWL0
MD5:	92852367D06B9A169512E11D3E8A6A39
SHA1:	6565D49CBFC166117D6974783313012F80B50A0A
SHA-256:	6089D96E6C8D659D3CD94642B35AA50FFE4735D1C0250FD2F675661AB82EF850
SHA-512:	3E6431FBC379C95F4188EC13868AE4C83420CC03E81897DC66AC7C39A8E3A62EAE990ADA60DB67FEB3B52BA376F47587DFAA51824945A5F3918CF9FCCA235C2A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f0e4143159d547f6ac836123cb734f14.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:779925vmQYg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.397935517269181
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm7w5hGsVEXsjs2BZZGu:SbFuFyLVIg1BAf+M85z1jNTZD
MD5:	37A43F07F1E50DA3CFD8202992C408C6
SHA1:	477AB96482AF449D107D4DAB64FBEF86D82BC9F8
SHA-256:	0E8438EF65E2170505CDB7F54FF597053B41BE558CCE436D71F2712B8D4409C6
SHA-512:	E8CCABECA5C7161EF6A1524B84686AE33A5AA7B6EEB4405DCFF0337D1207A4B028B1632BF14E9ECC342CE5771892B530BF8DE93DA4BE3C668AA62E1846D57895
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1dc957554fc14c23919076ef40f20f70.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78124MSnTgd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.4393598119173525
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8GnQlDmG2A+sjswxM:SbFuFyLVIg1BG+f+M8Xlt28jLTTIWTIL
MD5:	ABE158C10A356C719675B91E3C396B49
SHA1:	2018D96DC79CA3A18F972B497735C91341E2E233
SHA-256:	FC196CC8B939AF9E1826A94520C52C73D53E8204BD799925091EE86FEDF3B7AA
SHA-512:	20804643972BFE84084B13C265CD8525F7C8D215BC2FB6479F127AE5B21D9FE37FC7C4ED370AE616A9D81292598F4DFD2C78608A2019F4F8D4D45B70C9027421
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6c934674d0d9422cbec156ad681f70c1.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:781726dciLd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.449571337118238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmo5nBuieNgFQpjsz:SbFuFyLVK6g7/+BG+f+Mo5UiejjNq
MD5:	70BD759770D1E82ED38A580AF654F8D3
SHA1:	EE761986D7E0A10C3D7B79FDBCCD16C38B32E411
SHA-256:	4B246D0CE259EA936C3562C8D24FF45D880581815B6354CA4B8BD826A58D2CF9
SHA-512:	ABAF4F22209FF1D86FBA241F53013DC6D829EF6FDD54483920FCB4ED6D978408848F1F43BC99263329649C94E85A421E616E25C13B6833E31A730B9671146618
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b6a7db9d7d784a5b9c28be8f44135287.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78174xXN4Pe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.4004702777818405
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm6EZO/FooVHvKVYs:SbFuFyLVI6g7/+BG+f+M6EZK7jNq
MD5:	FD96404B858295AFC69D647B8C69FEB0
SHA1:	14BF34A4E5CF0E33583863F91C774D25CB647643
SHA-256:	825A7F180D73CC21A69256F2BADE108C38174DFE05CCA3F5F4E2A699E1E4EB76
SHA-512:	B109268CCE64EBABCC9A71A454F90C1611D4C7AE82C07AADF0710CB9E87D0B96E9CBAB2930B3AB8B9E3E5996BB618048A08F4B2D37E41576086A809A5EC327E7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0181f75d25814204a5a90c50b79c2910.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78218xgTLId

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.501102225279044
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MYyae1jr5qjFQMzKaBu:qgFqo6g7/+0+f+MTae1GTmh
MD5:	074368FE17C0A75F1E2DCE525FBEDB03
SHA1:	F860C599F107167005C10F835D0855FF6240852F
SHA-256:	AC8E1AF9F06DBB29874931937389100DEF0F8E53D97191C1975E7081E0E31AF3
SHA-512:	6B177C50CD6581F309E6A4A5D9CFB848DEC5A2BC832A2A4C601DF5CE3F1E235B1A315B695596A4AE9EEFEF9D34AEBF054924AC3E64E7417C2F5139BDCAC75769
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c2c9ff77348e44d994b0e1bea0ead8a3.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:78220nqiy4e

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.5062794897437275
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M4T2XGZJEmZjFQMzKaBu:qgFqdg7/+0+f+M4SXSVvTmh
MD5:	4BA20DA6BA7C6F30A60C91E83D09A3FE
SHA1:	C1688CADD8A9C5973C4286EB7D92E376BB677AEE
SHA-256:	8D45C261E3B6DDD7B7DF95D0415159DAC7A7FD5B606A3CBB3B2B0DB3BAF2E9F3
SHA-512:	D89ECC98F5D94DC3324B6AC738AAB2677EC1823397EDBF4E1C67F01095D86DC9D6B8118D32377F40E2AEC2E817AE9C18CC082FEB99E8FF9F4E4777381FBC76AC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=26ff2b4f890c452cac9daabca810c69c.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:78793bcrtod

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.36286313860381
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuf+r5AX5BUHqHOsjx:SbFuFyLVIg1BG+f+MufyAX5BUKHDjoa
MD5:	3F834F7F4A445C3B3F82F217D4BC96EC
SHA1:	C76B1C96649F8950DBD90943889A8F91A29AB2F1
SHA-256:	0EC3AAC573B626A3F912C281CF0029F63F0A39AA611E511496749310CAA10026
SHA-512:	47D89D649B830EE9C3693CE84E37F5A2D408EC0874EC1B99290A03901747DB3EC3B7C78101145E0D6C2950BB0BB541D2033D7D9CFC3FF6295F706C03049BD14D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dce494f701024b58ae25bbe511b519bc.IDENTIFIER=dbus-daemon.

/run/systemd/seats/.#seat0dP50J7

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0eRTvh7

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/users/.#12786b3Da

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127BvmLs9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.303461924440501
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6NEJgr9F2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEEJgZMthQHtPYq9M
MD5:	A02CEFAD42D567D71185F900E8817C81
SHA1:	CC4071F6279023BC71D931FE307386FB1DBD21CF
SHA-256:	1FE77EAB568B8897D62851CBCF21643C6E939E954313BDD82E59037D9F391A0F
SHA-512:	7BC30EFC53FA568A63A047E3CDF4C96BF358D6FBB722726F0D03508189A134F10514E7DBBC40CEB4A95598F250160761612F849672E411A05A38E0E17FB40BD8
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12287.REALTIME=1737618463372373.MONOTONIC=469516815.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127EDv2U9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.470010903114406
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff68Cgr9hot6NEco:qgFq30dABibBAgZ+I0
MD5:	FC37A62AFF080190C094A66BEBF186B6
SHA1:	1075006F558C3D821591C4DDFDCCCA90E04E19CE
SHA-256:	F111DBC740B41ABF433504342A1E73D5C4ED9DBD4DCCB81EC4AC9EB5082C6C4C
SHA-512:	A508DA8BA32F00911E44AC22E4EC30152BE5DAAB8FBAC4CEC44736E548AB2348F2C668FF16F74D4FF65F806E383900DC66EB457CA895A6048A7822606A823893
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12349.REALTIME=1737618463372373.MONOTONIC=469516815.LAST_SESSION_TIMESTAMP=469583593.

/run/systemd/users/.#127Iexci9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.311057957942776
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgCwk8f9Jpk5206qodjrQco:SbFuFyL3BVgdL87iesnAiRJgr9hot6Ne
MD5:	D46BD38133CB8AC9C88D7129D9EC5D71
SHA1:	738C7F4EBB8D1091D6D950E0103FD889C853AE9F
SHA-256:	AE76223C82967CEC1634A391D1E862DEFC8A9DCA01F46733F5FDA469A83CF703
SHA-512:	11E5E2FE533FC7BB1E1CA477E8039A2D7BA924FD244B4063444557FC283A668BF9734A50194FCFB59BC691B6D5AFCAE908B7D0C724C08B77DD0C02D9CE1E99FE
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1737618463372373.MONOTONIC=469516815.LAST_SESSION_TIMESTAMP=469583593.

/run/systemd/users/.#127WYrgb7

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.303461924440501
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6NEJgr9F2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEEJgZMthQHtPYq9M
MD5:	A02CEFAD42D567D71185F900E8817C81
SHA1:	CC4071F6279023BC71D931FE307386FB1DBD21CF
SHA-256:	1FE77EAB568B8897D62851CBCF21643C6E939E954313BDD82E59037D9F391A0F
SHA-512:	7BC30EFC53FA568A63A047E3CDF4C96BF358D6FBB722726F0D03508189A134F10514E7DBBC40CEB4A95598F250160761612F849672E411A05A38E0E17FB40BD8
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12287.REALTIME=1737618463372373.MONOTONIC=469516815.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:ce:ce
MD5:	A74FA28E47D20F36C18C0B0B3952AC18
SHA1:	A44161A3689494C698D21296600FCC9A308EF6D5
SHA-256:	80D88B40D5FBF1A6CDEFA4024B4CC7132B52BD7D673228F2FB2E1A85C4A5E474
SHA-512:	1B35D29AEEC3764607A0753F35BA82B410B261A0AA95FDBD2FAD3CE21B800E85D1C9C7B42D01640CB4392779EE517BE3B7FDC86FA7BDD8AA0D44489E3F55866A
Malicious:	false
Preview:	6329.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6722951801018084
Encrypted:	false
SSDEEP:	3:tCsXlXEWtl/5J4ml/l:tf+ylxJV
MD5:	CE6CCE6E03C1F7F0F4C41687671DF6CC
SHA1:	12AF7BA11F27CA917B913282EF8AEE26910D1F17
SHA-256:	003CBF59073E47368FB9C8480944302B90736A7412BB797E571C2AFDDF60F7B5
SHA-512:	F6FD7F770988A4B009355CAD2F532896C8213C4F783BE59CE114BF7E36FA6C0CEE81DC28BEF6545865B9B7E1239A460F36B1FA6F496146E2547B4639AB8954A1
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN......................................................................................................................................................................................................................................................................................................g........................................

/tmp/qemu-open.g6x89e (deleted)

Download File

Process:	/tmp/Fantazy.arm4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	3.578868021290193
Encrypted:	false
SSDEEP:	6:OgDF6ElR0Jznj/VUX/vYDF6ElR0JzC7Y/V3Y/VjmsVot/VOArB/VH:OYNlR0JznyXQNlR0JzDl
MD5:	9F11127DAAE371FF24035CEB57B1D9BF
SHA1:	A9DA07F9CF22C981D500410ED078AAC8011CF5CD
SHA-256:	9359C739AF2FB8C563B5879E9780B427E1BEC6F4839E5C51B3A620008F380E26
SHA-512:	39A51CDA08D24C843FD0248FAD7E21C8E381EA0D31EFB1918C143F6CAED1489085EF3FF30516BA54BD00C08E4521714460074DC7EB3FD999218836B50C7AA142
Malicious:	false
Preview:	8000-1b000 r-xp 00000000 fd:00 531606 /tmp/Fantazy.arm4.elf.22000-23000 rw-p 00012000 fd:00 531606 /tmp/Fantazy.arm4.elf.23000-24000 rw-p 00000000 00:00 0 .24000-26000 rw-p 00000000 00:00 0 .ff7ef000-ff7f0000 ---p 00000000 00:00 0 .ff7f0000-ffff0000 rw-p 00000000 00:00 0 [stack].

/var/lib/AccountsService/users/gdm.SUX902

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1839
Entropy (8bit):	4.887375512396212
Encrypted:	false
SSDEEP:	24:XA/xNxtFdcMZ4IbMZedbeZb2n2G2OzbZ9Ave9A2+VsPwKzM0pYr4QCJr4krCQU:Wx5MvZfV+Yr4pr4krCn
MD5:	6E909554DCF09E784502A227065FAD98
SHA1:	866C345F2E2C6CD0946E6286BF7369B675CB2C33
SHA-256:	4D98E899E951702AE506C726AFE9D2DA7E7CB9F2C950CB36CA6C3A91C3A404FC
SHA-512:	2B58EE620A2048D4CC55CD3A1407588F3F4D0ED5B0E9FF3AE6D27A61C64ADD67D2FFC846902E04E04F453667E49E8DDCBBFD67C318248477ACD979F587C2D031
Malicious:	false
Preview:	Jan 23 01:47:19 galassia systemd-logind[797]: Failed to abandon session scope, ignoring: Transport endpoint is not connected.Jan 23 01:47:19 galassia systemd-logind[797]: Session c2 logged out. Waiting for processes to exit..Jan 23 01:47:20 galassia systemd-logind[6334]: Failed to add user by file name 127, ignoring: Invalid argument.Jan 23 01:47:20 galassia systemd-logind[6334]: Failed to add user by file name 1000, ignoring: Invalid argument.Jan 23 01:47:20 galassia systemd-logind[6334]: User enumeration failed: Invalid argument.Jan 23 01:47:20 galassia systemd-logind[6334]: User of session c2 not known..Jan 23 01:47:20 galassia systemd-logind[6334]: User of session 2 not known..Jan 23 01:47:20 galassia systemd-logind[6334]: User of session c1 not known..Jan 23 01:47:20 galassia systemd-logind[6334]: Session enumeration failed: No such file or directory.Jan 23 01:47:20 galassia systemd-logind[6334]: Watching system buttons on /dev/input/event0 (Power Button).Jan 23 01:47:20 galassia

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4313806548581445
Encrypted:	false
SSDEEP:	3:F31Hlup/lllgpPllll:F3+dlletll
MD5:	F0B6159673267DDF26C14D7431957444
SHA1:	37195DCE58E0535848C27E16271DEB838B961E00
SHA-256:	CCCD58EA6CDB03D7B7D9AD2F875A1870478576D1C4757B0E90FE70DEA93E966D
SHA-512:	8EBC4C17843553C027CC14006F32D0A89C5FB8ED1003EFD9BE3EA698A28592DCE62BCB98D5410D5EC2B296F6A46F88F5EE2E2D5A516ECE4CC4841DFE8DB19862
Malicious:	false
Preview:	LPKSHHRH....................2LE......e.....................................2LE......e.........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.448047321524811
Encrypted:	false
SSDEEP:	3:F31Hl1D8Hzr+6dD8Hzr+u:F350r+K0r+u
MD5:	8E338B6C5F2C6FF0766F2AB2BA81DBDA
SHA1:	D0E8CFF05E1FD9D640F0BAEC49C371D42F4FF2FC
SHA-256:	18A996AD53A7EAA586B23CBB1A0F6A42F1AC5F513D39E25E23C2F96049EE0194
SHA-512:	33EE977D1404436CF2747B9C802C38E97BA68F10CB7A4EFD4D99517438A359C6F240FA953871F3D516AB8DA5BA25E0AC18246A8069386A9C8292F05C254BF2C2
Malicious:	false
Preview:	LPKSHHRH.................De5..Ab.N..0F...................................De5..Ab.N..0F..........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	6739
Entropy (8bit):	4.7200340847345545
Encrypted:	false
SSDEEP:	48:kJ1t6cUyJ9K+gs/0LRNpERIp85Hy0LDm+S0yKEBQGJk+hOBCXS4nx9qayv2UF96G:AbM872yM1OfuKew+1BVYrU3u
MD5:	34BB82318DB5697DA312A0D568CFDEAA
SHA1:	C7284C68DF54BB3A6FE33B53E0B6E44A8E454790
SHA-256:	FB1B5CAAD824CAE1E3433130FB6B97164EC8428CE05259E7CD03A588C0C0802B
SHA-512:	F6D0C9A83AFF6790590F4AF2176C1124BEE83AF142A013C8D395AD29055EDEEA48E942EC3F30B0664654C3F928BCBEA9B54111029123C946C0E8E27327212E86
Malicious:	false
Preview:	Jan 23 01:47:18 galassia kernel: [ 443.309128] New task spawned: old: (tgid 6326, tid 6326), new (tgid: 6326, tid: 6404).Jan 23 01:47:18 galassia kernel: [ 443.850904] Reached call limit: pid 6256, name read.Jan 23 01:47:18 galassia kernel: [ 444.083701] New task spawned: old: (tgid 6398, tid 6398), new (tgid: 6409, tid: 6409).Jan 23 01:47:18 galassia kernel: [ 444.211078] New task spawned: old: (tgid 6409, tid 6409), new (tgid: 6410, tid: 6410).Jan 23 01:47:18 galassia kernel: [ 444.668641] New task spawned: old: (tgid 6398, tid 6398), new (tgid: 6411, tid: 6411).Jan 23 01:47:18 galassia kernel: [ 444.751352] New task spawned: old: (tgid 6408, tid 6408), new (tgid: 6408, tid: 6412).Jan 23 01:47:18 galassia kernel: [ 444.752797] New task spawned: old: (tgid 6408, tid 6408), new (tgid: 6408, tid: 6413).Jan 23 01:47:18 galassia kernel: [ 444.757755] New task spawned: old: (tgid 6408, tid 6412), new (tgid: 6408, tid: 6414).Jan 23 01:47:18 galassia kernel: [ 444.770853] New task s

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (317)
Category:	dropped
Size (bytes):	32262
Entropy (8bit):	5.021623036661281
Encrypted:	false
SSDEEP:	768:KI86hnLfVUeKASO8gmVp1z8NJzA4cmTe6EU+LPRL0g+EB1rhjftUWKYM6WIyPjdK:i6U
MD5:	8773BE3B14528473FEB427F32140F3EC
SHA1:	AFBAFA1617EB2AA58EA0EC74FEBD4850E9C033B7
SHA-256:	07C1A8E083E848F75050DB911809323E85F0889D89E9E6D01A8839579DD1397F
SHA-512:	2F7DBF442AA8C92DF65F539462D64F99ACB2BE4363E284AE4CAF94599682AE9DC29ECFCF938626C0EB45E74EEC1AFCAA8FF20039C099F63A52E76BB96435141A
Malicious:	false
Preview:	Jan 23 01:47:18 galassia multipathd[658]: sda: add missing path.Jan 23 01:47:18 galassia multipathd[658]: sda: failed to get udev uid: Invalid argument.Jan 23 01:47:18 galassia multipathd[658]: sda: failed to get sysfs uid: Invalid argument.Jan 23 01:47:18 galassia multipathd[658]: sda: failed to get sgio uid: No such file or directory.Jan 23 01:47:18 galassia [2062]: xfsettingsd: Fatal IO error 11 (Resource temporarily unavailable) on X server :1..Jan 23 01:47:18 galassia polkitd[6397]: started daemon version 0.105 using authority implementation `local' version `0.105'.Jan 23 01:47:18 galassia [2063]: xfce4-panel: Fatal IO error 11 (Resource temporarily unavailable) on X server :1..Jan 23 01:47:18 galassia dbus-daemon[6321]: [system] Successfully activated service 'org.freedesktop.PolicyKit1'.Jan 23 01:47:18 galassia [2074]: xfdesktop: Fatal IO error 11 (Resource temporarily unavailable) on X server :1..Jan 23 01:47:18 galassia systemd[1]: whoopsie.service: Scheduled restart job, rest

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6722951801018084
Encrypted:	false
SSDEEP:	3:tCsXlXEWtl/5J4ml/l:tf+ylxJV
MD5:	CE6CCE6E03C1F7F0F4C41687671DF6CC
SHA1:	12AF7BA11F27CA917B913282EF8AEE26910D1F17
SHA-256:	003CBF59073E47368FB9C8480944302B90736A7412BB797E571C2AFDDF60F7B5
SHA-512:	F6FD7F770988A4B009355CAD2F532896C8213C4F783BE59CE114BF7E36FA6C0CEE81DC28BEF6545865B9B7E1239A460F36B1FA6F496146E2547B4639AB8954A1
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN......................................................................................................................................................................................................................................................................................................g........................................

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	6.116706435205788
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Fantazy.arm4.elf
File size:	76'608 bytes
MD5:	3f1b22621624a788f5226ff34b4e1601
SHA1:	d2933fe7305b3573e19472c8732c0a6da83dcad9
SHA256:	c49d046462acb70c1f1c4d31a0e7f68da11d17b1cf247f27d3f62958378562c2
SHA512:	5c40eee997ab6b68f912ef47e05add2167f81f84d715dcbe90a351aa43780718bab04123c26c1df2410dce958cd6c497ee5339ff2373cc272a745148a4c2f6d4
SSDEEP:	1536:ywiXKepUEGzxcJ7tqFkwN8wJ3AXfU2/pSDgBaAy:ywi6epUEGN6quwvJ3AM2RSEBaAy
TLSH:	79730786BC40AA16D7C05777FE6F10CE3314A7D8E1DA32029C255FA07B8ED2B0D66766
File Content Preview:	.ELF...a..........(.........4....)......4. ...(.....................@'..@'..............D'..D'..D'..,...............Q.td..................................-...L."....D..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	76208
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x113f0	0x0	0x6	AX	16
.fini	PROGBITS	0x194a0	0x114a0	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x194b4	0x114b4	0x128c	0x0	0x2	A	4
.ctors	PROGBITS	0x22744	0x12744	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x2274c	0x1274c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x22758	0x12758	0x218	0x0	0x3	WA	4
.bss	NOBITS	0x22970	0x12970	0x558	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x12970	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x12740	0x12740	6.1368	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x12744	0x22744	0x22744	0x22c	0x784	2.9605	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 23, 2025 08:47:17.779684067 CET	192.168.2.23	1.1.1.1	0x790c	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 23, 2025 08:47:17.779753923 CET	192.168.2.23	1.1.1.1	0xd465	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Jan 23, 2025 08:47:18.323852062 CET	192.168.2.23	1.1.1.1	0xb2d8	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 23, 2025 08:47:17.786521912 CET	1.1.1.1	192.168.2.23	0x790c	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Jan 23, 2025 08:47:17.786521912 CET	1.1.1.1	192.168.2.23	0x790c	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2025-01-23 07:47:24 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2025-01-23 07:47:25 UTC	25	IN	HTTP/1.1 100 Continue
2025-01-23 07:47:25 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2025-01-23 07:47:25 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2025-01-23 07:47:25 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2025-01-23 07:47:25 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2025-01-23 07:47:25 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2025-01-23 07:47:25 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2025-01-23 07:47:25 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2025-01-23 07:47:25 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2025-01-23 07:47:25 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2025-01-23 07:47:25 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2025-01-23 07:47:25 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Jan 2025 07:47:25 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	07:46:47
Start date (UTC):	23/01/2025
Path:	/tmp/Fantazy.arm4.elf
Arguments:	/tmp/Fantazy.arm4.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	07:46:54
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	07:46:56
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	07:47:13
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	07:47:14
Start date (UTC):	23/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	07:47:16
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	07:47:17
Start date (UTC):	23/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	07:47:18
Start date (UTC):	23/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	07:47:19
Start date (UTC):	23/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	07:47:20
Start date (UTC):	23/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	07:47:21
Start date (UTC):	23/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	07:47:22
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	07:47:24
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Fantazy.arm4.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6472/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:75927nOONpg

/run/systemd/journal/streams/.#9:759299HGate

/run/systemd/journal/streams/.#9:76451HNVvvh

/run/systemd/journal/streams/.#9:764520KgJLh

/run/systemd/journal/streams/.#9:76468GTdqQf

/run/systemd/journal/streams/.#9:76516MeArLd

/run/systemd/journal/streams/.#9:76613I7c1Fh

/run/systemd/journal/streams/.#9:76614t9mJDh

/run/systemd/journal/streams/.#9:76618iJGOWe

/run/systemd/journal/streams/.#9:76846LAwc4f

/run/systemd/journal/streams/.#9:76870E7XFMg

/run/systemd/journal/streams/.#9:768805929ld

/run/systemd/journal/streams/.#9:76884Fix5of

/run/systemd/journal/streams/.#9:76890GYgDMg

/run/systemd/journal/streams/.#9:779925vmQYg

/run/systemd/journal/streams/.#9:78124MSnTgd

/run/systemd/journal/streams/.#9:781726dciLd

/run/systemd/journal/streams/.#9:78174xXN4Pe

/run/systemd/journal/streams/.#9:78218xgTLId

/run/systemd/journal/streams/.#9:78220nqiy4e

/run/systemd/journal/streams/.#9:78793bcrtod

/run/systemd/seats/.#seat0dP50J7

/run/systemd/seats/.#seat0eRTvh7

/run/systemd/users/.#12786b3Da

/run/systemd/users/.#127BvmLs9

/run/systemd/users/.#127EDv2U9

/run/systemd/users/.#127Iexci9

/run/systemd/users/.#127WYrgb7

Linux Analysis Report
Fantazy.arm4.elf

Start time (UTC):	07:47:28
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	07:47:38
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	07:47:39
Start date (UTC):	23/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	07:47:41
Start date (UTC):	23/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	07:47:43
Start date (UTC):	23/01/2025
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	07:47:44
Start date (UTC):	23/01/2025
Path:	/usr/bin/dbus-run-session
Arguments:	-
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4

Start time (UTC):	07:47:57
Start date (UTC):	23/01/2025
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Start time (UTC):	07:49:27
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre