Create Interactive Tour

Linux Analysis Report
Fantazy.sh4.elf

Overview

General Information

Sample name:	Fantazy.sh4.elf
Analysis ID:	1597509
MD5:	af980b8d1e28eb0db206272ebf53e681
SHA1:	9a510ec64649e570cff28d92e0c6f20926add1f9
SHA256:	cdad489cf13fef6968275cad1ea866ecb5b8132f15fa9b718fc59a538c0ce04a
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1597509
Start date and time:	2025-01-23 11:26:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Fantazy.sh4.elf
Detection:	MAL
Classification:	mal68.spre.troj.linELF@0/43@3/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing network information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/Fantazy.sh4.elf
PID:	6236
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	VegaSec-KATANA001
Standard Error:

Process Tree

system is lnxubuntu20

Fantazy.sh4.elf (PID: 6236, Parent: 6160, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/Fantazy.sh4.elf

Fantazy.sh4.elf New Fork (PID: 6238, Parent: 6236)

Fantazy.sh4.elf New Fork (PID: 6239, Parent: 6236)

Fantazy.sh4.elf New Fork (PID: 6242, Parent: 6239)

Fantazy.sh4.elf New Fork (PID: 6244, Parent: 6239)

Fantazy.sh4.elf New Fork (PID: 6246, Parent: 6239)

systemd New Fork (PID: 6254, Parent: 1)

journalctl (PID: 6254, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6268, Parent: 1)

systemd-journald (PID: 6268, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6273, Parent: 1)

journalctl (PID: 6273, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6350, Parent: 1)

dbus-daemon (PID: 6350, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gdm3 New Fork (PID: 6352, Parent: 1320)

Default (PID: 6352, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6355, Parent: 1320)

Default (PID: 6355, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6356, Parent: 1320)

Default (PID: 6356, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6357, Parent: 1860)

pulseaudio (PID: 6357, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6360, Parent: 1)

rtkit-daemon (PID: 6360, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6363, Parent: 1)

systemd-logind (PID: 6363, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6425, Parent: 1)

polkitd (PID: 6425, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6430, Parent: 1)

gpu-manager (PID: 6430, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6431, Parent: 6430)

sh (PID: 6431, Parent: 6430, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6432, Parent: 6431)

grep (PID: 6432, Parent: 6431, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6434, Parent: 6430)

sh (PID: 6434, Parent: 6430, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6435, Parent: 6434)

grep (PID: 6435, Parent: 6434, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6438, Parent: 6430)

sh (PID: 6438, Parent: 6430, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6439, Parent: 6438)

grep (PID: 6439, Parent: 6438, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6441, Parent: 6430)

sh (PID: 6441, Parent: 6430, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6442, Parent: 6441)

grep (PID: 6442, Parent: 6441, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6443, Parent: 6430)

sh (PID: 6443, Parent: 6430, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6447, Parent: 6443)

grep (PID: 6447, Parent: 6443, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6448, Parent: 6430)

sh (PID: 6448, Parent: 6430, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6449, Parent: 6448)

grep (PID: 6449, Parent: 6448, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6450, Parent: 6430)

sh (PID: 6450, Parent: 6430, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6451, Parent: 6450)

grep (PID: 6451, Parent: 6450, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6452, Parent: 6430)

sh (PID: 6452, Parent: 6430, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6453, Parent: 6452)

grep (PID: 6453, Parent: 6452, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6433, Parent: 1)

agetty (PID: 6433, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6440, Parent: 1)

rsyslogd (PID: 6440, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6459, Parent: 1)

generate-config (PID: 6459, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6460, Parent: 6459)

pkill (PID: 6460, Parent: 6459, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6461, Parent: 1)

gdm-wait-for-drm (PID: 6461, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6468, Parent: 1)

gdm3 (PID: 6468, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6473, Parent: 6468)

plymouth (PID: 6473, Parent: 6468, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6490, Parent: 6468)

gdm-session-worker (PID: 6490, Parent: 6468, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6494, Parent: 6490)

gdm-wayland-session (PID: 6494, Parent: 6490, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6496, Parent: 6494)

dbus-daemon (PID: 6496, Parent: 6494, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6500, Parent: 6496)

dbus-daemon New Fork (PID: 6501, Parent: 6500)

false (PID: 6501, Parent: 6500, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6502, Parent: 6494)

dbus-run-session (PID: 6502, Parent: 6494, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6503, Parent: 6502)

dbus-daemon (PID: 6503, Parent: 6502, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6504, Parent: 6468)

Default (PID: 6504, Parent: 6468, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6505, Parent: 6468)

Default (PID: 6505, Parent: 6468, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6474, Parent: 1)

accounts-daemon (PID: 6474, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6485, Parent: 6474)

language-validate (PID: 6485, Parent: 6474, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6486, Parent: 6485)

language-options (PID: 6486, Parent: 6485, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6487, Parent: 6486)

sh (PID: 6487, Parent: 6486, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6488, Parent: 6487)

locale (PID: 6488, Parent: 6487, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6489, Parent: 6487)

grep (PID: 6489, Parent: 6487, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

gvfsd-fuse New Fork (PID: 6512, Parent: 2038)

fusermount (PID: 6512, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6554, Parent: 1860)

dbus-daemon (PID: 6554, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6440)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /tmp/Fantazy.sh4.elf (PID: 6236)	Socket: 127.0.0.1:59025	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6268)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6468)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6496)	Socket: unknown address family	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 192.223.7.113
Source: unknown	TCP traffic detected without corresponding DNS query: 31.134.180.138
Source: unknown	TCP traffic detected without corresponding DNS query: 89.135.240.59
Source: unknown	TCP traffic detected without corresponding DNS query: 14.157.66.129
Source: unknown	TCP traffic detected without corresponding DNS query: 88.169.148.188
Source: unknown	TCP traffic detected without corresponding DNS query: 186.80.76.2
Source: unknown	TCP traffic detected without corresponding DNS query: 136.128.61.30
Source: unknown	TCP traffic detected without corresponding DNS query: 189.69.146.97
Source: unknown	TCP traffic detected without corresponding DNS query: 124.63.14.119
Source: unknown	TCP traffic detected without corresponding DNS query: 31.7.230.93
Source: unknown	TCP traffic detected without corresponding DNS query: 93.23.118.38
Source: unknown	TCP traffic detected without corresponding DNS query: 106.99.250.28
Source: unknown	TCP traffic detected without corresponding DNS query: 60.162.218.195
Source: unknown	TCP traffic detected without corresponding DNS query: 201.20.238.108
Source: unknown	TCP traffic detected without corresponding DNS query: 191.156.251.36
Source: unknown	TCP traffic detected without corresponding DNS query: 27.60.125.139
Source: unknown	TCP traffic detected without corresponding DNS query: 118.225.22.3
Source: unknown	TCP traffic detected without corresponding DNS query: 18.202.87.75
Source: unknown	TCP traffic detected without corresponding DNS query: 184.191.118.161
Source: unknown	TCP traffic detected without corresponding DNS query: 58.115.50.95
Source: unknown	TCP traffic detected without corresponding DNS query: 125.11.41.48
Source: unknown	TCP traffic detected without corresponding DNS query: 18.12.40.173
Source: unknown	TCP traffic detected without corresponding DNS query: 68.123.222.70
Source: unknown	TCP traffic detected without corresponding DNS query: 73.19.175.152
Source: unknown	TCP traffic detected without corresponding DNS query: 130.208.54.189
Source: unknown	TCP traffic detected without corresponding DNS query: 104.117.69.170
Source: unknown	TCP traffic detected without corresponding DNS query: 126.27.121.110
Source: unknown	TCP traffic detected without corresponding DNS query: 191.22.183.246
Source: unknown	TCP traffic detected without corresponding DNS query: 179.122.215.201
Source: unknown	TCP traffic detected without corresponding DNS query: 60.71.68.46
Source: unknown	TCP traffic detected without corresponding DNS query: 205.235.115.130
Source: unknown	TCP traffic detected without corresponding DNS query: 162.215.162.215
Source: unknown	TCP traffic detected without corresponding DNS query: 217.120.181.9
Source: unknown	TCP traffic detected without corresponding DNS query: 102.66.122.155
Source: unknown	TCP traffic detected without corresponding DNS query: 120.241.129.219
Source: unknown	TCP traffic detected without corresponding DNS query: 112.204.72.95
Source: unknown	TCP traffic detected without corresponding DNS query: 136.124.120.104
Source: unknown	TCP traffic detected without corresponding DNS query: 44.169.12.234
Source: unknown	TCP traffic detected without corresponding DNS query: 13.8.41.202
Source: unknown	TCP traffic detected without corresponding DNS query: 185.29.84.18
Source: unknown	TCP traffic detected without corresponding DNS query: 90.145.168.48
Source: unknown	TCP traffic detected without corresponding DNS query: 211.67.223.201
Source: unknown	TCP traffic detected without corresponding DNS query: 93.81.29.185
Source: unknown	TCP traffic detected without corresponding DNS query: 18.195.61.224
Source: unknown	TCP traffic detected without corresponding DNS query: 126.174.126.138
Source: unknown	TCP traffic detected without corresponding DNS query: 208.242.20.58
Source: unknown	TCP traffic detected without corresponding DNS query: 182.213.58.77
Source: unknown	TCP traffic detected without corresponding DNS query: 216.129.52.139
Source: unknown	TCP traffic detected without corresponding DNS query: 195.144.2.238
Source: unknown	TCP traffic detected without corresponding DNS query: 84.192.169.145

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.57.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38238
Source: unknown	Network traffic detected: HTTP traffic on port 38238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 6066, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 6220, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 6221, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 6239, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 6244, result: unknown	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 6066, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 6220, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 6221, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 6239, result: successful	Jump to behavior
Source: /tmp/Fantazy.sh4.elf (PID: 6244)	SIGKILL sent: pid: 6244, result: unknown	Jump to behavior

Source: classification engine

Classification label: mal68.spre.troj.linELF@0/43@3/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6350)	File: /proc/6350/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6496)	File: /proc/6496/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6503)	File: /proc/6503/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6512)	File: /proc/6512/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6554)	File: /proc/6554/mounts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6268)	File: /run/systemd/journal/streams/.#9:75139OI6iy9	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6268)	File: /run/systemd/journal/streams/.#9:74744iXJAga	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6268)	File: /run/systemd/journal/streams/.#9:762911Y2ppa	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6268)	File: /run/systemd/journal/streams/.#9:76306tQNED8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6268)	File: /run/systemd/journal/streams/.#9:76319hGNzp8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6268)	File: /run/systemd/journal/streams/.#9:76581S3hQJb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6268)	File: /run/systemd/journal/streams/.#9:76585E6diH7	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6268)	File: /run/systemd/journal/streams/.#9:76700recw39	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6268)	File: /run/systemd/journal/streams/.#9:757229T9AXb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6268)	File: /run/systemd/journal/streams/.#9:76942Dmbjcb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6268)	File: /run/systemd/journal/streams/.#9:76945k6DV8a	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6268)	File: /run/systemd/journal/streams/.#9:77119AGNSn8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6268)	File: /run/systemd/journal/streams/.#9:77190HM5qOa	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6268)	File: /run/systemd/journal/streams/.#9:77306GoC9Nb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6268)	File: /run/systemd/journal/streams/.#9:77357FQ9Y4b	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6268)	File: /run/systemd/journal/streams/.#9:77358zahzU7	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6268)	File: /run/systemd/journal/streams/.#9:77395q23IVa	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6268)	File: /run/systemd/journal/streams/.#9:77401uwiyV9	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6268)	File: /run/systemd/journal/streams/.#9:78349i8vIL7	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6363)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6363)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6363)	File: /run/systemd/seats/.#seat0HAoGum	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6363)	File: /run/systemd/users/.#127RFFRKl	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6363)	File: /run/systemd/users/.#127LGATmm	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6363)	File: /run/systemd/seats/.#seat00DWBem	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6363)	File: /run/systemd/users/.#127RT92il	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6363)	File: /run/systemd/users/.#1273J02aj	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6363)	File: /run/systemd/users/.#1273GUC0j	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6363)	File: /run/systemd/users/.#127vrBoXk	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6425)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6494)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6474)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6474)	Directory: /root/.cache	Jump to behavior

Source: /usr/bin/dbus-daemon (PID: 6350)	File opened: /proc/6494/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6350)	File opened: /proc/6350/status	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6350)	File opened: /proc/6350/attr/current	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6350)	File opened: /proc/6353/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6350)	File opened: /proc/6353/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6350)	File opened: /proc/6474/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6350)	File opened: /proc/6363/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6350)	File opened: /proc/6357/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6350)	File opened: /proc/6357/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6350)	File opened: /proc/6357/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6350)	File opened: /proc/6490/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6350)	File opened: /proc/6490/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6350)	File opened: /proc/6360/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6350)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6350)	File opened: /proc/6425/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6350)	File opened: /proc/6468/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/6350/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/6350/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/6353/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/6353/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/6357/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/6357/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/3088/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/230/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/230/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/231/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/231/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/232/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/232/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/233/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/233/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/234/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/234/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/1335/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/1334/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/2302/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/236/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/236/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/237/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/237/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/910/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/910/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/2307/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/13/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/14/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/14/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/6363/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/6363/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/15/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/15/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/16/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/16/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/6244/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/6244/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/17/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/17/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/18/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/18/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/6246/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/6246/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/6360/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/6360/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/120/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/120/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/121/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/121/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/1/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/122/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/122/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/243/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	File opened: /proc/243/cmdline	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6431)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6434)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6438)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6441)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6443)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6448)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6450)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6452)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6487)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Source: /bin/sh (PID: 6432)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6435)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6439)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6442)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6447)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6449)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6451)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6453)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6489)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6460)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6268)

Reads from proc file: /proc/meminfo

Jump to behavior

Source: /sbin/agetty (PID: 6433)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6468)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6468)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6474)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6474)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6430)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6440)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6440)	Log file created: /var/log/auth.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 6430)

Truncated file: /var/log/gpu-manager.log

Jump to behavior

Source: /usr/bin/pulseaudio (PID: 6357)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pkill (PID: 6460)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /tmp/Fantazy.sh4.elf (PID: 6236)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6268)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6357)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6430)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6433)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6440)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6490)	Queries kernel information via 'uname':	Jump to behavior

Source: kern.log.57.dr	Binary or memory string: Jan 23 04:27:51 galassia kernel: [ 475.396163] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: Fantazy.sh4.elf, 6236.1.00007ffd4134c000.00007ffd4136d000.rw-.sdmp, Fantazy.sh4.elf, 6238.1.00007ffd4134c000.00007ffd4136d000.rw-.sdmp, Fantazy.sh4.elf, 6239.1.00007ffd4134c000.00007ffd4136d000.rw-.sdmp, Fantazy.sh4.elf, 6242.1.00007ffd4134c000.00007ffd4136d000.rw-.sdmp, Fantazy.sh4.elf, 6244.1.00007ffd4134c000.00007ffd4136d000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/Fantazy.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Fantazy.sh4.elf
Source: Fantazy.sh4.elf, 6236.1.00007ffd4134c000.00007ffd4136d000.rw-.sdmp, Fantazy.sh4.elf, 6238.1.00007ffd4134c000.00007ffd4136d000.rw-.sdmp, Fantazy.sh4.elf, 6239.1.00007ffd4134c000.00007ffd4136d000.rw-.sdmp, Fantazy.sh4.elf, 6242.1.00007ffd4134c000.00007ffd4136d000.rw-.sdmp, Fantazy.sh4.elf, 6244.1.00007ffd4134c000.00007ffd4136d000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: Fantazy.sh4.elf, 6244.1.00007ffd4134c000.00007ffd4136d000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.2Bkodn
Source: Fantazy.sh4.elf, 6244.1.00007ffd4134c000.00007ffd4136d000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.2Bkodn
Source: Fantazy.sh4.elf, 6236.1.000055cca2194000.000055cca21f7000.rw-.sdmp, Fantazy.sh4.elf, 6238.1.000055cca2194000.000055cca21f7000.rw-.sdmp, Fantazy.sh4.elf, 6239.1.000055cca2194000.000055cca21f7000.rw-.sdmp, Fantazy.sh4.elf, 6242.1.000055cca2194000.000055cca21f7000.rw-.sdmp, Fantazy.sh4.elf, 6244.1.000055cca2194000.000055cca21f7000.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: Fantazy.sh4.elf, 6236.1.000055cca2194000.000055cca21f7000.rw-.sdmp, Fantazy.sh4.elf, 6238.1.000055cca2194000.000055cca21f7000.rw-.sdmp, Fantazy.sh4.elf, 6239.1.000055cca2194000.000055cca21f7000.rw-.sdmp, Fantazy.sh4.elf, 6242.1.000055cca2194000.000055cca21f7000.rw-.sdmp, Fantazy.sh4.elf, 6244.1.000055cca2194000.000055cca21f7000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4
Source: kern.log.57.dr	Binary or memory string: Jan 23 04:27:51 galassia kernel: [ 475.396195] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6474)

Logged in records file read: /var/log/wtmp

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Fantazy.sh4.elf	56%	Virustotal		Browse
Fantazy.sh4.elf	61%	ReversingLabs	Linux.Trojan.Mirai
Fantazy.sh4.elf	100%	Avira	EXP/ELF.Gafgyt.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.57.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
12.121.131.71	unknown	United States	7018	ATT-INTERNET4US	false
70.124.134.15	unknown	United States	11427	TWC-11427-TEXASUS	false
189.178.88.170	unknown	Mexico	8151	UninetSAdeCVMX	false
142.171.116.17	unknown	Canada	7122	MTS-ASNCA	false
44.72.30.125	unknown	United States	7377	UCSDUS	false
45.185.187.137	unknown	Peru	269811	IMPORTACIONESYEXPORTACIONESCLKSACPE	false
35.207.83.232	unknown	United States	19527	GOOGLE-2US	false
120.228.86.55	unknown	China	56047	CMNET-HUNAN-APChinaMobilecommunicationscorporationCN	false
113.176.108.43	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
151.195.172.97	unknown	United States	122	UPMC-AS122US	false
4.25.223.150	unknown	United States	3356	LEVEL3US	false
40.3.204.232	unknown	United States	4249	LILLY-ASUS	false
96.119.94.112	unknown	United States	7922	COMCAST-7922US	false
63.198.120.198	unknown	United States	7018	ATT-INTERNET4US	false
2.64.113.134	unknown	Sweden	44034	HI3GSE	false
60.139.160.107	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
24.80.106.96	unknown	Canada	6327	SHAWCA	false
111.67.13.25	unknown	Australia	55803	DIGITALPACIFIC-AUDigitalPacificPtyLtdAustraliaAU	false
176.52.175.123	unknown	Spain	56924	SANTANDER-TELEPORTES	false
124.103.46.228	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
5.99.241.3	unknown	Italy	3269	ASN-IBSNAZIT	false
170.53.17.172	unknown	United States	54640	CONEHEALTHUS	false
112.236.120.36	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
203.138.2.255	unknown	Japan	2514	INFOSPHERENTTPCCommunicationsIncJP	false
166.224.135.139	unknown	United States	6614	USCC-ASNUS	false
216.138.40.63	unknown	United States	12033	ASN-AT-12033US	false
167.1.153.146	unknown	United States	15084	CONVERGYSUS	false
44.200.239.91	unknown	United States	14618	AMAZON-AESUS	false
14.155.65.71	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
68.130.9.15	unknown	United States	23148	TERRENAPUS	false
143.23.224.171	unknown	United States	11003	PANDGUS	false
198.119.204.227	unknown	United States	297	AS297US	false
23.192.105.15	unknown	United States	16625	AKAMAI-ASUS	false
197.30.88.199	unknown	Tunisia	37492	ORANGE-TN	false
135.41.207.120	unknown	United States	54614	CIKTELECOM-CABLECA	false
185.72.169.38	unknown	Belgium	57112	ASN-F2XNL	false
121.7.253.222	unknown	Singapore	9506	SINGTEL-FIBRESingtelFibreBroadbandSG	false
188.155.84.155	unknown	Switzerland	6730	SUNRISECH	false
166.200.187.201	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
14.23.184.201	unknown	China	58466	CT-GUANGZHOU-IDCCHINANETGuangdongprovincenetworkCN	false
210.32.119.106	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
96.162.238.122	unknown	United States	7922	COMCAST-7922US	false
71.169.206.148	unknown	United States	701	UUNETUS	false
187.226.24.24	unknown	Mexico	8151	UninetSAdeCVMX	false
136.251.221.106	unknown	United States	72	SCHLUMBERGER-ASUS	false
68.10.236.3	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
188.99.82.188	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
1.18.64.131	unknown	Korea Republic of	45996	GNJ-AS-KRDAOUTECHNOLOGYKR	false
163.23.134.155	unknown	Taiwan; Republic of China (ROC)	1659	ERX-TANET-ASN1TaiwanAcademicNetworkTANetInformationC	false
152.89.51.232	unknown	United Kingdom	5413	AS5413GB	false
65.43.247.228	unknown	United States	7018	ATT-INTERNET4US	false
175.48.251.113	unknown	China	134810	CMNET-JILIN-AS-APChinaMobileGroupJiLincommunicationsco	false
188.50.180.126	unknown	Saudi Arabia	25019	SAUDINETSTC-ASSA	false
110.131.88.199	unknown	Japan	9824	JTCL-JP-ASJupiterTelecommunicationCoLtdJP	false
42.145.241.45	unknown	Japan	9824	JTCL-JP-ASJupiterTelecommunicationCoLtdJP	false
46.235.118.233	unknown	Germany	51483	SASGCecinastr70DE	false
148.155.251.36	unknown	United States	18715	NYPAUS	false
223.40.49.45	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
99.102.15.235	unknown	United States	7018	ATT-INTERNET4US	false
135.32.57.170	unknown	United States	54614	CIKTELECOM-CABLECA	false
87.189.113.223	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
125.201.87.147	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
9.74.251.126	unknown	United States	3356	LEVEL3US	false
104.168.48.77	unknown	United States	36352	AS-COLOCROSSINGUS	false
37.215.202.99	unknown	Belarus	6697	BELPAK-ASBELPAKBY	false
184.200.49.125	unknown	United States	10507	SPCSUS	false
99.113.20.210	unknown	United States	7018	ATT-INTERNET4US	false
72.95.81.95	unknown	United States	12175	YELMNETUS	false
187.211.100.51	unknown	Mexico	8151	UninetSAdeCVMX	false
34.39.125.79	unknown	United States	2686	ATGS-MMD-ASUS	false
32.121.222.158	unknown	United States	7018	ATT-INTERNET4US	false
170.38.145.95	unknown	Malaysia	139776	PETRONAS-BHD-AS-APPetroliamNasionalBerhadMY	false
99.117.102.48	unknown	United States	7018	ATT-INTERNET4US	false
112.205.62.151	unknown	Philippines	9299	IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH	false
78.14.132.192	unknown	Italy	8612	TISCALI-IT	false
159.170.120.81	unknown	United Kingdom	28686	AVECTRIS-ASCH	false
169.101.175.240	unknown	United States	37611	AfrihostZA	false
45.24.139.149	unknown	United States	7018	ATT-INTERNET4US	false
41.221.123.174	unknown	unknown	36974	AFNET-ASCI	false
124.205.70.236	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
9.137.51.42	unknown	United States	3356	LEVEL3US	false
24.174.177.99	unknown	United States	11426	TWC-11426-CAROLINASUS	false
207.52.55.174	unknown	United States	1239	SPRINTLINKUS	false
181.90.210.91	unknown	Argentina	7303	TelecomArgentinaSAAR	false
45.10.226.129	unknown	France	29075	IELOIELOMainNetworkFR	false
160.188.163.147	unknown	Japan	36903	MT-MPLSMA	false
79.0.136.172	unknown	Italy	3269	ASN-IBSNAZIT	false
163.52.77.104	unknown	unknown	2516	KDDIKDDICORPORATIONJP	false
62.146.146.230	unknown	Germany	15598	QSC-AG-IPXDE	false
188.17.255.30	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
186.157.6.58	unknown	Argentina	11664	TechtelLMDSComunicacionesInteractivasSAAR	false
53.236.123.42	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
219.212.202.49	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
40.182.58.9	unknown	United States	4249	LILLY-ASUS	false
89.76.187.136	unknown	Poland	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
184.164.41.205	unknown	Canada	36493	295CA-TOR-ASNCA	false
54.25.22.132	unknown	United States	14618	AMAZON-AESUS	false
218.124.239.151	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
203.221.101.10	unknown	Australia	7545	TPG-INTERNET-APTPGTelecomLimitedAU	false
217.149.37.74	unknown	Netherlands	1239	SPRINTLINKUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
44.72.30.125	m475yPSqTk.elf	Get hash	malicious	Mirai	Browse
151.195.172.97	7yKvHvL7Jf.elf	Get hash	malicious	Mirai	Browse
151.195.172.97	HT7gBWexDX	Get hash	malicious	Mirai	Browse
2.64.113.134	33cWz2DNq2.elf	Get hash	malicious	Mirai	Browse
2.64.113.134	DWPsUbp6tU	Get hash	malicious	Mirai	Browse
113.176.108.43	QmqH6JQIZx.elf	Get hash	malicious	Unknown	Browse
113.176.108.43	7H1A4kavqO.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	Fantazy.mips.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	zte	Get hash	malicious	Unknown	Browse	162.213.35.24
	Fantazy.x86_64.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	sh4.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	debug.dbg.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	Fantazy.ppc.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATT-INTERNET4US	Fantazy.arm7.elf	Get hash	malicious	Mirai	Browse	206.171.189.10
	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	155.106.140.112
	Fantazy.i486.elf	Get hash	malicious	Unknown	Browse	75.14.106.188
	Fantazy.mips.elf	Get hash	malicious	Unknown	Browse	99.2.2.234
	zte	Get hash	malicious	Unknown	Browse	12.138.214.134
	jaws	Get hash	malicious	Unknown	Browse	12.49.33.12
	Fantazy.x86_64.elf	Get hash	malicious	Unknown	Browse	166.72.228.233
	Fantazy.i686.elf	Get hash	malicious	Unknown	Browse	99.50.104.171
	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	107.122.40.63
	Fantazy.ppc.elf	Get hash	malicious	Unknown	Browse	67.38.130.133
MTS-ASNCA	165224.exe	Get hash	malicious	FormBook	Browse	142.171.82.112
	elitebotnet.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	206.45.165.245
	6.elf	Get hash	malicious	Unknown	Browse	142.160.9.209
	miori.mips.elf	Get hash	malicious	Unknown	Browse	170.199.65.95
	botnet.spc.elf	Get hash	malicious	Mirai, Moobot	Browse	142.172.147.63
	vcimanagement.powerpc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.11.11.12
	vcimanagement.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.11.11.37
	vcimanagement.i686.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.11.11.43
	botx.mips.elf	Get hash	malicious	Mirai	Browse	170.199.78.117
	loligang.ppc.elf	Get hash	malicious	Mirai	Browse	142.174.125.8
UninetSAdeCVMX	Fantazy.arm7.elf	Get hash	malicious	Mirai	Browse	189.143.22.149
	Fantazy.i486.elf	Get hash	malicious	Unknown	Browse	201.126.162.195
	Fantazy.mips.elf	Get hash	malicious	Unknown	Browse	189.229.88.247
	zte	Get hash	malicious	Unknown	Browse	187.147.47.213
	Fantazy.i686.elf	Get hash	malicious	Unknown	Browse	201.106.102.201
	Fantazy.arm4.elf	Get hash	malicious	Unknown	Browse	187.150.212.8
	armv7l.elf	Get hash	malicious	Unknown	Browse	148.221.182.208
	armv6l.elf	Get hash	malicious	Unknown	Browse	187.206.41.240
	Fantazy.mips.elf	Get hash	malicious	Unknown	Browse	189.178.202.23
	Fantazy.x86.elf	Get hash	malicious	Unknown	Browse	189.255.191.20
TWC-11427-TEXASUS	Fantazy.arm4.elf	Get hash	malicious	Unknown	Browse	24.175.56.234
	armv4l.elf	Get hash	malicious	Unknown	Browse	50.84.252.120
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	76.85.61.88
	naarm7.elf	Get hash	malicious	Unknown	Browse	72.183.84.136
	154.213.189.141-arm-2025-01-21T03_19_06.elf	Get hash	malicious	Mirai, Moobot	Browse	69.22.53.135
	armv5l.elf	Get hash	malicious	Mirai	Browse	173.175.33.9
	arm.elf	Get hash	malicious	Mirai	Browse	98.156.54.250
	mpsl-wrt.elf	Get hash	malicious	Unknown	Browse	67.48.211.230
	arm5.elf	Get hash	malicious	Unknown	Browse	70.114.4.245
	arm7.elf	Get hash	malicious	Unknown	Browse	24.106.9.5

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	high, very likely benign file
Preview:	auto_null.monitor.

/proc/6501/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:r:r
MD5:	35574E260779030C85F82EF1AA707384
SHA1:	85D236550DD12D0BB84F12CACDB70338643BE8D5
SHA-256:	8C5716C1D2ABBF062A8995992D846C0ED8DF8FB13F3218123F1B019C97482E3A
SHA-512:	1D81CDF5BA0A214432D1E3D3DA1874069DC20202D881C10D736DBB898D774AFF8CCC97AD2BD21D8E0464D4C7FE534B1704B5A94822F8EE4002DA736729F13083
Malicious:	false
Reputation:	low
Preview:	6468.

/run/systemd/journal/streams/.#9:74744iXJAga

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.527245554687344
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm91wm8AMA+hg2js7LH:SbFuFyLVIg1BG+f+MYm8AB+22ji4s
MD5:	00420363EF7996C24A3DEDFF560FB078
SHA1:	AB29E6AFD99FB2D18A7B9A330D9A3FC699C20F65
SHA-256:	8EB0CDA4895E962714195B018385F8EC1B4DB63D15217D754549D2E0B6E1D690
SHA-512:	0749C4288E2CFBD6A7B8410B6C0EF7963ADBE9935E88B4E16CA0D8A6AC5379305E6B5A71CF8692FA2512C84E08F18EDC1B5666320E8DFFF3B245BE0C35360D7D
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=746bbe411b8b4b8eb9c2f5eb0474df09.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:75139OI6iy9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.5445473060322925
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6a69URRKkXUnKmsZ+:SbFuFyLVIg1BG+f+M6a69URYLKbZji4s
MD5:	8D0737FEBF0151D6033CF0AA38F02D82
SHA1:	43BC664E84CEAAA3DDF3DEF4465B6BC44A122E21
SHA-256:	ECD10E2228C2CA8C6E1432B69DEF39E9B73CB37BABA84A9B883740A438E28D8A
SHA-512:	81AF5F2001F8D9D9AA5E563F192481C1591B53A082A4E8C4ECCD296185E5978AE9FC2F1C6C32A0F1D8E84C63D22BF5A3D6243B2FE610F4737BC46F6CDC236B81
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=01f0523b78144c87b8214da028537657.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:757229T9AXb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.394175157538649
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9DzBURxHQPwXwsjsV:SbFuFyLVIg1BG+f+MkiP+jLkGq
MD5:	6990D92C4CF2A021EDDD42AC3C8E3EE1
SHA1:	9585A55BF5208D7C47AB885F6E2659EA4B2C00F5
SHA-256:	BFFE21B4349C6D8CCC0B793DC27DBB7502E0B53A43FB24F3B8275A24E7CE7E23
SHA-512:	1D66A7D919C495A02C90C9B8F63010B5E57320669FBC6899D65EF877E67BA72B54CE359E9E0BE7754259E93435AC0B076AA761C8FA055E153D3DF801E6FE832C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7262343246d14feeb935730bb796ae00.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:762911Y2ppa

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.425186321900642
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+x02gVfc1FCvATjsc:SbFuFyLVIg1BG+f+M+wVf3YTjosQu
MD5:	D48A6A9663AA84029F48EB82FC0E0AA7
SHA1:	2DED0C9AFB48BED2ED947439B461E8CF12429147
SHA-256:	E4DFFEC024734746F2AEB4CACF068244820D164DA154F91EBD7B12EFB5B0F353
SHA-512:	4E2342EFC7103B136413C66EBE36554C1CF7431CD6B686DD933E29E23FCA97342861881F4D4055AB1140E5C91C559D77586D55674EE0752942E9262B2C4B1257
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4d5c4569891940669e58759253b0539e.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76306tQNED8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.384156633312175
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvndGSERk/JLxsjsmM:SbFuFyLVIg1BG+f+MfAi/9qjdCLKzK
MD5:	EB2A0DCDE382526BB5D09AB2F63254F0
SHA1:	D72EE31B8B88639F4EF94DB07D1132F3F93BE38E
SHA-256:	2FBEC22699729AED82FA36FC38D2290F863FF6A8FC1906111474216A6554A639
SHA-512:	E7438F38D2A5D283483A172461F23B31C7CE09EA1CB9753A61857F7F4313CAFDB7BB523F5BAAD1CB66FB834E9C66CBCF94BB14DC658094F1C51755FD43F8E4BA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=edc788a4c2a84e59a576313b59af8cac.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:76319hGNzp8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.337010607564901
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpsEyyU6pVGYSh+sjt:SbFuFyLVIg1BG+f+MGyZGxTjtWL0
MD5:	7CE5DF03CF280E59561E699508DE0D13
SHA1:	DBB889B273C7F982D1352CB23F6996210E5735E5
SHA-256:	8377D08312EEB31180F2A06CD6BA276E53B7B6E96A23CAE8BB3A44D19296B231
SHA-512:	F38A5805A90AD98B02CD160A3505CBA9BC1C16F1D963940533B9F9A8F86128DA146CC73C46A0359A552EBBED02061A0AC56EC9C1C7C95C8BF22496F894EB070B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c5480ab74113439bb013be2a08afa76a.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:76581S3hQJb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.3952581455940045
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuRN11cOv2S6j8jsjF:SbFuFyLVIg1BG+f+MuRN1Xv2SBjNE
MD5:	1AD391D16BC70A880858ED9313291404
SHA1:	94AE76F1E849822F23923DC83AA5527016C64470
SHA-256:	A089BE0927689B6C9DA7D45388FEB5DF2C8FBFABE3CEC19C7CE2FC1D2C644A42
SHA-512:	24B734C35E85DB7625BB17D16EB18AB257A3E5213DAAB3D5113FE23764AF31A2AEAAF093D88565BA2BA721D8E7AF393F44C505B90C9BB68DB314D78DF34BA534
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d9e26d46e5974c4da7937c27d02d5d46.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:76585E6diH7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.448488235877065
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm75vS3uHWncDcKshTi:SbFuFyLVIg1BG+f+MIvaChTjZcHcljX+
MD5:	14483197B6D3D46B03D5C0ABAE4E53CA
SHA1:	8139A509194A861706985DD2452358D51DEAFC96
SHA-256:	2BA5C5220212644E291DFBE7FDCB9E0B6AC9EFB1B07F6257100211CBC6F92D96
SHA-512:	3A84C70135C770BF6004EF6F5786EF942EA282ADC12D6F60B5E25C192BB40531637CCD21A96657B8E27F746C82F9B7DE22343C73C708FA5AD14608BFFF5815F8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1c650fd7efea45cb9c1a032ddfe4cc9e.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:76700recw39

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.404583101827918
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoSsDGUhvYuqjshKJg:SbFuFyLVIg1BG+f+MorDGUhv5qjbVC
MD5:	4DCE2248957CF09DA9D97148E69D0EB1
SHA1:	1F7DB79DDFB24ACE47673F169C24A79FBA6D1DBA
SHA-256:	03C17B28F7B3C5430362474AF75C52A7A7C93ED0E63504A83DDB527747C2D101
SHA-512:	F79E35EDB91589EE07F37C12F0DBE642E6FE02D2528139CEAC85374AADA274817CF82ED8CD29A4AAB190ED8874C299B241576D71F37E30187AD662357341FC0C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b5998b3e59ac41ccb58187e853e7f4c9.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:76942Dmbjcb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.47035647448189
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M2kOwhFjdCt/rRMtq:qgFq6g10+f+MZOwpCDL
MD5:	4A7605AA695A0AF239BDD0F6B2F0B026
SHA1:	81C417C3F4739996F18F1695C4DBD3C26A77BE5A
SHA-256:	241DE6E42EC3820E45E3C80B6F63F7AD40530E330A553AA7BBC1AB353E55B423
SHA-512:	8B97472669483A19C5FD800E1AA89EC0CBE550852CE4C0807D2843E1AD99EEECEBF2BFB0FD2BD859480D16DAAB1783E412B62FC8492FB57223635CF3E7FD7762
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a63b926725224a77a4f164b62c8b8a31.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:76945k6DV8a

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.42325136516109
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm9cMSbTcBlRkDVjs2ALl:SbFuFyLVIg1BAf+MiT30IjNALyAZD
MD5:	194F6C4075EBDFF3B3910AF8A4E20DCC
SHA1:	DA529650D83014AD4143B878F7F417F319CE131A
SHA-256:	D689E769FDB548E242CD3EECF250AC9CCD9417C35FA66C550BBB7DBBEFC9B4EB
SHA-512:	DEE463E6FBBFFAE2BE98283786F1186EC0E3D3B0AD88255172B74CDC79ED92E8B1C99351089778462E80DBA3747512A0C8AB67B8E0B12610D33BE121804C8366
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7d4dc1e822974498b969da1b4ed068ed.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77119AGNSn8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.492529579679603
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmyxdlfXMlWF2js2BbQIa:SbFuFyLVIg1BAf+MyxUHjNdQIeXD
MD5:	83E7B0C995B04C7DD7705CF767EA59F7
SHA1:	0354B5FE5AC1F337D96912AF8FFD9E0021EECD47
SHA-256:	62DE888EF626B96AB60B797257A8EA376DFC817FF3ACA266691636A9DAC228AB
SHA-512:	8C43621CB961567354C3FC9639996C879E8243C0B3D479D05BE84EDFBC0F1E26F44AF7139EC40D7CBF2CF6F7AD7BACF3824315A1B66AA1856A948ECDB7246968
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=89dc88b7b8ba4763909d354ea584f254.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77190HM5qOa

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.440680428961022
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmzXJesWEN2js2BZZGu:SbFuFyLVIg1BAf+M8LEN2jNTZD
MD5:	49A4DCD1E1B7934281081CBFDC02E1C4
SHA1:	1B9CEA54E5ECCB3239189BFE0421A8A7BAA457F1
SHA-256:	A1BB6B72296357AECE554F7BC07A4F211CF8EAE0EB2A086B15C607A6265449D7
SHA-512:	C20E04D4D4F18478F61AB9745BB60E5B82F16AAAB52876DD24586C4E804838B4F154F5D72B4EAE4273EAA25B3A114ED935306EB9B10F10083EBD8F96BDCEC012
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=92b9f0c7cd6749b4859a655dd4a5852f.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77306GoC9Nb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.443880251456318
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M6r8QuVdMqjLTTIWTIL:qgFq6g10+f+MrhEWEL
MD5:	CE7B94AA4C3CE61271D3CEBB57BD3DB0
SHA1:	7A536F6ADA5F8766AA3448A0F1971746083225A7
SHA-256:	BAE05D957697215C1DCF250FAF715639FF1F913AD96CDB0EF17F301CB6A65582
SHA-512:	AF61CD4B976DA37063985220ACE41B3A1595E9427E974FAA1305A0EFC94F57E3C6B5732ECB24BF78BF307C9D63805B946F7089311007C9555A5F2E785D9231A5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=70d88c278d41425b92e1f95b858d0bda.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:77357FQ9Y4b

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.393823822229638
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm65A1THDi2uHyHsQ:SbFuFyLVK6g7/+BG+f+M68LDiLHyMjNq
MD5:	537C3527CD13A5AE63AD18A6D15B270A
SHA1:	6E1CCCD9F41F6055C1E257CFACF9E5E5536F2336
SHA-256:	5AD76B31501961BFD844C97D998904AB43DF12E34B463FFDFFD6F89337EF48D8
SHA-512:	CF1E3AF0F52A189C77CBB492533345A9E0E7120A5D37A437E63F98065EAAFD3B0BFCE4EEBCD823731CB0EA9FF338DA354D593D0A3B509E982CEF0A6EF04EE827
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0a5e466bf7dd4458ba4bb7de4cf1ab31.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:77358zahzU7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.369439783757005
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm62BQGUT1jWwycXb:SbFuFyLVI6g7/+BG+f+M62mxW1HjNq
MD5:	3BEB65C7D4B309424EFB0EE02BE13225
SHA1:	036B17B72909BC6BBA4754EA65689EAF7E0C9F12
SHA-256:	BC45E1518B1868E5F693C2847190E5DCC5D16F8443A133CC075B03813DB0E927
SHA-512:	EEF511A881785E610863EA353D974B37E07C8DCC508732E4F4A6AAB64FE094368BE40483FA124A4927E494DBBCDDF8888E4B8E4B279642247002B88CE8157225
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=065b494a5c1646e6a34b25b599d5eb6a.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:77395q23IVa

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4678750537138665
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MVL0sTjFQMzKaBu:qgFqo6g7/+0+f+MVL9NTmh
MD5:	38FD0CFB1EB721F4FBF6B1BE13F6B260
SHA1:	F1ABA724F50BE751E6EBBADDA7A587797B6AA7A8
SHA-256:	846166487D1A6FB1E8C663BACB96AF6164507CFB826B0CE348CBD43913B80C40
SHA-512:	8B859B1B976CB4338F5493D60A02DB4014B0AD0B3BEB0A9295F5F2232723B351C391A1440F1762761ABDB3598F96D4371057A8235B0D1F4ADF43158F61721D77
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=afeeff4ed1e44543a7e20ac7d9e4343b.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:77401uwiyV9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4537923755946185
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M+hTUHAf92jFQMzKaBu:qgFqdg7/+0+f+MwU+uTmh
MD5:	F5CE18DE5787BB197A74505A87229D23
SHA1:	BA75B1F5319BB812051DF1AFB35357532D11E7A5
SHA-256:	2B2BCEC67CDB88984C8B4516E3EC24374014B5AAEE928A9409F95165EEBCE24C
SHA-512:	36E6E9F4881040A62C1AE707FF2A8C50673636992CBA19BEF314F4F45C848556BDA1322AC5131FF2D7117155FEFA2AC4A29602C78B412F56259F0679612C0D6B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=44a9e9ffde9944ed8aaba2dc9aac3162.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:78349i8vIL7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.352281128021801
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/4aURDdKGuxsjs1Ha:SbFuFyLVIg1BG+f+MQTDUGuqjoa
MD5:	238611AF4C8E7603E1410B671840B032
SHA1:	99BB60B1B351E6D76BE60DA091A41332362AE620
SHA-256:	AC1A8DB58A55F249CA234E18CDBBA8C87792FAE8AD72BF7ED7506E96A6A93D37
SHA-512:	4B87A1C615C708BEE33F472503C31BBA7A5575165440D946C0B38C9215720D5DD70D5EE30C9504DAABB23062DEEFE9ECF24627A71C556C8340970128D337CDC2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5a49064373e045b6826816683659aeba.IDENTIFIER=dbus-daemon.

/run/systemd/seats/.#seat00DWBem

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0HAoGum

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/users/.#1273GUC0j

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.4727728852433115
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff68CgtRwLit6oWSU:qgFq30dABibBAgkeIL5
MD5:	F41C23DF25207E826700D0218B2EBE3C
SHA1:	E066553F676B253D62C67DC6C4CA46B08F2298AB
SHA-256:	2C1C1AEC6308CE717DB3FB0A7ACF95CB034101B8B6BFC1314738614434879B3F
SHA-512:	26814067297EB67279BA1604B52E0EF8528A92DF4F20BBE3C9D0F76ADBE9444CF2D4D630752377CB165CAAF17DCBAF5E20CA52CB0D2041A3E5CB8B8639186095
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12349.REALTIME=1737628069387374.MONOTONIC=473279198.LAST_SESSION_TIMESTAMP=473437205.

/run/systemd/users/.#1273J02aj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.31359419851982
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgCORw54mbi206qodOWSXV6:SbFuFyL3BVgdL87iesnAiRJgtRwLit6V
MD5:	771D64CDF9A1379A70C9AE6AFC308076
SHA1:	1289A1FCF445E135ED8C4CF076B557E2D0B5181F
SHA-256:	60F1C84C8C095D4E11395A73292CA7194A27E8C953E051F7F8860DCDF2E0836E
SHA-512:	5FEB451647D3E58DA6DEB47EE86747EF6DB5CF3EC136CA007FBF8F6849AE9AD4E1949B4950DC3FBA719472AE24E47F87CE8CF7FF0C80A20641E7BE8188927CB3
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1737628069387374.MONOTONIC=473279198.LAST_SESSION_TIMESTAMP=473437205.

/run/systemd/users/.#127LGATmm

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.29506734309561
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6NEJgtRwJf2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEEJgkJethQHtPYq9M
MD5:	0F225FB2D9D8A47E7474A874ACCC76C2
SHA1:	03FC25B15DAF86CB7ECC51569F28AFB5CDC915B5
SHA-256:	08AA2D546FA2A4FF581D1F413FD4D3A4AA27D23ABFFF1CE45B0C4F8181E9CF14
SHA-512:	7A8CDD2FFB87A662EF81E62F28FA31F3F9F3C5978A96A3645D7E623AD30A5CA8E2B19173A9AB72BF2B5BA2FAD8B367955D8923A2B4B3C2E072464D5A293AAA15
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12287.REALTIME=1737628069387374.MONOTONIC=473279198.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127RFFRKl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127RT92il

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.29506734309561
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6NEJgtRwJf2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEEJgkJethQHtPYq9M
MD5:	0F225FB2D9D8A47E7474A874ACCC76C2
SHA1:	03FC25B15DAF86CB7ECC51569F28AFB5CDC915B5
SHA-256:	08AA2D546FA2A4FF581D1F413FD4D3A4AA27D23ABFFF1CE45B0C4F8181E9CF14
SHA-512:	7A8CDD2FFB87A662EF81E62F28FA31F3F9F3C5978A96A3645D7E623AD30A5CA8E2B19173A9AB72BF2B5BA2FAD8B367955D8923A2B4B3C2E072464D5A293AAA15
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12287.REALTIME=1737628069387374.MONOTONIC=473279198.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127vrBoXk

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.4727728852433115
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff68CgtRwLit6oWSU:qgFq30dABibBAgkeIL5
MD5:	F41C23DF25207E826700D0218B2EBE3C
SHA1:	E066553F676B253D62C67DC6C4CA46B08F2298AB
SHA-256:	2C1C1AEC6308CE717DB3FB0A7ACF95CB034101B8B6BFC1314738614434879B3F
SHA-512:	26814067297EB67279BA1604B52E0EF8528A92DF4F20BBE3C9D0F76ADBE9444CF2D4D630752377CB165CAAF17DCBAF5E20CA52CB0D2041A3E5CB8B8639186095
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12349.REALTIME=1737628069387374.MONOTONIC=473279198.LAST_SESSION_TIMESTAMP=473437205.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:bcn:I
MD5:	244E485DDD8E9ED5DBEAFC3F3A4C8028
SHA1:	8C1DC2E88C2328CAC6DE4761B0DADAD94EDBAE98
SHA-256:	BF8368931E2D39E29BE0FF4FC154DD4905E37A441457F788C0672412FD1F4E19
SHA-512:	D98B8AF5FFEF504EA7DBE4F0A8E1B5A0062A42A8FDF69F645AF77FD0F2E6B4C566CAF823A967E5978CA4479AA494FD9719C516E88C8AB6DF65EDAD16D18FCD69
Malicious:	false
Preview:	6357.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6651209938982575
Encrypted:	false
SSDEEP:	3:9lc1sXlXEWtl/Q3i2:9lv+yl+
MD5:	A7694C90D48DDA662A64673D86DA78B7
SHA1:	B850CFF1BCB90B48436FB8CA45369F0B1A4BFE71
SHA-256:	F2F9135244E4F675F0A75452FFB8666156700925731555F000E036D920A73651
SHA-512:	8A586F16D1799B1C55E00A2525EE261D6996773D3B80A88F660F91D809D7D245989C944B84B42E049D4F51087DE4E5BA277CF06B4FC6F541A93A2FA23F498FF9
Malicious:	false
Preview:	....!...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................!......g.\......................................

/tmp/qemu-open.2Bkodn (deleted)

Download File

Process:	/tmp/Fantazy.sh4.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	3.5796258815476407
Encrypted:	false
SSDEEP:	6:URN3dDF6EcSSmb/VUMVbsDF6EcSNj/VWL/VDM/V+4D/VH:IldN4JUbENLeMfF
MD5:	3D3E41982A63F45B2BF1E00F60115FF7
SHA1:	D47EFB716D1DE305EA6D99E88117D14B99A7324D
SHA-256:	4E9673EF0B43B0B677339B63EA341AA222BABA79783936F690122B6C9DE39E52
SHA-512:	BBBE546929D3780D4FF0E78DB467559B94BC5AC96C5A6B33187B96DFFC679234EC4EBE9BA65E04B0411326088DDFE484E80F377C241B9B028C0A06BE778D6004
Malicious:	false
Preview:	400000-411000 r-xp 00000000 fd:00 531606 /tmp/Fantazy.sh4.elf.421000-422000 rw-p 00011000 fd:00 531606 /tmp/Fantazy.sh4.elf.422000-423000 rw-p 00000000 00:00 0 .423000-425000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/var/lib/AccountsService/users/gdm.U39802

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	678
Entropy (8bit):	4.827921913924069
Encrypted:	false
SSDEEP:	12:YAEF0hLadUEFET4p1Wr4eEF0nCLGaWr4IdRF0hLajO8mWFCTFX54TzfbZUQU:Z0pYr4GJr4/4TrCQU
MD5:	8E91B22D57F78CD497250558015C42B2
SHA1:	C8C26C58283C2CE00370A5460E11930C2BFBF168
SHA-256:	0F097054C0598A3DB551081977A62265232D1B6F34E930F4DF730B6319294A3C
SHA-512:	9FBFF3FDE63799CC366DED2E255468A56C2AC1BE4BC172196BB370A716257AE55D4617FF5A8EA47599B2E86A0E0146B5CF657D8554C2A982170EBAE5853F8B93
Malicious:	false
Preview:	Jan 23 04:27:49 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Jan 23 04:27:49 galassia systemd-logind[6363]: Failed to start session scope session-c1.scope: Unit session-c1.scope already exists..Jan 23 04:27:49 galassia gdm-launch-environment]: pam_systemd(gdm-launch-environment:session): Failed to create session: Unit session-c1.scope already exists..Jan 23 04:27:51 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session closed for user gdm.Jan 23 04:27:53 galassia dbus-daemon[6350]: [system] Failed to activate service 'org.bluez': timed out (service_start_timeout=25000ms).

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31Hleij2/tZ5b+ij2/tZ5b/:F3Rktk
MD5:	6DDCFBA280B85031259311C61FF93AFB
SHA1:	A5C7712F117D67826B235C1D33E5E9C672933D4A
SHA-256:	9CC2C4517493A345BF6508BD527C1E44D2C0EB62A004855294EDFD24608C82CC
SHA-512:	14D770D547EFF0619A11EAE078C841186BF0FFC86FE2482934595242EF7A61CCC3657A787A38D74F84D66B12B31555521CEBDF5D77BF052A1015880EF95501DA
Malicious:	false
Preview:	LPKSHHRH................/.j..GFq......Y................................./.j..GFq......Y.........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.448047321524811
Encrypted:	false
SSDEEP:	3:F31Hl7aSjH/lzaSjNX:F3raSL/FaS
MD5:	083E793FC3A172D3625FE20544FBA555
SHA1:	A703486706A48FE0F95E3DF0FCD5F478EC633990
SHA-256:	03E72052125B1E03DF9E5522903B70C795904FC50B12CA3A1EC32CBE6F357BF4
SHA-512:	C448558E9AED38415F6CF7D3B5CFD764882135FAA889FDA15390F0D66ED0F1CB2789E81B74ED4DD76EDB541C5BB0D8A9313E7DEA9833E6692C16262133A25188
Malicious:	false
Preview:	LPKSHHRH.................@a+v}K..)..wFu..................................@a+v}K..)..wFu.........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	CSV text
Category:	dropped
Size (bytes):	10642
Entropy (8bit):	4.989965785891592
Encrypted:	false
SSDEEP:	96:F0tdB6geq1jKv9IHX0u9rMsWIS5WOr8M8OrhYc6xvMPQC0OSw:2dBhJs9k9rMcUr8mPP
MD5:	6F815B446D1E5B0C3B4E2668996FCBB2
SHA1:	09D1BAA0575E2D0E0CB9EB3B48B2B72286796AE1
SHA-256:	5BBB393D32C1CF09B790A929DFB4C5675B9E7C1ACDEFFE2814A59C352ECBD8C8
SHA-512:	116681094D4A9221E32C449F5CBABC83F020B2BEF0821AA9179B0EDC373DDA7BD1C06F1ACD2A38B665CE6D21AF07AD9B5C16A8BD64A5B489E81B132726114E8D
Malicious:	false
Preview:	Jan 23 04:27:26 galassia kernel: [ 448.681836] New task spawned: old: (tgid 6434, tid 6434), new (tgid: 6435, tid: 6435).Jan 23 04:27:26 galassia kernel: [ 448.928985] New task spawned: old: (tgid 6430, tid 6430), new (tgid: 6438, tid: 6438).Jan 23 04:27:26 galassia kernel: [ 448.984884] New task spawned: old: (tgid 6438, tid 6438), new (tgid: 6439, tid: 6439).Jan 23 04:27:26 galassia kernel: [ 449.769466] New task spawned: old: (tgid 6430, tid 6430), new (tgid: 6441, tid: 6441).Jan 23 04:27:26 galassia kernel: [ 450.016238] New task spawned: old: (tgid 6441, tid 6441), new (tgid: 6442, tid: 6442).Jan 23 04:27:26 galassia kernel: [ 450.385369] New task spawned: old: (tgid 6430, tid 6430), new (tgid: 6443, tid: 6443).Jan 23 04:27:26 galassia kernel: [ 450.424581] New task spawned: old: (tgid 6440, tid 6440), new (tgid: 6440, tid: 6444).Jan 23 04:27:26 galassia kernel: [ 450.424809] New task spawned: old: (tgid 6440, tid 6440), new (tgid: 6440, tid: 6445).Jan 23 04:27:26 galassia

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	31807
Entropy (8bit):	5.059337787576317
Encrypted:	false
SSDEEP:	768:Xt4Z9TcsoGcesYqvZt/Q/LldnqeQ05VLmMAemOaYH7vtlj/BQWq0qQs2ClZDT1Zf:PYW
MD5:	D7722924F96B194AA6ED9B68226E1A7D
SHA1:	FC7ADD1E56EF97A8153CF9118759B1AE8ABA75D2
SHA-256:	055C7802AC57C6A5C47A87379BEE9C8EA8B21EA667791628F0DA12C2BE7CCCE5
SHA-512:	E3D3EC735AA3882FB5CC55708F166F7850698DBBB411E15281E70ABE41D1790BD4F97A7EA22BEED47D1403D9EA5EA66ABCA339D8C5FF778238F5FF34ABE71E8E
Malicious:	false
Preview:	Jan 23 04:27:25 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Jan 23 04:27:26 galassia kernel: [ 448.681836] New task spawned: old: (tgid 6434, tid 6434), new (tgid: 6435, tid: 6435).Jan 23 04:27:25 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Jan 23 04:27:25 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 1..Jan 23 04:27:26 galassia kernel: [ 448.928985] New task spawned: old: (tgid 6430, tid 6430), new (tgid: 6438, tid: 6438).Jan 23 04:27:26 galassia kernel: [ 448.984884] New task spawned: old: (tgid 6438, tid 6438), new (tgid: 6439, tid: 6439).Jan 23 04:27:25 galassia systemd[1]: Stopped System Logging Service..Jan 23 04:27:26 galassia kernel: [ 449.769466] New task spawned: old: (tgid 6430, tid 6430), new (tgid: 6441, tid: 6441).Jan 23 04:27:26 galassia kernel: [ 450.016238] New task spawned: old: (tgid 6441, tid 6441), new (tgid: 6442, tid: 6442).Jan 23 04:27:26 galassia kernel: [

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6651209938982575
Encrypted:	false
SSDEEP:	3:9lc1sXlXEWtl/Q3i2:9lv+yl+
MD5:	A7694C90D48DDA662A64673D86DA78B7
SHA1:	B850CFF1BCB90B48436FB8CA45369F0B1A4BFE71
SHA-256:	F2F9135244E4F675F0A75452FFB8666156700925731555F000E036D920A73651
SHA-512:	8A586F16D1799B1C55E00A2525EE261D6996773D3B80A88F660F91D809D7D245989C944B84B42E049D4F51087DE4E5BA277CF06B4FC6F541A93A2FA23F498FF9
Malicious:	true
Preview:	....!...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................!......g.\......................................

Source: Fantazy.sh4.elf	Virustotal: Detection: 55%			Perma Link
Source: Fantazy.sh4.elf	ReversingLabs: Detection: 60%

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.705882660197087
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Fantazy.sh4.elf
File size:	70'648 bytes
MD5:	af980b8d1e28eb0db206272ebf53e681
SHA1:	9a510ec64649e570cff28d92e0c6f20926add1f9
SHA256:	cdad489cf13fef6968275cad1ea866ecb5b8132f15fa9b718fc59a538c0ce04a
SHA512:	afc3f8fc667fefcf347976e201220e7e96288f6092709c5f4ab101669e875db1d9e8f2e70f9b0e267259cac9c717c764b79a1dfd15ae209a9c80f3864a231d52
SSDEEP:	1536:o/sbV5a6wtab2im7sMxGmJecRFd3sDZFZbC3Ry:okbvZb2pIMecRSZFZbey
TLSH:	C7637C75D5B8ACA0C044CAB176A889B44707A80596F77EF2CBC18F65480BAFCF1497F6
File Content Preview:	.ELF.....................@.4...h.......4. ...(...............@...@.T...T.....................B...B.(...............Q.td............................././"O.n........#.@........#.*@.....o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	70248
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x30	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0xf6c0	0x0	0x6	AX	32
.fini	PROGBITS	0x40f7a0	0xf7a0	0x24	0x0	0x6	AX	4
.rodata	PROGBITS	0x40f7c4	0xf7c4	0x1290	0x0	0x2	A	4
.ctors	PROGBITS	0x421000	0x11000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x421008	0x11008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x421014	0x11014	0x214	0x0	0x3	WA	4
.bss	NOBITS	0x421228	0x11228	0x558	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x11228	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x10a54	0x10a54	6.8192	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x11000	0x421000	0x421000	0x228	0x780	3.0027	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 23, 2025 11:27:23.786607981 CET	192.168.2.23	1.1.1.1	0xa06f	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 23, 2025 11:27:23.786665916 CET	192.168.2.23	1.1.1.1	0x3972	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Jan 23, 2025 11:27:24.110385895 CET	192.168.2.23	1.1.1.1	0xe1ca	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 23, 2025 11:27:23.795408964 CET	1.1.1.1	192.168.2.23	0xa06f	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Jan 23, 2025 11:27:23.795408964 CET	1.1.1.1	192.168.2.23	0xa06f	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2025-01-23 10:27:30 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2025-01-23 10:27:30 UTC	25	IN	HTTP/1.1 100 Continue
2025-01-23 10:27:30 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2025-01-23 10:27:30 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2025-01-23 10:27:30 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2025-01-23 10:27:30 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2025-01-23 10:27:30 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2025-01-23 10:27:30 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2025-01-23 10:27:30 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2025-01-23 10:27:30 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2025-01-23 10:27:30 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2025-01-23 10:27:30 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2025-01-23 10:27:30 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Jan 2025 10:27:30 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	10:26:54
Start date (UTC):	23/01/2025
Path:	/tmp/Fantazy.sh4.elf
Arguments:	/tmp/Fantazy.sh4.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	10:27:01
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	10:27:02
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	10:27:04
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	10:27:21
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	10:27:22
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	10:27:23
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	10:27:24
Start date (UTC):	23/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	10:27:25
Start date (UTC):	23/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	10:27:26
Start date (UTC):	23/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	10:27:27
Start date (UTC):	23/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	10:27:28
Start date (UTC):	23/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Fantazy.sh4.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6501/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:74744iXJAga

/run/systemd/journal/streams/.#9:75139OI6iy9

/run/systemd/journal/streams/.#9:757229T9AXb

/run/systemd/journal/streams/.#9:762911Y2ppa

/run/systemd/journal/streams/.#9:76306tQNED8

/run/systemd/journal/streams/.#9:76319hGNzp8

/run/systemd/journal/streams/.#9:76581S3hQJb

/run/systemd/journal/streams/.#9:76585E6diH7

/run/systemd/journal/streams/.#9:76700recw39

/run/systemd/journal/streams/.#9:76942Dmbjcb

/run/systemd/journal/streams/.#9:76945k6DV8a

/run/systemd/journal/streams/.#9:77119AGNSn8

/run/systemd/journal/streams/.#9:77190HM5qOa

/run/systemd/journal/streams/.#9:77306GoC9Nb

/run/systemd/journal/streams/.#9:77357FQ9Y4b

/run/systemd/journal/streams/.#9:77358zahzU7

/run/systemd/journal/streams/.#9:77395q23IVa

/run/systemd/journal/streams/.#9:77401uwiyV9

/run/systemd/journal/streams/.#9:78349i8vIL7

/run/systemd/seats/.#seat00DWBem

/run/systemd/seats/.#seat0HAoGum

/run/systemd/users/.#1273GUC0j

/run/systemd/users/.#1273J02aj

/run/systemd/users/.#127LGATmm

/run/systemd/users/.#127RFFRKl

/run/systemd/users/.#127RT92il

/run/systemd/users/.#127vrBoXk

/run/user/1000/pulse/pid

Linux Analysis Report
Fantazy.sh4.elf

Start time (UTC):	10:27:29
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	10:27:31
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	10:27:34
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	10:27:45
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	10:27:47
Start date (UTC):	23/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	10:27:49
Start date (UTC):	23/01/2025
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	10:27:50
Start date (UTC):	23/01/2025
Path:	/usr/lib/gdm3/gdm-wayland-session
Arguments:	-
File size:	76368 bytes
MD5 hash:	d3def63cf1e83f7fb8a0f13b1744ff7c

Start time (UTC):	10:27:51
Start date (UTC):	23/01/2025
Path:	/usr/lib/gdm3/gdm-wayland-session
Arguments:	-
File size:	76368 bytes
MD5 hash:	d3def63cf1e83f7fb8a0f13b1744ff7c

Start time (UTC):	10:27:52
Start date (UTC):	23/01/2025
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	10:27:46
Start date (UTC):	23/01/2025
Path:	/usr/share/language-tools/language-options
Arguments:	-
File size:	3478464 bytes
MD5 hash:	16a21f464119ea7fad1d3660de963637