Create Interactive Tour

Linux Analysis Report
Fantazy.mpsl.elf

Overview

General Information

Sample name:	Fantazy.mpsl.elf
Analysis ID:	1597682
MD5:	93bcc3581458be3a436b3eab7d847118
SHA1:	32641233c5ca0a5be22c578df7b8915194020ae4
SHA256:	b466b109c9ce9819e1f6ea5f68f7a75ffa5278ad031c61e72a077171cdf9ee92
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1597682
Start date and time:	2025-01-23 15:56:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Fantazy.mpsl.elf
Detection:	MAL
Classification:	mal68.spre.troj.linELF@0/42@3/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing network information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/Fantazy.mpsl.elf
PID:	6218
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	VegaSec-KATANA001
Standard Error:

Process Tree

system is lnxubuntu20

Fantazy.mpsl.elf (PID: 6218, Parent: 6139, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/Fantazy.mpsl.elf

Fantazy.mpsl.elf New Fork (PID: 6220, Parent: 6218)

Fantazy.mpsl.elf New Fork (PID: 6222, Parent: 6218)

Fantazy.mpsl.elf New Fork (PID: 6224, Parent: 6222)

Fantazy.mpsl.elf New Fork (PID: 6226, Parent: 6222)

Fantazy.mpsl.elf New Fork (PID: 6229, Parent: 6222)

systemd New Fork (PID: 6236, Parent: 1)

journalctl (PID: 6236, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6254, Parent: 1)

systemd-journald (PID: 6254, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6258, Parent: 1)

journalctl (PID: 6258, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6308, Parent: 1)

dbus-daemon (PID: 6308, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6322, Parent: 1860)

pulseaudio (PID: 6322, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6327, Parent: 1)

systemd-logind (PID: 6327, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6386, Parent: 1)

rtkit-daemon (PID: 6386, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6390, Parent: 1)

rsyslogd (PID: 6390, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6393, Parent: 1)

polkitd (PID: 6393, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

gdm3 New Fork (PID: 6397, Parent: 1320)

Default (PID: 6397, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6402, Parent: 1320)

Default (PID: 6402, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6403, Parent: 1320)

Default (PID: 6403, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6404, Parent: 1)

agetty (PID: 6404, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6405, Parent: 1)

gpu-manager (PID: 6405, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6406, Parent: 6405)

sh (PID: 6406, Parent: 6405, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6407, Parent: 6406)

grep (PID: 6407, Parent: 6406, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6408, Parent: 6405)

sh (PID: 6408, Parent: 6405, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6409, Parent: 6408)

grep (PID: 6409, Parent: 6408, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6412, Parent: 6405)

sh (PID: 6412, Parent: 6405, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6413, Parent: 6412)

grep (PID: 6413, Parent: 6412, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6414, Parent: 6405)

sh (PID: 6414, Parent: 6405, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6415, Parent: 6414)

grep (PID: 6415, Parent: 6414, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6416, Parent: 6405)

sh (PID: 6416, Parent: 6405, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6417, Parent: 6416)

grep (PID: 6417, Parent: 6416, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6418, Parent: 6405)

sh (PID: 6418, Parent: 6405, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6419, Parent: 6418)

grep (PID: 6419, Parent: 6418, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6420, Parent: 6405)

sh (PID: 6420, Parent: 6405, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6421, Parent: 6420)

grep (PID: 6421, Parent: 6420, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6422, Parent: 6405)

sh (PID: 6422, Parent: 6405, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6426, Parent: 6422)

grep (PID: 6426, Parent: 6422, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6429, Parent: 1)

generate-config (PID: 6429, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6440, Parent: 6429)

pkill (PID: 6440, Parent: 6429, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6447, Parent: 1)

gdm-wait-for-drm (PID: 6447, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6454, Parent: 1)

gdm3 (PID: 6454, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6459, Parent: 6454)

plymouth (PID: 6459, Parent: 6454, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6478, Parent: 6454)

gdm-session-worker (PID: 6478, Parent: 6454, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6483, Parent: 6478)

gdm-wayland-session (PID: 6483, Parent: 6478, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6487, Parent: 6483)

dbus-daemon (PID: 6487, Parent: 6483, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6489, Parent: 6487)

dbus-daemon New Fork (PID: 6490, Parent: 6489)

false (PID: 6490, Parent: 6489, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6491, Parent: 6483)

dbus-run-session (PID: 6491, Parent: 6483, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6492, Parent: 6491)

dbus-daemon (PID: 6492, Parent: 6491, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6493, Parent: 6454)

Default (PID: 6493, Parent: 6454, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6494, Parent: 6454)

Default (PID: 6494, Parent: 6454, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6460, Parent: 1)

accounts-daemon (PID: 6460, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6471, Parent: 6460)

language-validate (PID: 6471, Parent: 6460, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6472, Parent: 6471)

language-options (PID: 6472, Parent: 6471, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6473, Parent: 6472)

sh (PID: 6473, Parent: 6472, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6474, Parent: 6473)

locale (PID: 6474, Parent: 6473, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6475, Parent: 6473)

grep (PID: 6475, Parent: 6473, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

gvfsd-fuse New Fork (PID: 6504, Parent: 2038)

fusermount (PID: 6504, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6545, Parent: 1860)

dbus-daemon (PID: 6545, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6390)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /tmp/Fantazy.mpsl.elf (PID: 6218)	Socket: 127.0.0.1:59025	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6454)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6487)	Socket: unknown address family	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.189.127
Source: unknown	TCP traffic detected without corresponding DNS query: 220.55.111.21
Source: unknown	TCP traffic detected without corresponding DNS query: 64.237.254.51
Source: unknown	TCP traffic detected without corresponding DNS query: 114.17.105.104
Source: unknown	TCP traffic detected without corresponding DNS query: 181.250.159.19
Source: unknown	TCP traffic detected without corresponding DNS query: 83.221.4.55
Source: unknown	TCP traffic detected without corresponding DNS query: 189.15.185.49
Source: unknown	TCP traffic detected without corresponding DNS query: 149.104.91.244
Source: unknown	TCP traffic detected without corresponding DNS query: 35.64.43.36
Source: unknown	TCP traffic detected without corresponding DNS query: 221.176.0.212
Source: unknown	TCP traffic detected without corresponding DNS query: 20.80.26.26
Source: unknown	TCP traffic detected without corresponding DNS query: 145.141.39.235
Source: unknown	TCP traffic detected without corresponding DNS query: 162.77.43.9
Source: unknown	TCP traffic detected without corresponding DNS query: 8.250.137.117
Source: unknown	TCP traffic detected without corresponding DNS query: 205.222.205.236
Source: unknown	TCP traffic detected without corresponding DNS query: 119.176.234.94
Source: unknown	TCP traffic detected without corresponding DNS query: 77.105.7.5
Source: unknown	TCP traffic detected without corresponding DNS query: 66.206.251.107
Source: unknown	TCP traffic detected without corresponding DNS query: 77.147.6.61
Source: unknown	TCP traffic detected without corresponding DNS query: 144.2.230.31
Source: unknown	TCP traffic detected without corresponding DNS query: 125.213.242.224
Source: unknown	TCP traffic detected without corresponding DNS query: 112.151.164.99
Source: unknown	TCP traffic detected without corresponding DNS query: 168.250.251.73
Source: unknown	TCP traffic detected without corresponding DNS query: 88.47.63.206
Source: unknown	TCP traffic detected without corresponding DNS query: 89.255.156.221
Source: unknown	TCP traffic detected without corresponding DNS query: 169.25.157.224
Source: unknown	TCP traffic detected without corresponding DNS query: 194.114.242.38
Source: unknown	TCP traffic detected without corresponding DNS query: 216.172.104.32
Source: unknown	TCP traffic detected without corresponding DNS query: 98.230.129.126
Source: unknown	TCP traffic detected without corresponding DNS query: 122.23.140.165
Source: unknown	TCP traffic detected without corresponding DNS query: 155.175.177.221
Source: unknown	TCP traffic detected without corresponding DNS query: 72.14.112.170
Source: unknown	TCP traffic detected without corresponding DNS query: 197.115.127.162
Source: unknown	TCP traffic detected without corresponding DNS query: 143.13.18.35
Source: unknown	TCP traffic detected without corresponding DNS query: 75.254.250.41
Source: unknown	TCP traffic detected without corresponding DNS query: 90.147.248.163
Source: unknown	TCP traffic detected without corresponding DNS query: 62.95.192.204
Source: unknown	TCP traffic detected without corresponding DNS query: 78.3.23.120
Source: unknown	TCP traffic detected without corresponding DNS query: 72.199.105.184
Source: unknown	TCP traffic detected without corresponding DNS query: 8.216.105.91
Source: unknown	TCP traffic detected without corresponding DNS query: 190.197.16.37
Source: unknown	TCP traffic detected without corresponding DNS query: 163.140.173.181
Source: unknown	TCP traffic detected without corresponding DNS query: 202.90.202.109
Source: unknown	TCP traffic detected without corresponding DNS query: 119.140.234.230
Source: unknown	TCP traffic detected without corresponding DNS query: 198.239.125.193
Source: unknown	TCP traffic detected without corresponding DNS query: 9.219.81.154
Source: unknown	TCP traffic detected without corresponding DNS query: 87.28.173.181
Source: unknown	TCP traffic detected without corresponding DNS query: 87.25.71.218
Source: unknown	TCP traffic detected without corresponding DNS query: 35.118.101.197

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.35.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38148
Source: unknown	Network traffic detected: HTTP traffic on port 38148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 6049, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 6200, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 6201, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 6222, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 6226, result: unknown	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 6049, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 6200, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 6201, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 6222, result: successful	Jump to behavior
Source: /tmp/Fantazy.mpsl.elf (PID: 6226)	SIGKILL sent: pid: 6226, result: unknown	Jump to behavior

Source: classification engine

Classification label: mal68.spre.troj.linELF@0/42@3/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6308)	File: /proc/6308/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6487)	File: /proc/6487/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6492)	File: /proc/6492/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6504)	File: /proc/6504/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6545)	File: /proc/6545/mounts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6254)	File: /run/systemd/journal/streams/.#9:75626oxPDD7	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File: /run/systemd/journal/streams/.#9:75627n642a8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File: /run/systemd/journal/streams/.#9:75976h3dvt8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File: /run/systemd/journal/streams/.#9:76007xQYzx7	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File: /run/systemd/journal/streams/.#9:76014vDrQK4	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File: /run/systemd/journal/streams/.#9:76164vAPAv8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File: /run/systemd/journal/streams/.#9:76166uABrh4	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File: /run/systemd/journal/streams/.#9:77020YM5vX6	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File: /run/systemd/journal/streams/.#9:76441Dv7gJ4	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File: /run/systemd/journal/streams/.#9:76509fcmuH7	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File: /run/systemd/journal/streams/.#9:765349rSyl5	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File: /run/systemd/journal/streams/.#9:76587ZJWgz4	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File: /run/systemd/journal/streams/.#9:77716vWg7U6	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File: /run/systemd/journal/streams/.#9:77751R9phT3	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File: /run/systemd/journal/streams/.#9:77778cNF6i7	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File: /run/systemd/journal/streams/.#9:77779krulE7	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File: /run/systemd/journal/streams/.#9:77812DVDlK4	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File: /run/systemd/journal/streams/.#9:77817AdjhS3	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File: /run/systemd/journal/streams/.#9:787086c74s8	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6327)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6327)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6327)	File: /run/systemd/seats/.#seat0iPnHdA	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6327)	File: /run/systemd/users/.#12782a9KE	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6327)	File: /run/systemd/users/.#127VkhLuE	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6327)	File: /run/systemd/seats/.#seat08ZEDGE	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6327)	File: /run/systemd/users/.#127D7QpgB	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6327)	File: /run/systemd/users/.#127vQNb6A	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6327)	File: /run/systemd/users/.#127fuMJ0C	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6393)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6483)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6460)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6460)	Directory: /root/.cache	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/6478/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/6478/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/6478/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/6478/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/6478/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/6478/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/6478/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2078/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2078/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2078/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2078/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2078/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2078/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2078/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2077/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2077/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2077/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2077/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2077/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2077/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2077/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2033/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2033/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2033/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2033/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2033/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2033/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2033/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2074/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2074/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2074/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2074/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2074/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2074/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2074/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/6390/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/6390/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/6390/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/6390/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/6390/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/6390/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/6390/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/6393/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/6393/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/6393/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/6393/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/6393/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/6393/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/6393/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/1532/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/1532/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/1532/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/1532/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/1532/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/1532/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/1532/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/1334/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/1334/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2302/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2302/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2302/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2302/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2302/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2302/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2223/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2223/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2223/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2223/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2223/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2223/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2223/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2025/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2025/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2025/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2025/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2025/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2025/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	File opened: /proc/2025/cgroup	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6406)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6408)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6412)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6414)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6416)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6418)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6420)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6422)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6473)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Source: /bin/sh (PID: 6407)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6409)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6413)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6415)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6417)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6419)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6421)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6426)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6475)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6440)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6254)

Reads from proc file: /proc/meminfo

Jump to behavior

Source: /sbin/agetty (PID: 6404)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6454)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6454)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6460)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6460)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6390)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6390)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 6405)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 6405)

Truncated file: /var/log/gpu-manager.log

Jump to behavior

Source: /usr/bin/pulseaudio (PID: 6322)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pkill (PID: 6440)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /tmp/Fantazy.mpsl.elf (PID: 6218)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6254)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6322)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6390)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6404)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6405)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6478)	Queries kernel information via 'uname':	Jump to behavior

Source: Fantazy.mpsl.elf, 6218.1.00005654ae288000.00005654ae30f000.rw-.sdmp, Fantazy.mpsl.elf, 6220.1.00005654ae288000.00005654ae30f000.rw-.sdmp, Fantazy.mpsl.elf, 6222.1.00005654ae288000.00005654ae30f000.rw-.sdmp, Fantazy.mpsl.elf, 6224.1.00005654ae288000.00005654ae30f000.rw-.sdmp, Fantazy.mpsl.elf, 6226.1.00005654ae288000.00005654ae30f000.rw-.sdmp	Binary or memory string: TV!/etc/qemu-binfmt/mipsel
Source: Fantazy.mpsl.elf, 6226.1.00007ffed30d6000.00007ffed30f7000.rw-.sdmp	Binary or memory string: TV/tmp/qemu-open.phqcaZ(9
Source: Fantazy.mpsl.elf, 6218.1.00005654ae288000.00005654ae30f000.rw-.sdmp, Fantazy.mpsl.elf, 6220.1.00005654ae288000.00005654ae30f000.rw-.sdmp, Fantazy.mpsl.elf, 6222.1.00005654ae288000.00005654ae30f000.rw-.sdmp, Fantazy.mpsl.elf, 6224.1.00005654ae288000.00005654ae30f000.rw-.sdmp, Fantazy.mpsl.elf, 6226.1.00005654ae288000.00005654ae30f000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mipsel
Source: syslog.35.dr	Binary or memory string: Jan 23 08:57:54 galassia kernel: [ 475.731487] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: Fantazy.mpsl.elf, 6226.1.00007ffed30d6000.00007ffed30f7000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.phqcaZ
Source: syslog.35.dr	Binary or memory string: Jan 23 08:57:54 galassia kernel: [ 475.731522] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: Fantazy.mpsl.elf, 6218.1.00007ffed30d6000.00007ffed30f7000.rw-.sdmp, Fantazy.mpsl.elf, 6220.1.00007ffed30d6000.00007ffed30f7000.rw-.sdmp, Fantazy.mpsl.elf, 6222.1.00007ffed30d6000.00007ffed30f7000.rw-.sdmp, Fantazy.mpsl.elf, 6224.1.00007ffed30d6000.00007ffed30f7000.rw-.sdmp, Fantazy.mpsl.elf, 6226.1.00007ffed30d6000.00007ffed30f7000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mipsel
Source: Fantazy.mpsl.elf, 6218.1.00007ffed30d6000.00007ffed30f7000.rw-.sdmp, Fantazy.mpsl.elf, 6220.1.00007ffed30d6000.00007ffed30f7000.rw-.sdmp, Fantazy.mpsl.elf, 6222.1.00007ffed30d6000.00007ffed30f7000.rw-.sdmp, Fantazy.mpsl.elf, 6224.1.00007ffed30d6000.00007ffed30f7000.rw-.sdmp, Fantazy.mpsl.elf, 6226.1.00007ffed30d6000.00007ffed30f7000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/Fantazy.mpsl.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Fantazy.mpsl.elf

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6460)

Logged in records file read: /var/log/wtmp

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Fantazy.mpsl.elf	61%	ReversingLabs	Linux.Trojan.Mirai
Fantazy.mpsl.elf	100%	Avira	EXP/ELF.Gafgyt.Z.A

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.35.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
71.174.139.242	unknown	United States	701	UUNETUS	false
114.170.121.29	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
67.144.68.83	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
152.125.78.228	unknown	United States	29992	VA-TMP-COREUS	false
126.71.78.73	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
87.193.0.119	unknown	Germany	20676	PLUSNETDE	false
133.161.219.254	unknown	Japan	385	AFCONC-BLOCK1-ASUS	false
150.25.201.137	unknown	Japan	6400	CompaniaDominicanadeTelefonosSADO	false
152.206.72.255	unknown	Cuba	27725	EmpresadeTelecomunicacionesdeCubaSACU	false
95.53.186.179	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
9.48.215.48	unknown	United States	3356	LEVEL3US	false
63.148.196.254	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
39.230.204.81	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
122.190.21.148	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
113.125.52.171	unknown	China	58519	CHINATELECOM-CTCLOUDCloudComputingCorporationCN	false
42.8.182.142	unknown	Korea Republic of	4249	LILLY-ASUS	false
158.172.136.241	unknown	Spain	48990	ATALAYATV-ASES	false
83.150.87.205	unknown	Finland	29422	NBLNETWORKS-ASNebulaOyFI	false
173.77.111.190	unknown	United States	701	UUNETUS	false
204.154.7.174	unknown	United States	40288	CFCU-ASUS	false
57.132.138.212	unknown	Belgium	2686	ATGS-MMD-ASUS	false
65.148.158.199	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
84.171.255.46	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
81.137.110.126	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
39.37.96.238	unknown	Pakistan	45595	PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPK	false
145.235.190.24	unknown	Sweden	1257	TELE2EU	false
107.48.166.96	unknown	United States	16567	NETRIX-16567US	false
106.164.130.71	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
206.74.65.57	unknown	United States	22646	HARCOM1US	false
102.229.165.47	unknown	unknown	36926	CKL1-ASNKE	false
71.81.11.36	unknown	United States	20115	CHARTER-20115US	false
171.107.224.144	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
183.155.37.185	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
160.27.203.213	unknown	Japan	9371	SAKURA-CSAKURAInternetIncJP	false
198.53.124.254	unknown	Canada	852	ASN852CA	false
191.230.98.80	unknown	Brazil	26615	TIMSABR	false
211.93.186.165	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
181.124.244.45	unknown	Paraguay	23201	TelecelSAPY	false
103.119.159.120	unknown	China	137989	BIGHUBCOLTD-AS-APBigHubCoLtdKH	false
116.15.87.43	unknown	Singapore	9506	SINGTEL-FIBRESingtelFibreBroadbandSG	false
166.228.206.39	unknown	United States	6614	USCC-ASNUS	false
177.58.254.28	unknown	Brazil	22085	ClaroSABR	false
72.97.121.91	unknown	United States	22394	CELLCOUS	false
118.187.210.57	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
119.149.82.183	unknown	Korea Republic of	17839	DREAMPLUS-AS-KRLGHelloVisionCorpKR	false
211.23.177.94	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
5.143.11.134	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
150.24.123.250	unknown	Japan	6400	CompaniaDominicanadeTelefonosSADO	false
125.99.58.255	unknown	India	17488	HATHWAY-NET-APHathwayIPOverCableInternetIN	false
69.45.209.201	unknown	United States	3356	LEVEL3US	false
133.152.68.94	unknown	Japan	38634	DWANGODWANGOCoLtdJP	false
32.109.183.67	unknown	United States	2688	ATGS-MMD-ASUS	false
8.92.216.5	unknown	United States	3356	LEVEL3US	false
114.14.38.87	unknown	Indonesia	56046	CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN	false
195.113.33.151	unknown	Czech Republic	2852	CESNET2CZ	false
182.122.104.133	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
219.158.46.192	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
45.44.239.125	unknown	Canada	54198	VIANETCA	false
48.45.50.44	unknown	United States	2686	ATGS-MMD-ASUS	false
168.31.159.172	unknown	United States	3479	PEACHNET-AS1US	false
85.140.211.146	unknown	Russian Federation	8359	MTSRU	false
204.174.1.244	unknown	Canada	14683	WILSHIREASSOCIATESINCUS	false
136.71.188.71	unknown	United States	60311	ONEFMCH	false
27.209.227.131	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
114.103.47.213	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
91.119.201.29	unknown	Austria	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
128.252.243.169	unknown	United States	2552	WUSTL-ASNUS	false
218.191.130.194	unknown	Hong Kong	9304	HUTCHISON-AS-APHGCGlobalCommunicationsLimitedHK	false
135.140.227.117	unknown	United States	10455	LUCENT-CIOUS	false
141.198.24.131	unknown	United States	1761	TDIR-CAPNETUS	false
48.78.131.80	unknown	United States	2686	ATGS-MMD-ASUS	false
42.217.82.196	unknown	China	4249	LILLY-ASUS	false
2.67.189.215	unknown	Sweden	44034	HI3GSE	false
108.165.154.49	unknown	United States	11798	ACEDATACENTERS-AS-1US	false
115.168.194.7	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
206.198.52.82	unknown	United States	26844	PACTIVUS	false
101.68.105.136	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
42.234.145.149	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
151.81.183.148	unknown	Italy	1267	ASN-WINDTREIUNETEU	false
219.192.206.114	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
121.201.45.193	unknown	China	58543	CHINATELECOM-GUANGDONG-IDCGuangdongCN	false
38.209.163.73	unknown	United States	174	COGENT-174US	false
191.126.125.139	unknown	Chile	7418	TELEFONICACHILESACL	false
46.230.96.253	unknown	Saudi Arabia	35819	MOBILY-ASEtihadEtisalatCompanyMobilySA	false
117.207.53.41	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
60.237.131.253	unknown	Japan	2518	BIGLOBEBIGLOBEIncJP	false
24.176.170.248	unknown	United States	20115	CHARTER-20115US	false
20.232.130.161	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.198.206.207	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
63.189.37.13	unknown	United States	1239	SPRINTLINKUS	false
188.52.136.37	unknown	Saudi Arabia	25019	SAUDINETSTC-ASSA	false
102.249.45.190	unknown	South Africa	5713	SAIX-NETZA	false
60.141.152.121	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
166.217.193.43	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
97.163.77.42	unknown	United States	6167	CELLCO-PARTUS	false
169.143.255.245	unknown	United States	26121	JEPPESENUS	false
169.106.137.23	unknown	United States	37611	AfrihostZA	false
219.137.249.230	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
62.206.208.114	unknown	Germany	20676	PLUSNETDE	false
154.237.235.252	unknown	Egypt	36992	ETISALAT-MISREG	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
39.230.204.81	P8Ql4X3E2T	Get hash	malicious	Mirai	Browse
39.230.204.81	sora.arm7	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	Fantazy.sh4.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Fantazy.mips.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	zte	Get hash	malicious	Unknown	Browse	162.213.35.24
	Fantazy.x86_64.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	sh4.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	debug.dbg.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	Fantazy.ppc.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UUNETUS	BlumBot.exe	Get hash	malicious	Xmrig	Browse	71.179.14.4
	3.elf	Get hash	malicious	Unknown	Browse	63.49.4.60
	Fantazy.sh4.elf	Get hash	malicious	Unknown	Browse	71.169.206.148
	Fantazy.arm7.elf	Get hash	malicious	Mirai	Browse	147.225.110.192
	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	194.175.103.189
	Fantazy.i486.elf	Get hash	malicious	Unknown	Browse	210.80.93.117
	Fantazy.mips.elf	Get hash	malicious	Unknown	Browse	71.241.60.7
	jaws	Get hash	malicious	Unknown	Browse	139.4.86.149
	Fantazy.i686.elf	Get hash	malicious	Unknown	Browse	71.103.91.220
	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	63.91.239.135
CENTURYLINK-US-LEGACY-QWESTUS	Fantazy.arm7.elf	Get hash	malicious	Mirai	Browse	97.125.189.29
	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	63.226.219.167
	Fantazy.mips.elf	Get hash	malicious	Unknown	Browse	174.20.119.56
	jaws	Get hash	malicious	Unknown	Browse	71.38.242.44
	Fantazy.x86_64.elf	Get hash	malicious	Unknown	Browse	207.109.0.37
	Fantazy.i686.elf	Get hash	malicious	Unknown	Browse	67.6.133.151
	Fantazy.arm4.elf	Get hash	malicious	Unknown	Browse	71.52.232.15
	armv5l.elf	Get hash	malicious	Unknown	Browse	138.15.218.232
	armv6l.elf	Get hash	malicious	Unknown	Browse	67.4.100.164
	https://eightdays-pdfnow.b-cdn.net/	Get hash	malicious	TechSupportScam	Browse	162.19.138.117
OCNNTTCommunicationsCorporationJP	3.elf	Get hash	malicious	Unknown	Browse	157.67.23.203
	Fantazy.sh4.elf	Get hash	malicious	Unknown	Browse	125.201.87.147
	Fantazy.arm7.elf	Get hash	malicious	Mirai	Browse	210.232.249.224
	Fantazy.mips.elf	Get hash	malicious	Unknown	Browse	118.18.205.182
	2.elf	Get hash	malicious	Unknown	Browse	157.104.12.118
	Fantazy.i686.elf	Get hash	malicious	Unknown	Browse	60.37.237.103
	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	118.5.226.231
	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	210.133.153.235
	4.elf	Get hash	malicious	Unknown	Browse	180.39.246.114
	armv5l.elf	Get hash	malicious	Unknown	Browse	153.198.79.28

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	high, very likely benign file
Preview:	auto_null.monitor.

/proc/6490/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:M:M
MD5:	BA494C188316311212CCEE52D096D630
SHA1:	DF7D3D80AE1A6486901EC355B09D59E123FC0686
SHA-256:	E452DF535213BF392680781699F920EFDAE43814190C8465A0538BA78090332C
SHA-512:	145F2FAC791560C489497FC020E430376AE18506D70C1596A18F6C571B8BB192C209A67919FC8784F9F58CE48CE451AA079343043F6DC97673C1E627E5D5B0A6
Malicious:	false
Reputation:	low
Preview:	6454.

/run/systemd/journal/streams/.#9:75626oxPDD7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.509672052788005
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpo2nKHj3QVduqjs77:SbFuFyLVIg1BG+f+M6DDgVduqji4s
MD5:	668EEDA5E133BC5223AE93FAC5ECC9D0
SHA1:	B877D5A431221BE07A05B46310CC85EE03895ACD
SHA-256:	EB3B4DDF8782C42A6D653B785AF975621AE1C795E4A43E17DDE2F5237C03F47A
SHA-512:	B5EFB77CCC47B27F121E809E8976C812F25FF5ABD2FFA55B191BA5CD8B1ABD9CFB5C69C08A38FCEC18A8ED7FFF397CA2A4470CF0710D289DA9A385C8051A139F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cadd5ddd248e4590bbf085041241970e.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:75627n642a8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.5038407073829765
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsSXWD+fzrSGvAgls+:SbFuFyLVIg1BG+f+MsStOGvF2ji4s
MD5:	E2CD055FAAEBF98994552401AF188909
SHA1:	5D392DDB7873FD140BA4E8AAA13319153FA16468
SHA-256:	7F92F128FDD5D3794AA08FE14C5CF320617EFED63E2C1F7C14585DBAF28239F0
SHA-512:	4A665CF29DE45494D4F17EACA7A0C2520C87ECC8A73423512B953C2F6549286D791B237C553462D69FBE8ED2C9A8F9918752F976C1DDE5C08F04798414FAC019
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f5b808195048411c8305019a7c7450dc.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:75976h3dvt8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.377751416328456
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/TBVhVsBoXFXsjs16:SbFuFyLVIg1BG+f+MpVjXmjosQu
MD5:	775C7D1E7DB6BB411FD6FF79F90F15BF
SHA1:	C7F7178254EE8E3FA5816F33ACA5F7E3E2052505
SHA-256:	99544B7A6127EE04387B896060245C7B9A7B98B4275E60E8564052A58FF55831
SHA-512:	CA284F8C360221BF40E5B6132870ACD9B35EA35414DDAF9CC8282AD95C24DB470178F7A44E80C2AEF315E2054DC8420D3FF246C3BB4E536FFF2144ED187B9206
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=55cd051a42414e9085d5d361151b1420.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76007xQYzx7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.362881977782229
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuAjURU/Dux3grxsje:SbFuFyLVIg1BG+f+MuWEdjdCLKzK
MD5:	F4C7CA88598989D709533CDD8B72A330
SHA1:	26906BE3E92370CA8894FC16D9FB9BC013F903AB
SHA-256:	5B858C61D04703C1B4752AD0750432DCB9157E1324065A9714770609343FB0B8
SHA-512:	2B6A9FAFCFE188EDDA866ABB7688096C2E4C0773AEE451C49D42ADCAEC94561F10087B909907615401F01073E08277FD34ABB5F823DB69751CA476845E8168BE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d92d3c240a3941349bd8f0ac6afc8e30.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:76014vDrQK4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.3611173574353215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/QHWKdwmvsjshQJWQ:SbFuFyLVIg1BG+f+MyWK4jtWL0
MD5:	782E4DD5925BD8B73FA7D7232F715393
SHA1:	F43DC28BEFD0F53A4BAC89ACDF8832521B76D5E3
SHA-256:	E70C02B0F23C7B0E2487F2AAC42F4064B483087DCEAD77BDFBE5B6BE06921335
SHA-512:	54FBBA826C251578758E42B8B6893AF925CFF05AD980E5551466D89DE235A36BA16DE59C812AA78044316D0016133466783232A4F61287003715D1FB0E185CFA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=564704f3a78944c1aeeadfd2df1c6792.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:76164vAPAv8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.461778955075598
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M8aApRb4GGojZcHcljX+:qgFq6g10+f+M8aA/b4EmAu
MD5:	59CA66E461407F157F68071F995C012F
SHA1:	C2F8B12656AB6A177AA882A7748CE0BC0FE30219
SHA-256:	8E4A1DB970A7DE07E746F2A6597355A5F3A8ABA0A16994D02E02A45D67121046
SHA-512:	DD52839842823710C884F98E0BA0F995C27622786EBC54504BAF1EF89149E103F4B3E62B5F297D7FA101F7FCFDD6F7D0B34FAB268681922842B4D231E791AB08
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=624e9335deae492c8a7e4c4d3f5f8e35.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:76166uABrh4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.427174131656881
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyRtRQoUjFR7yF2jsx:SbFuFyLVIg1BG+f+MyHRQJjFRVjNE
MD5:	0F215253E76D02AC4197DD06276398CD
SHA1:	40818AEC23E61A3161AE8DD6563A0C8C17332716
SHA-256:	C5D39F8FAE71BAAFBC2723B2DF7FFEBDFB3FC85A1F0D2B6FB22EE9AEF3DA149B
SHA-512:	24C7E8C865A13C479EBAC300D703C538FD9F6612AFE8A94D2C151EFCA7392D6B6B913336CE4C6C96A83B57509A9333E7DD7EEA2E965F5B5931C8B1AEA2CE5CE4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=82ef18ec6d634352b071d08b485d3dad.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:76441Dv7gJ4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.354149061580513
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpfnbRT0gWULATjswK:SbFuFyLVIg1BG+f+M5b90TULATjLkGq
MD5:	F8B0ECFEC910C474F90A7C63F1420407
SHA1:	D37EFDEB3F12B87C65914A1D7B59872B5E8E5C9F
SHA-256:	583CC6D367D20ECD34E0B149C4A59D0375CB4D11DD245276F7989B4665783CBD
SHA-512:	09FF3E35FA9D272AC298839F37E0FB585CAD7740CEAE1F31B7EB8DD7452120B807FE23AABBB83D3BE8935B92980A0A18EF4BF5EC314DA852B44C3A6226714220
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c76cf9e1191d41339221939223171349.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:76509fcmuH7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.388873836833121
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmpLzIn4xsZjs2ALAXaGS:SbFuFyLVIg1BAf+M9slZjNALyAZD
MD5:	5539418CF0EF2B000C6BD897AF70EA1A
SHA1:	21F03339E035B3C51C261508B1BE7CD99BDB8F34
SHA-256:	D2B98C9D02C17C88629D50280399130664E6027ACA1C44D33C90527ED1E781A8
SHA-512:	8C167DFB09502CF07FB78E8D902188AB9889831DFF2F25A070AE086EC04F90C1F1A410DA48978AB63960BB531BCDE4A481AA1877AA9549590914B5A6113C579E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cf7e6b642ee14b6bb66f750bb546bb06.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:765349rSyl5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.379472095751274
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MoWHE1TvF2jdCt/rRMtq:qgFq6g10+f+MocCDL
MD5:	4922C801AD9CF692107C531845C99D34
SHA1:	1D7235A88E3F36C70744676BD3049AAB80D00BAD
SHA-256:	A1A714197A74F4DACC7210D5661F7358E30EC674AEB925B14932DDB400D0DE6B
SHA-512:	3DFA8F1D36D2E8B9FB6B6E485F11F95FDCCCB396D5882E8810193AAEC0825A70BDBFBBD68C534E45B898D76F8BFE87CD14B195A193AE0250DB8886255081BB92
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b2bc8ba08e6a4ad4b020e0a1fb48cab6.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:76587ZJWgz4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.449769892611771
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmsDRqhdBUJmtwsjs2BbM:SbFuFyLVIg1BAf+Ms4h+mXjNdQIeXD
MD5:	8536EA206123DDFA7F05A036CD4D8765
SHA1:	9BF2F738A992DF7BA8637F4EE4D8C30473F202DC
SHA-256:	ADB9388608C156C8D4F61BC318857D3A36C8913C7AEED19CA86CBD6CEC42883F
SHA-512:	4074716139AC15E82463D3297349F0F7AB590CA6D2BDAE276D2234B83BE762D719C3DDFA66363DC030408DB9C31CFE5461DA434B8F36A23D93391502A289C71C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f8a14af4160d410299d115d792ab4232.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77020YM5vX6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.411143969964242
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/JlvQQF6lsjshKJv4:SbFuFyLVIg1BG+f+MHQQF62jbVC
MD5:	84A8C33F6174BC58EA1BCDFF6F6EDE35
SHA1:	C57506E9CE30FD57F3900C51E444806C52E33FA1
SHA-256:	86A8B118434EFA0B254D5D005F7364BF60DFA17A63ECD9DA34069A64A0CFACA0
SHA-512:	C0311C40AF47826BEC7044B8CD07B36BDCE0CA634B4DBB387A0940D0826386C352478CA6FE05CEE6AB48925C1A101EB03CB8D1931BE98D4A3F0DDC2297D511A6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=55973a6a810b44469df481cbeefa1540.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:77716vWg7U6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.404904471781306
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmvDmD5S1sjs2BZZGu:SbFuFyLVIg1BAf+MbmNjNTZD
MD5:	CB1D9526348D2D4E583B246566BD3EFF
SHA1:	C56E1C0D21987B5C9E7BDEFAF778CE0E70A47226
SHA-256:	3C617CC903B59DAE6D2442A32B975B1D3C998265F04B988816D9A2C3F3C84298
SHA-512:	833E7BE2884580E4D8C1974AA9C09162078479A4276B3462531C43B3155C4AF019AA3499B8FA4722D52A0BFFE498A51A19D6A8E5103E2439DA85E41E7744CFE1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=eceb1209fdb1466fa59711e676588ee0.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77751R9phT3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.387479124007881
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+My8WVNAZjLTTIWTIL:qgFq6g10+f+MqYEWEL
MD5:	8BA529FA54F6D31946467C92DA7A89E0
SHA1:	42E007841B0C34665481E742E9EDDA6BF734BDE6
SHA-256:	D47F71C336DAF3559EAD6F7349A921A7BEA5189D41D01D6E1B6062835D96A05A
SHA-512:	1373F445C471210636FBF16445306925770B5058090154134F78C1E99433EA543CF9DE46E266B175F3096AB0DD97FF3FC41DE4739FAA2672DC2C529FB0B7C38E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8bfef6d0095a4f6fa160003809903e9f.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:77778cNF6i7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.450083467734186
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmz/TalWnx5Mqjs2q:SbFuFyLVK6g7/+BG+f+MjTalWnx5ZjNq
MD5:	FAC24E36CF27BE24516BB6702058391C
SHA1:	7479B0D868213093F7DF0DE599FEFC5E3D441B51
SHA-256:	BC283645CCEDB4C9278BA8CC7C0C4CFEAEEF7789E3F2E315722485F1FA9140D8
SHA-512:	B53CF40CE2F01B5D02A57916AA7C315EC78B10589651B85317E47DFD5F09B25F5FCDCF0F5009A4826EEEF2C77CA499E887FEFD4FDB9E40425A517C7DEDB30E3A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=91c3dee9951f435387627ce6af7fbe86.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:77779krulE7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.358621734993437
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MfyzKfy9vsZjNq:qgFqdg7/+0+f+MKzKzq
MD5:	8FE430701403391D3E43C1F92B3CA40E
SHA1:	54041ED4BBA329DD2EDCBEE5F522B73AA94E1900
SHA-256:	6EA69195BDCEB25EEC8983D7A63AF4A6246A92FDDC44EB891D7F71A803E196E4
SHA-512:	FEBEFB75B29639A1D13BBFA816D64187888378C47D43243CBB5F50F71D0A41447ACF8A1F768B70A52739783C6230A60CB4526943F04C718304D330021CE281F3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9806180a749b43e38686a688d04e218a.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:77812DVDlK4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.508800085043635
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MM3rdAWrqjFQMzKaBu:qgFqo6g7/+0+f+MM3mWETmh
MD5:	CF16EA6651C3BA486F22AEAA9B7986EE
SHA1:	CD917EA39C21844FD044653729DF7CABB11E1B38
SHA-256:	3DC7153C08FE0EE873ACD5A16BA27E4845F0F8A6127A77ACCE9FD66E4C18C977
SHA-512:	A36DF0F79D48BF14285AC5F9F93F12157DC2E462CDADB81BFD6340D47A29ED810CCFFA7D0603A09148780D97FA8CC9C459F5B27A52282824C0777FC6EA529030
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a59c724c7a0d4a928a03e441779392b5.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:77817AdjhS3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.484897465954806
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+Mh2zZjFQMzKaBu:qgFqdg7/+0+f+MADTmh
MD5:	2BAB1292080B03021F515101EB0E1E9E
SHA1:	D81701FBFB49E5DF8518AAD27C42114DD97B05AE
SHA-256:	F593976C4E8BFEF5501322121C233429010799658425BCC9FA72B0794DB7CD57
SHA-512:	B4B4E3B8509C8FD0832392974033AC9C058D045318B35E255BFF9D494BFDA5B6F4E60E69162CBD924CDFC112F7640F19D84E4BB4F3F833ADD9028672FCA7AEB8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c328ac77b0db440bba3e40f29648a099.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:787086c74s8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.3400773899982195
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+l0OEwtbUxv8js1Ha:SbFuFyLVIg1BG+f+M+lb2xv8joa
MD5:	3BF628BDEE26150415E3CDC685641224
SHA1:	33D6072E5A7B0BA69232086608670F6D4F450C4F
SHA-256:	1E4B9061ED0DB541551CA087C9521DE183E99B745B7627814DC524185652A936
SHA-512:	E6C4E5EDD4C43D030FFC41AF2CECEB097954D7DA99D4DF7BA230069A1E365731B17DD8479CAF5FCBBE409F8E2BB9BE7528FF1D9CB08E3D248A5B11D006BDBB29
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=47a04742904a4321afb4f80bc7eea5be.IDENTIFIER=dbus-daemon.

/run/systemd/seats/.#seat08ZEDGE

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0iPnHdA

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/users/.#12782a9KE

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127D7QpgB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.272943829061825
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7g7yQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+g78thQHtPYq9M
MD5:	44C76ECFBF36C53833429F6B1AA2712C
SHA1:	AA529D653C2742DC6408297389DDF611607E0673
SHA-256:	21C77ABD376415C4A77D676A716C9B871AE88FBED6628497F2C7795318068D47
SHA-512:	09EDFCD3D184759B072A2E13FEBFB628242D230617C6730C471C14BB5CE396FC13106F867E3A546A8E80EF3DA57F3FEAF1B807D56A2527F30BD343FCDC2004C8
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1737644272174172.MONOTONIC=473348301.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127VkhLuE

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.272943829061825
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6d7g7yQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB+g78thQHtPYq9M
MD5:	44C76ECFBF36C53833429F6B1AA2712C
SHA1:	AA529D653C2742DC6408297389DDF611607E0673
SHA-256:	21C77ABD376415C4A77D676A716C9B871AE88FBED6628497F2C7795318068D47
SHA-512:	09EDFCD3D184759B072A2E13FEBFB628242D230617C6730C471C14BB5CE396FC13106F867E3A546A8E80EF3DA57F3FEAF1B807D56A2527F30BD343FCDC2004C8
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12350.REALTIME=1737644272174172.MONOTONIC=473348301.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127fuMJ0C

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.407503124875851
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff6lgTg7Ot6oSA:qgFq30dABibB3Tg7OIPA
MD5:	309550A58DD0AB06A6F129C37C3F4A87
SHA1:	7577A7A067D8BFB953EBD2D9FA44AD89ABB23954
SHA-256:	D20349F110C8ECC808229C896A6E25425382756524DE539E9AEB2C68AC3D9F46
SHA-512:	FCC30BC7CED82DD8EE80494BA78A51948B52B39BACBA38F0BEF2114660E8EAC65723455C32F8CE303B48260D9B3AFA55B8A50C33D30F883A4770891D4D9CCAB8
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12412.REALTIME=1737644272174172.MONOTONIC=473348301.LAST_SESSION_TIMESTAMP=473470452.

/run/systemd/users/.#127vQNb6A

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.250062681781355
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgCVqrqWQUeH206qodOSVa:SbFuFyL3BVgdL87iesnAiRJg7Ot6oSA
MD5:	AC095B01981A7BFF038688397E5A9020
SHA1:	A6A4811B62820F1AF96603F8C550F571067937DE
SHA-256:	7E1F69ABB523631DB9EA77BF04B5475C87600CEEC3AC5501947A266D03DE07AF
SHA-512:	A5DF008551653ECE59A8BD4C1367E6214C32433D1B6E34B06398B2DBDF1E9965B98D639B3543DE6016E5C590F4C13B50E96E417867EF91B718307EB446E3C758
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1737644272174172.MONOTONIC=473348301.LAST_SESSION_TIMESTAMP=473470452.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:c/:c/
MD5:	BC95C9D26D286D3D26D17F9B0A2B1D82
SHA1:	98C38ACBDC4BDBD152DF84326C815A1CD7B624B6
SHA-256:	E9A46EF37F9B26E53A170FCD7E061EDE6375C6523A1340D4AF314E0D1FD9ACDF
SHA-512:	8FF22817852B9E3DF3F92A4C3AD3F949DB95FFBD5D9003676088522CF5D984F359C63C7EE96CAD2EC81F1E1A50C4EE1D1FEC43948385729D8313FD22B8336B13
Malicious:	false
Preview:	6322.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6516795542818555
Encrypted:	false
SSDEEP:	3:MCsXlXEWtl/YZ1l:2+ylQ
MD5:	9B601E6F3BF7494D9327A6117365793D
SHA1:	3182576A501464169F819F8BB7960B4ED562B034
SHA-256:	126EEAE3401CDB01DC7F480191FE6753F2CAAB051AE1089755C4F9B8165ACF1C
SHA-512:	4B44DE83638A69BF53447B5D80BE763CB01C06D5F4F3365FAC0B57C848761CF3A78F597C4935BE1C876EF03B56CAC78DEB9A983F1890022043E8CCAE4FB643EF
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN....................................................................................................................................................................................................................................................................................................X.g._......................................

/tmp/qemu-open.phqcaZ (deleted)

Download File

Process:	/tmp/Fantazy.mpsl.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	3.5858017607410924
Encrypted:	false
SSDEEP:	6:URgDF6EP0gcdtSY/VUd/vYDF6EP0HVYHT/VtVxGdtj/VDM/V+4D/VH:IYNPktSZdHQN2aKxMfF
MD5:	A57CA37BE4ABAFF7D5B10A107606D921
SHA1:	1C9C9771BAB3934547E4AF8811B161330F2A7512
SHA-256:	371C972454E62DAFE7A7EC10D3B2E3CFDF1F9BDD5E1161819D4F1B5E4AF06290
SHA-512:	5FF468DF65D5D0AB8C2B055794E8E0410C31DB1A4160B45CBD01BEDC57EA36BC86D5D9FE31B1D191C50113A24364CE255F25A859CB222668AE99B09CBFA7D073
Malicious:	false
Preview:	400000-418000 r-xp 00000000 fd:00 531606 /tmp/Fantazy.mpsl.elf.458000-459000 rw-p 00018000 fd:00 531606 /tmp/Fantazy.mpsl.elf.459000-45a000 rw-p 00000000 00:00 0 .45a000-45c000 rw-p 00000000 00:00 0 .7f7ff000-7f800000 ---p 00000000 00:00 0 .7f800000-80000000 rw-p 00000000 00:00 0 [stack].

/var/lib/AccountsService/users/gdm.FRPA12

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	4.898982825677016
Encrypted:	false
SSDEEP:	24:JbqxtZ4IetZedeDZeHSHrHDooIAvTIA2+V9yIF0pYr4d7Jr4PwrCQU:J24vJfVAIQYr4dNr44rCn
MD5:	9F575A851B7A2FA06626C3FF3A13A1E8
SHA1:	BC2B35953E872FBF3E023AF9A6F234CBC7558867
SHA-256:	1F442215F3A460DAB42CD88280D88AA65BAD1AACB3FD953565B04DF84FC3E42F
SHA-512:	181552665F06BB387AE8605CEE39D0DA4C02F790751AA8E410C10C27B762D859BA8425663EC26776CB39AB26B80F3079CCA8A61998E2D718C5FD4396C0D9D31D
Malicious:	false
Preview:	Jan 23 08:57:27 galassia gdm-password]: pam_systemd(gdm-password:session): Failed to release session: No session '2' known.Jan 23 08:57:28 galassia systemd-logind[6327]: Failed to add user by file name 127, ignoring: Invalid argument.Jan 23 08:57:28 galassia systemd-logind[6327]: Failed to add user by file name 1000, ignoring: Invalid argument.Jan 23 08:57:28 galassia systemd-logind[6327]: User enumeration failed: Invalid argument.Jan 23 08:57:28 galassia systemd-logind[6327]: User of session c2 not known..Jan 23 08:57:28 galassia systemd-logind[6327]: User of session 2 not known..Jan 23 08:57:28 galassia systemd-logind[6327]: User of session c1 not known..Jan 23 08:57:28 galassia systemd-logind[6327]: Session enumeration failed: No such file or directory.Jan 23 08:57:28 galassia systemd-logind[6327]: Watching system buttons on /dev/input/event0 (Power Button).Jan 23 08:57:28 galassia systemd-logind[6327]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Jan

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4313806548581445
Encrypted:	false
SSDEEP:	3:F31HlNOhe1OhOlll:F3dOhoOhOl/
MD5:	6FFEC8864844CF25ADB5143EA21384B2
SHA1:	D9E3D7E05555C52D098ACB97987A231BDCF99607
SHA-256:	F16A0587838B1424B3B4BE36BD7D393EEDCBF562711E556EB18575394BAC9F3A
SHA-512:	2FB39A7AE697FDE6CEBEE8ED2EA96309ED89F1B2B64CE847B5DD9D2FBB7C2DC6CC77C3A7A56903B25383AC742554D18D2D61C2A3BC61A37727251B921EB4E330
Malicious:	false
Preview:	LPKSHHRH.....................WK...b..g.....................................WK...b..g........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.448047321524811
Encrypted:	false
SSDEEP:	3:F31Hl08okh//k8okhP/:F3Edxd
MD5:	8756D2905C554BD3A9821EB738801E15
SHA1:	57719502AAB2B275C0C7EBB6BF85F24D0C6DC316
SHA-256:	3A205F7B5B1DEBA688F125D83A154E97F58CA5619C5C95D70DEE3B931C64794A
SHA-512:	B042819FF6B8805A03C00169938953F982901D24BB9AE4F41B38DA7ECFDEA0E5AE2D3AC68B2B28382D0D40BF90ABC3A5DAA58372D41E441C9980918F54BB297F
Malicious:	false
Preview:	LPKSHHRH.................%..FMDt.{..L..&.................................%..FMDt.{..L..&........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	CSV text
Category:	dropped
Size (bytes):	12110
Entropy (8bit):	4.984414424242784
Encrypted:	false
SSDEEP:	192:a4DMeb7Hk9Sm4iH/ugr8JOAZ837UGU9pX:9aSmnH2yLAEC9pX
MD5:	18D7346DCB396FAE3BCC90EFC402C0E3
SHA1:	F54D6EFC85BCF1BEFDAFCE3810CE34816FF1F25D
SHA-256:	675F9B6ED354B0AEE165523405E06764A13A4F97A80D48B89A5F0191E2AC1226
SHA-512:	5AF0AA0CD285B012234315D6F7A97A190BB1B7967A6164CA43C416428DCF22B542DA17EB2698D8AC40D69215D4EC7FF6E0ADB7A7D305B8FDDB70AE2E2CE1460B
Malicious:	false
Preview:	Jan 23 08:57:24 galassia kernel: [ 443.491491] New task spawned: old: (tgid 6321, tid 6321), new (tgid: 6321, tid: 6389).Jan 23 08:57:24 galassia kernel: [ 444.014039] New task spawned: old: (tgid 6386, tid 6386), new (tgid: 6386, tid: 6391).Jan 23 08:57:24 galassia kernel: [ 444.015022] New task spawned: old: (tgid 6386, tid 6386), new (tgid: 6386, tid: 6392).Jan 23 08:57:24 galassia kernel: [ 444.395737] New task spawned: old: (tgid 6393, tid 6393), new (tgid: 6393, tid: 6394).Jan 23 08:57:24 galassia kernel: [ 444.397489] New task spawned: old: (tgid 6393, tid 6393), new (tgid: 6393, tid: 6395).Jan 23 08:57:24 galassia kernel: [ 444.448922] New task spawned: old: (tgid 6393, tid 6395), new (tgid: 6393, tid: 6396).Jan 23 08:57:24 galassia kernel: [ 444.733616] New task spawned: old: (tgid 6321, tid 6321), new (tgid: 6321, tid: 6398).Jan 23 08:57:24 galassia kernel: [ 445.215759] New task spawned: old: (tgid 6390, tid 6390), new (tgid: 6390, tid: 6399).Jan 23 08:57:24 galassia

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	40387
Entropy (8bit):	5.091429619351802
Encrypted:	false
SSDEEP:	768:Q/0AznARkAoMa2kzkJwUCfFhX3IZlnysQSMK2IEmnHT7FBbfDdpwciYFJ3xvrRwh:gDmnHT7FK
MD5:	85EA2A2B9B40E1A9C9AC3ACD7624D38A
SHA1:	FCB66BDCF288A35077AD6B38A7FA0C789C2AB204
SHA-256:	2A00F9175917C64787280894E79817BE92EE0C25A7CADD877850A3014B57DBD1
SHA-512:	5F0D7DD341637B76C1E4D61FBB3535ABAF09886F34FC6E1E0583739D9084754ABA586537CD261A274060B76E18CD7881CF99A8FE59785A2A1C7A1C9C60456BD1
Malicious:	false
Preview:	Jan 23 08:57:23 galassia multipathd[658]: sda: add missing path.Jan 23 08:57:24 galassia kernel: [ 443.491491] New task spawned: old: (tgid 6321, tid 6321), new (tgid: 6321, tid: 6389).Jan 23 08:57:24 galassia kernel: [ 444.014039] New task spawned: old: (tgid 6386, tid 6386), new (tgid: 6386, tid: 6391).Jan 23 08:57:24 galassia kernel: [ 444.015022] New task spawned: old: (tgid 6386, tid 6386), new (tgid: 6386, tid: 6392).Jan 23 08:57:24 galassia kernel: [ 444.395737] New task spawned: old: (tgid 6393, tid 6393), new (tgid: 6393, tid: 6394).Jan 23 08:57:24 galassia kernel: [ 444.397489] New task spawned: old: (tgid 6393, tid 6393), new (tgid: 6393, tid: 6395).Jan 23 08:57:24 galassia kernel: [ 444.448922] New task spawned: old: (tgid 6393, tid 6395), new (tgid: 6393, tid: 6396).Jan 23 08:57:24 galassia kernel: [ 444.733616] New task spawned: old: (tgid 6321, tid 6321), new (tgid: 6321, tid: 6398).Jan 23 08:57:24 galassia kernel: [ 445.215759] New task spawned: old: (tgid 6390,

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6516795542818555
Encrypted:	false
SSDEEP:	3:MCsXlXEWtl/YZ1l:2+ylQ
MD5:	9B601E6F3BF7494D9327A6117365793D
SHA1:	3182576A501464169F819F8BB7960B4ED562B034
SHA-256:	126EEAE3401CDB01DC7F480191FE6753F2CAAB051AE1089755C4F9B8165ACF1C
SHA-512:	4B44DE83638A69BF53447B5D80BE763CB01C06D5F4F3365FAC0B57C848761CF3A78F597C4935BE1C876EF03B56CAC78DEB9A983F1890022043E8CCAE4FB643EF
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN....................................................................................................................................................................................................................................................................................................X.g._......................................

File type:	ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.506391230628808
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Fantazy.mpsl.elf
File size:	100'468 bytes
MD5:	93bcc3581458be3a436b3eab7d847118
SHA1:	32641233c5ca0a5be22c578df7b8915194020ae4
SHA256:	b466b109c9ce9819e1f6ea5f68f7a75ffa5278ad031c61e72a077171cdf9ee92
SHA512:	6203b198d196936d19f903c343260a1bf3a0a0c50c652ef4d5fafb9503443359e34a244003ab0217e9f450c4123d0653bbba8dd2001967359c3e60d262c22662
SSDEEP:	1536:277/BCaYLJcHPasWK20j+QNIxhRQmnDRZNdaney:0LAaYeHlWK2ABaDRJy
TLSH:	DBA3831ABF605EF3ECAFDC77499A2B45208D141A21897B78BD70D814F64E24F19E38B1
File Content Preview:	.ELF....................`.@.4...D.......4. ...(...............@...@..z...z....................E...E.....x...........Q.td...............................<...'!......'.......................<...'!... .........9'.. ........................<...'!............f9

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	99908
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x16600	0x0	0x6	AX	16
.fini	PROGBITS	0x416720	0x16720	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x416780	0x16780	0x1340	0x0	0x2	A	16
.ctors	PROGBITS	0x458000	0x18000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x458008	0x18008	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x458014	0x18014	0x4	0x0	0x3	WA	4
.data	PROGBITS	0x458020	0x18020	0x258	0x0	0x3	WA	16
.got	PROGBITS	0x458280	0x18280	0x360	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x4585e0	0x185e0	0x20	0x0	0x10000003	WAp	4
.bss	NOBITS	0x458600	0x185e0	0x578	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x678	0x185e0	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x185e0	0x64	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x17ac0	0x17ac0	5.5662	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x18000	0x458000	0x458000	0x5e0	0xb78	4.0368	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 23, 2025 15:57:23.780020952 CET	192.168.2.23	1.1.1.1	0xd8ec	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Jan 23, 2025 15:57:23.780020952 CET	192.168.2.23	1.1.1.1	0x9a08	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Jan 23, 2025 15:57:24.577370882 CET	192.168.2.23	1.1.1.1	0x1c52	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 23, 2025 15:57:23.787961006 CET	1.1.1.1	192.168.2.23	0xd8ec	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false
Jan 23, 2025 15:57:23.787961006 CET	1.1.1.1	192.168.2.23	0xd8ec	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2025-01-23 14:57:34 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2025-01-23 14:57:34 UTC	25	IN	HTTP/1.1 100 Continue
2025-01-23 14:57:34 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2025-01-23 14:57:34 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2025-01-23 14:57:34 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2025-01-23 14:57:34 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2025-01-23 14:57:34 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2025-01-23 14:57:34 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2025-01-23 14:57:34 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2025-01-23 14:57:34 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2025-01-23 14:57:34 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2025-01-23 14:57:34 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2025-01-23 14:57:35 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Jan 2025 14:57:35 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	14:56:52
Start date (UTC):	23/01/2025
Path:	/tmp/Fantazy.mpsl.elf
Arguments:	/tmp/Fantazy.mpsl.elf
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Start time (UTC):	14:56:59
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	14:57:02
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	14:57:18
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	14:57:19
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	14:57:21
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	14:57:23
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	14:57:24
Start date (UTC):	23/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	14:57:25
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	14:57:26
Start date (UTC):	23/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	14:57:27
Start date (UTC):	23/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	14:57:28
Start date (UTC):	23/01/2025
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	14:57:29
Start date (UTC):	23/01/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Fantazy.mpsl.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6490/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:75626oxPDD7

/run/systemd/journal/streams/.#9:75627n642a8

/run/systemd/journal/streams/.#9:75976h3dvt8

/run/systemd/journal/streams/.#9:76007xQYzx7

/run/systemd/journal/streams/.#9:76014vDrQK4

/run/systemd/journal/streams/.#9:76164vAPAv8

/run/systemd/journal/streams/.#9:76166uABrh4

/run/systemd/journal/streams/.#9:76441Dv7gJ4

/run/systemd/journal/streams/.#9:76509fcmuH7

/run/systemd/journal/streams/.#9:765349rSyl5

/run/systemd/journal/streams/.#9:76587ZJWgz4

/run/systemd/journal/streams/.#9:77020YM5vX6

/run/systemd/journal/streams/.#9:77716vWg7U6

/run/systemd/journal/streams/.#9:77751R9phT3

/run/systemd/journal/streams/.#9:77778cNF6i7

/run/systemd/journal/streams/.#9:77779krulE7

/run/systemd/journal/streams/.#9:77812DVDlK4

/run/systemd/journal/streams/.#9:77817AdjhS3

/run/systemd/journal/streams/.#9:787086c74s8

/run/systemd/seats/.#seat08ZEDGE

/run/systemd/seats/.#seat0iPnHdA

/run/systemd/users/.#12782a9KE

/run/systemd/users/.#127D7QpgB

/run/systemd/users/.#127VkhLuE

/run/systemd/users/.#127fuMJ0C

/run/systemd/users/.#127vQNb6A

/run/user/1000/pulse/pid

/run/utmp

Linux Analysis Report
Fantazy.mpsl.elf

Start time (UTC):	14:57:30
Start date (UTC):	23/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	14:57:31
Start date (UTC):	23/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	14:57:32
Start date (UTC):	23/01/2025
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	14:57:34
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	14:57:35
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	14:57:45
Start date (UTC):	23/01/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	14:57:46
Start date (UTC):	23/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	14:57:49
Start date (UTC):	23/01/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	14:57:52
Start date (UTC):	23/01/2025
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	14:57:53
Start date (UTC):	23/01/2025
Path:	/usr/bin/dbus-daemon
Arguments:	dbus-daemon --print-address 3 --session
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c