Create Interactive Tour

Linux Analysis Report
rrrdsl.elf

Overview

General Information

Sample name:	rrrdsl.elf
Analysis ID:	1630027
MD5:	48819782a01b2b57ddc437eecae3431a
SHA1:	f39f8483d949349d375132e4ad223373c6f3af8d
SHA256:	6346aac64caa717e670ea357d1d7c0dceba1c65e1f871e9930ec8d5752f075f2
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	56
Range:	0 - 100

Signatures

Multi AV Scanner detection for submitted file

Sample deletes itself

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1630027
Start date and time:	2025-03-05 12:47:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	rrrdsl.elf
Detection:	MAL
Classification:	mal56.spre.evad.linELF@0/81@98/0

Runtime Messages

Command:	/tmp/rrrdsl.elf
PID:	5445
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	kovey/cursinq was here, go away!
Standard Error:

Process Tree

system is lnxubuntu20

rrrdsl.elf (PID: 5445, Parent: 5367, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/rrrdsl.elf

rrrdsl.elf New Fork (PID: 5447, Parent: 5445)

rrrdsl.elf New Fork (PID: 5449, Parent: 5447)

rrrdsl.elf New Fork (PID: 5450, Parent: 5447)

rrrdsl.elf New Fork (PID: 5453, Parent: 5447)

systemd New Fork (PID: 5479, Parent: 1)

rsyslogd (PID: 5479, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

xfce4-panel New Fork (PID: 5480, Parent: 3147)

wrapper-2.0 (PID: 5480, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 5481, Parent: 3147)

wrapper-2.0 (PID: 5481, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 5484, Parent: 3147)

wrapper-2.0 (PID: 5484, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 5485, Parent: 3147)

wrapper-2.0 (PID: 5485, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

wrapper-2.0 New Fork (PID: 5504, Parent: 5485)

xfpm-power-backlight-helper (PID: 5504, Parent: 5485, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness

xfce4-panel New Fork (PID: 5486, Parent: 3147)

wrapper-2.0 (PID: 5486, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 5487, Parent: 3147)

wrapper-2.0 (PID: 5487, Parent: 3147, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

systemd New Fork (PID: 5490, Parent: 1)

rsyslogd (PID: 5490, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

dbus-daemon New Fork (PID: 5503, Parent: 5502)

xfconfd (PID: 5503, Parent: 5502, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

systemd New Fork (PID: 5524, Parent: 1)

rsyslogd (PID: 5524, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5531, Parent: 1)

rsyslogd (PID: 5531, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5536, Parent: 1)

rsyslogd (PID: 5536, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5543, Parent: 1)

rsyslogd (PID: 5543, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5550, Parent: 1)

rsyslogd (PID: 5550, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5556, Parent: 1)

rsyslogd (PID: 5556, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5560, Parent: 1)

rsyslogd (PID: 5560, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

dash New Fork (PID: 5565, Parent: 3578)

rm (PID: 5565, Parent: 3578, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.Sd2DGOZ8E4 /tmp/tmp.o0OOt58qLs /tmp/tmp.iIE0z6HVOU

dash New Fork (PID: 5566, Parent: 3578)

rm (PID: 5566, Parent: 3578, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.Sd2DGOZ8E4 /tmp/tmp.o0OOt58qLs /tmp/tmp.iIE0z6HVOU

systemd New Fork (PID: 5569, Parent: 1)

rsyslogd (PID: 5569, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5573, Parent: 1)

rsyslogd (PID: 5573, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5579, Parent: 1)

rsyslogd (PID: 5579, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5583, Parent: 1)

rsyslogd (PID: 5583, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5589, Parent: 1)

rsyslogd (PID: 5589, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5595, Parent: 1)

rsyslogd (PID: 5595, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5599, Parent: 1)

rsyslogd (PID: 5599, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5607, Parent: 1)

rsyslogd (PID: 5607, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5613, Parent: 1)

rsyslogd (PID: 5613, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5618, Parent: 1)

rsyslogd (PID: 5618, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5624, Parent: 1)

rsyslogd (PID: 5624, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5628, Parent: 1)

rsyslogd (PID: 5628, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5634, Parent: 1)

rsyslogd (PID: 5634, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5640, Parent: 1)

rsyslogd (PID: 5640, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5644, Parent: 1)

rsyslogd (PID: 5644, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5650, Parent: 1)

rsyslogd (PID: 5650, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5656, Parent: 1)

rsyslogd (PID: 5656, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5660, Parent: 1)

rsyslogd (PID: 5660, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5666, Parent: 1)

rsyslogd (PID: 5666, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5673, Parent: 1)

rsyslogd (PID: 5673, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5677, Parent: 1)

rsyslogd (PID: 5677, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5683, Parent: 1)

rsyslogd (PID: 5683, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5687, Parent: 1)

rsyslogd (PID: 5687, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5693, Parent: 1)

rsyslogd (PID: 5693, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5699, Parent: 1)

rsyslogd (PID: 5699, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5703, Parent: 1)

rsyslogd (PID: 5703, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5711, Parent: 1)

rsyslogd (PID: 5711, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5717, Parent: 1)

rsyslogd (PID: 5717, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5722, Parent: 1)

rsyslogd (PID: 5722, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5728, Parent: 1)

rsyslogd (PID: 5728, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5732, Parent: 1)

rsyslogd (PID: 5732, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5750, Parent: 1)

rsyslogd (PID: 5750, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

cleanup

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: rrrdsl.elf	Virustotal: Detection: 23%			Perma Link
Source: rrrdsl.elf	ReversingLabs: Detection: 26%

Source: global traffic

TCP traffic: 192.168.2.13:51626 -> 141.98.10.142:2211

Source: /usr/sbin/rsyslogd (PID: 5479)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5490)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5524)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5531)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5536)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5543)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5550)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5556)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5560)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5569)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5573)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5579)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5583)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5589)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5595)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5599)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5607)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5613)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5618)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5624)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5628)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5634)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5640)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5644)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5650)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5656)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5660)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5666)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5673)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5677)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5683)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5687)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5693)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5699)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5703)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5711)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5717)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5722)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5728)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5732)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5750)	Reads hosts file: /etc/hosts	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 54.247.62.1
Source: unknown	TCP traffic detected without corresponding DNS query: 54.247.62.1

Source: global traffic

DNS traffic detected: DNS query: raw.awaken-network.net

Source: syslog.48.dr, syslog.84.dr, syslog.88.dr, syslog.118.dr, syslog.44.dr, syslog.102.dr, syslog.86.dr, syslog.110.dr, syslog.82.dr, syslog.76.dr, syslog.100.dr, syslog.98.dr, syslog.92.dr, syslog.62.dr, syslog.74.dr, syslog.114.dr, syslog.68.dr, syslog.104.dr, syslog.78.dr, syslog.38.dr, syslog.50.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57212
Source: unknown	Network traffic detected: HTTP traffic on port 57212 -> 443

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/rrrdsl.elf (PID: 5447)	SIGKILL sent: pid: 5450, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 803, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 855, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 914, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 917, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 3161, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 3162, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 3163, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 3164, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 3165, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 3170, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 3208, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 3212, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5453, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5479, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5480, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5481, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5484, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5485, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5486, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5487, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5490, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5503, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5524, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5531, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5536, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5543, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5550, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5556, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5560, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5569, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5573, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5579, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5583, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5589, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5595, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5599, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5607, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5613, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5618, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5624, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5628, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5634, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5640, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5644, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5650, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5656, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5660, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5666, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5673, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5677, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5683, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5687, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5693, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5699, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5703, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5711, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5717, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5722, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5728, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5732, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 2, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: sys_monitor_cnrbusyboxadbddockerdBlink_Cloudsystemdhttpshsshdbashmsg_centerlte_mgrmain_mgrpkarm7pkarm5pkarmpkarm6pkmipspkmpslpkx86/tmp/var/mnt/root/boot/sbin/home/dev/media/opt/../(deleted)x86armmipsmpslsh4arm5arm6%s/%s/data/local/tmp/bin/dev/null/dev/console/var/lib/dockerraw.awaken-network.netabcdefghijklmnopqrstuvwxyz/proc/%d/cmdline/proc/%d/proc/selfhttpd/proc/self/exe

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/rrrdsl.elf (PID: 5447)	SIGKILL sent: pid: 5450, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 803, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 855, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 914, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 917, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 3161, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 3162, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 3163, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 3164, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 3165, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 3170, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 3208, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 3212, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5453, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5479, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5480, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5481, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5484, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5485, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5486, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5487, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5490, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5503, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5524, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5531, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5536, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5543, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5550, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5556, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5560, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5569, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5573, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5579, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5583, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5589, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5595, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5599, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5607, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5613, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5618, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5624, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5628, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5634, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5640, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5644, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5650, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5656, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5660, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5666, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5673, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5677, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5683, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5687, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5693, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5699, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5703, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5711, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5717, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5722, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5728, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 5732, result: successful	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	SIGKILL sent: pid: 2, result: successful	Jump to behavior

Source: classification engine

Classification label: mal56.spre.evad.linELF@0/81@98/0

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5485)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5486)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5487)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5503)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5503)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5503)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5503)	Directory: /home/saturnino/.config	Jump to behavior

Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/238/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/238/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/238/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/239/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/239/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/239/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/3757/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/3757/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/13/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/13/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/13/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/14/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/14/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/14/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/15/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/15/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/15/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/16/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/16/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/16/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/17/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/17/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/17/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/18/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/18/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/18/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/19/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/19/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/19/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/240/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/240/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/240/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/3095/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/3095/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/3095/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/5391/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/5391/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/120/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/120/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/120/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/241/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/241/stat	Jump to behavior
Source: /tmp/rrrdsl.elf (PID: 5449)	File opened: /proc/241/stat	Jump to behavior

Source: /usr/bin/dash (PID: 5565)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.Sd2DGOZ8E4 /tmp/tmp.o0OOt58qLs /tmp/tmp.iIE0z6HVOU			Jump to behavior
Source: /usr/bin/dash (PID: 5566)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.Sd2DGOZ8E4 /tmp/tmp.o0OOt58qLs /tmp/tmp.iIE0z6HVOU			Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 5490)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5524)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5531)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5536)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5543)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5550)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5556)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5560)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5569)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5573)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5579)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5583)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5589)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5595)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5599)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5607)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5613)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5618)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5624)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5628)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5634)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5640)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5644)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5650)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5656)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5660)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5666)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5673)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5677)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5683)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5687)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5693)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5699)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5703)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5711)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5717)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5722)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5728)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5732)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5750)	Log file created: /var/log/kern.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/rrrdsl.elf (PID: 5447)

File: /tmp/rrrdsl.elf

Jump to behavior

Source: /tmp/rrrdsl.elf (PID: 5445)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5479)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5485)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5486)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5487)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5490)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5524)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5531)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5536)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5543)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5550)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5556)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5560)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5569)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5573)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5579)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5583)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5589)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5595)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5599)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5607)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5613)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5618)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5624)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5628)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5634)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5640)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5644)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5650)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5656)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5660)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5666)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5673)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5677)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5683)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5687)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5693)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5699)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5703)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5711)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5717)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5722)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5728)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5732)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5750)	Queries kernel information via 'uname':	Jump to behavior

Source: rrrdsl.elf, 5453.1.00007f5a3447f000.00007f5a34485000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.3.logog
Source: rrrdsl.elf, 5453.1.00007f5a3447f000.00007f5a34485000.rw-.sdmp	Binary or memory string: HP/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-fwupd.service-gomG2hP/tmp/systemd-private-fe424f1b0f85425093f40a37100b81c4-colord.service-PB7Ovf4/tmp/vmware-root_727-42906909664
Source: rrrdsl.elf, 5453.1.00007f5a3447f000.00007f5a34485000.rw-.sdmp	Binary or memory string: vmware-vmtoolsd-root.logXIM-logXIM-
Source: rrrdsl.elf, 5453.1.000055a15b759000.000055a15b77c000.rw-.sdmp	Binary or memory string: U/mipsel/tmp/vmware-root_727-4290690966
Source: rrrdsl.elf, 5453.1.000055a15b759000.000055a15b77c000.rw-.sdmp	Binary or memory string: /mipsel/tmp/vmware-root_727-4290690966
Source: rrrdsl.elf, 5445.1.000055a15b6d2000.000055a15b759000.rw-.sdmp, rrrdsl.elf, 5450.1.000055a15b6d2000.000055a15b759000.rw-.sdmp, rrrdsl.elf, 5453.1.000055a15b6d2000.000055a15b759000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mipsel
Source: rrrdsl.elf, 5453.1.00007f5a3447f000.00007f5a34485000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.3.log
Source: rrrdsl.elf, 5453.1.00007f5a3447f000.00007f5a34485000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.2.log-logiog-logi
Source: rrrdsl.elf, 5445.1.00007ffee7e8d000.00007ffee7eae000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.izvp7T\
Source: rrrdsl.elf, 5453.1.00007f5a3447f000.00007f5a34485000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.logH@PGH@PG
Source: rrrdsl.elf, 5445.1.00007ffee7e8d000.00007ffee7eae000.rw-.sdmp, rrrdsl.elf, 5450.1.00007ffee7e8d000.00007ffee7eae000.rw-.sdmp, rrrdsl.elf, 5453.1.00007ffee7e8d000.00007ffee7eae000.rw-.sdmp	Binary or memory string: /qemu-open.XXXXX
Source: rrrdsl.elf, 5445.1.00007ffee7e8d000.00007ffee7eae000.rw-.sdmp, rrrdsl.elf, 5450.1.00007ffee7e8d000.00007ffee7eae000.rw-.sdmp, rrrdsl.elf, 5453.1.00007ffee7e8d000.00007ffee7eae000.rw-.sdmp	Binary or memory string: mx86_64/usr/bin/qemu-mipsel/tmp/rrrdsl.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/rrrdsl.elf
Source: rrrdsl.elf, 5453.1.00007f5a3447f000.00007f5a34485000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.1.log
Source: rrrdsl.elf, 5453.1.000055a15b759000.000055a15b77c000.rw-.sdmp	Binary or memory string: /tmp/vmware-root_727-4290690966
Source: rrrdsl.elf, 5453.1.000055a15b759000.000055a15b77c000.rw-.sdmp	Binary or memory string: U/mipsel/1/tmp/vmware-root_727-42906909660
Source: rrrdsl.elf, 5453.1.00007f5a3447f000.00007f5a34485000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.1.logog
Source: rrrdsl.elf, 5445.1.000055a15b6d2000.000055a15b759000.rw-.sdmp, rrrdsl.elf, 5450.1.000055a15b6d2000.000055a15b759000.rw-.sdmp, rrrdsl.elf, 5453.1.000055a15b6d2000.000055a15b759000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mipsel
Source: rrrdsl.elf, 5453.1.00007f5a3447f000.00007f5a34485000.rw-.sdmp	Binary or memory string: vmware-vmtoolsd-root.log
Source: rrrdsl.elf, 5453.1.00007f5a3447f000.00007f5a34485000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.log
Source: rrrdsl.elf, 5445.1.00007ffee7e8d000.00007ffee7eae000.rw-.sdmp, rrrdsl.elf, 5450.1.00007ffee7e8d000.00007ffee7eae000.rw-.sdmp, rrrdsl.elf, 5453.1.00007ffee7e8d000.00007ffee7eae000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mipsel
Source: rrrdsl.elf, 5453.1.00007f5a3447f000.00007f5a34485000.rw-.sdmp	Binary or memory string: vmware-vmsvc-root.2.log
Source: rrrdsl.elf, 5445.1.00007ffee7e8d000.00007ffee7eae000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.izvp7T

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 File Deletion	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
rrrdsl.elf	23%	Virustotal		Browse
rrrdsl.elf	26%	ReversingLabs	Linux.Trojan.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
raw.awaken-network.net	141.98.10.142	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.48.dr, syslog.84.dr, syslog.88.dr, syslog.118.dr, syslog.44.dr, syslog.102.dr, syslog.86.dr, syslog.110.dr, syslog.82.dr, syslog.76.dr, syslog.100.dr, syslog.98.dr, syslog.92.dr, syslog.62.dr, syslog.74.dr, syslog.114.dr, syslog.68.dr, syslog.104.dr, syslog.78.dr, syslog.38.dr, syslog.50.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
141.98.10.142	raw.awaken-network.net	Lithuania		209605	HOSTBALTICLT	false
54.247.62.1	unknown	United States		16509	AMAZON-02US	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
141.98.10.142	jfeeps.elf	Get hash	malicious	Unknown	Browse
	rrrdsl.elf	Get hash	malicious	Unknown	Browse
	efefa7.elf	Get hash	malicious	Mirai	Browse
	rrrdsl.elf	Get hash	malicious	Unknown	Browse
	eehah4.elf	Get hash	malicious	Unknown	Browse
	drea4.elf	Get hash	malicious	Unknown	Browse
	rjfe686.elf	Get hash	malicious	Unknown	Browse
	weje64.elf	Get hash	malicious	Unknown	Browse
	vejfa5.elf	Get hash	malicious	Unknown	Browse
	bejv86.elf	Get hash	malicious	Unknown	Browse
54.247.62.1	na.elf	Get hash	malicious	Prometei	Browse
	powerpc.nn.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	m68k.elf	Get hash	malicious	Unknown	Browse
	PwnKit32.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	hydra.x86.elf	Get hash	malicious	Mirai	Browse
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse
	sparc.elf	Get hash	malicious	Mirai, Moobot	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.awaken-network.net	jfeeps.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	weje64.elf	Get hash	malicious	Unknown	Browse	141.98.10.142

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	Message.eml	Get hash	malicious	Unknown	Browse	44.239.142.249
	TagManager.exe	Get hash	malicious	Unknown	Browse	13.32.121.100
	http://meanswarehouse.com	Get hash	malicious	Phisher	Browse	52.53.41.57
	Map1.pdf	Get hash	malicious	Unknown	Browse	54.229.236.29
	NycfkzjAlr.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	q3na5Mc.exe	Get hash	malicious	Vidar	Browse	18.244.18.27
	. MV PUMA 7 - FINAL INVOICES - VOY. 16.02.2025.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	DHL AWB Receipt_pdf.bat.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	DHL - OVERDUE ACCOUNT LETTER- FINAL REMINDER - 1300711528.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	DHL - NINGBO OVERDUE INVOICES- FINAL REMINDER - 456034158.gggg.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
HOSTBALTICLT	jfeeps.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	efefa7.elf	Get hash	malicious	Mirai	Browse	141.98.10.142
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	eehah4.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	drea4.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	rjfe686.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	weje64.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	vejfa5.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	bejv86.elf	Get hash	malicious	Unknown	Browse	141.98.10.142

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.izvp7T (deleted)

Download File

Process:	/tmp/rrrdsl.elf
File Type:	data
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.8731406795131327
Encrypted:	false
SSDEEP:	3:TgxWO8HJN:Tg2JN
MD5:	94BB3F3C4E316B1BFDA0789F3F4CCF1C
SHA1:	D30AE36DEDF23C1003471DDF03ABD529AFD78DC7
SHA-256:	A6E654A189D43F2ECD936B290B0E3816BA80B39599736442E886809BA05E966E
SHA-512:	3C3B3C7F3B4BEF3B52972823D6BDD1EF1E4E29A8A88851A681ECFCF5D26E3056ACFD1332D91E44F2E2ADFA4A9D4E863A1AB64E0087D50F646C813BE04D9FD294
Malicious:	false
Reputation:	low
Preview:	/tmp/rrrdsl.elf.nwlrbbmqbh

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	799
Entropy (8bit):	4.658680461022405
Encrypted:	false
SSDEEP:	24:pZY8aYsDYaCpYdeQY5JY2kJYOaY5AIS5dYyAISOn:LYhYSYaeYdHYvY2UYrY/S5dYcSOn
MD5:	E3FDA89111C3049B1F4ECA22E4078587
SHA1:	68A033A721FE12920057006971B9CFD82322041E
SHA-256:	16B71F2121A05487962845AD31B28468A4F2FA27D2358816D3C01D09A7A1DB6B
SHA-512:	FB8DB4189E01875FE1B5AC151F711597868994AC0A06B613B113C047044142D0008678A332BA1360374A37968D35B05F16746673970E063FC6244AF04DB1BD65
Malicious:	false
Reputation:	low
Preview:	Mar 5 05:50:03 galassia kernel: [ 230.148430] blocking signal 9: 5449 -> 1400.Mar 5 05:50:03 galassia kernel: [ 230.278667] blocking signal 9: 5449 -> 660.Mar 5 05:50:03 galassia kernel: [ 230.288016] blocking signal 9: 5449 -> 778.Mar 5 05:50:03 galassia kernel: [ 230.296348] blocking signal 9: 5449 -> 803.Mar 5 05:50:03 galassia kernel: [ 230.305241] blocking signal 9: 5449 -> 855.Mar 5 05:50:03 galassia kernel: [ 230.313358] blocking signal 9: 5449 -> 936.Mar 5 05:50:03 galassia kernel: [ 230.321466] blocking signal 9: 5449 -> 1400.Mar 5 05:50:03 galassia kernel: [ 230.519159] New task spawned: old: (tgid 5750, tid 5750), new (tgid: 5750, tid: 5751).Mar 5 05:50:03 galassia kernel: [ 230.519736] New task spawned: old: (tgid 5750, tid 5751), new (tgid: 5750, tid: 5753).

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	2039
Entropy (8bit):	4.929040653935674
Encrypted:	false
SSDEEP:	48:P3FJCPJR5ivHtNYhYSYaeYdHYvY2UYrY/S5dYcSOoA/M/m/p:+JR2Hyw
MD5:	882FD2A8B82769CF7C4FCFD9DE42709B
SHA1:	B469E7CEEBCD715DB2AEAE586A883220B96B1C22
SHA-256:	3A5D7064EB4374A439BF10FBF6A8966D5983CC244BD474B571BA7F6D9FA94EE3
SHA-512:	E2126E90289DB771A517DF55EB785DA6B78CB8694CF25F8AB0EC33A7A315C883DC69D9B61783567FA95F95DF716D0A7EB4FCAA92AE2166348D623F086DDF97DB
Malicious:	false
Reputation:	low
Preview:	Mar 5 05:50:03 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Mar 5 05:50:03 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Mar 5 05:50:03 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 41..Mar 5 05:50:03 galassia systemd[1]: Stopped System Logging Service..Mar 5 05:50:03 galassia systemd[1]: Starting System Logging Service....Mar 5 05:50:03 galassia systemd[1]: Started System Logging Service..Mar 5 05:50:03 galassia rsyslogd: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd. [v8.2001.0].Mar 5 05:50:03 galassia rsyslogd: rsyslogd's groupid changed to 110.Mar 5 05:50:03 galassia rsyslogd: rsyslogd's userid changed to 104.Mar 5 05:50:03 galassia rsyslogd: [origin software="rsyslogd" swVersion="8.2001.0" x-pid="5750" x-info="https://www.rsyslog.com"] start.Mar 5 05:50:03 galassia kernel: [ 230.148430] blocking signal 9: 5449 -> 1400.Mar 5 05:50:03 ga

File type:	ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.013038433259562
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	rrrdsl.elf
File size:	200'528 bytes
MD5:	48819782a01b2b57ddc437eecae3431a
SHA1:	f39f8483d949349d375132e4ad223373c6f3af8d
SHA256:	6346aac64caa717e670ea357d1d7c0dceba1c65e1f871e9930ec8d5752f075f2
SHA512:	4a54d040eebf36efec2c7e31240a9008e597b4d8fa293a7cecf057d4c32b7094b3d21c5f7d71329e895eeba1485baa3a9bf3c7293615425d9c6964c7da383e4f
SSDEEP:	3072:wrSH8anavqSVVqznas5gKz0CpM4pCzGlDU:wrScanavqSVVt6zxMF6J
TLSH:	FD14C70AAB620EFBDCAFDD3706E9070525CCA50722A53B363674D928F54B54B49E3C78
File Content Preview:	.ELF....................`.@.4... .......4. ...(...............@...@...........................F...F..X.., ..........Q.td...............................<...'!......'.......................<...'!... .........9'.. ........................<h..'!...$........z9

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	199968
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x27a20	0x0	0x6	AX	16
.fini	PROGBITS	0x427b40	0x27b40	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x427ba0	0x27ba0	0x3850	0x0	0x2	A	16
.ctors	PROGBITS	0x46b3f4	0x2b3f4	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x46b400	0x2b400	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x46b40c	0x2b40c	0x474	0x0	0x3	WA	4
.data	PROGBITS	0x46b880	0x2b880	0x49e0	0x0	0x3	WA	32
.got	PROGBITS	0x470260	0x30260	0xa5c	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x470cbc	0x30cbc	0x50	0x0	0x10000003	WAp	4
.bss	NOBITS	0x470d10	0x30cbc	0xc710	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x1332	0x30cbc	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x30cbc	0x64	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x2b3f0	0x2b3f0	5.3285	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x2b3f4	0x46b3f4	0x46b3f4	0x58c8	0x1202c	1.4474	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 5, 2025 12:48:00.293734074 CET	40116	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:00.305584908 CET	53	40116	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:00.313514948 CET	42161	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:00.328907013 CET	53	42161	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:01.034990072 CET	40279	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:01.044730902 CET	53	40279	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:01.056756020 CET	44912	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:01.064011097 CET	53	44912	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:01.775957108 CET	34627	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:01.787549973 CET	53	34627	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:01.796555042 CET	44922	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:01.803544998 CET	53	44922	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:02.500639915 CET	50184	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:02.507807970 CET	53	50184	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:02.514853954 CET	51849	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:02.527924061 CET	53	51849	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:03.229253054 CET	54788	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:03.242599010 CET	53	54788	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:03.248477936 CET	51081	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:03.256902933 CET	53	51081	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:03.967578888 CET	44003	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:03.977633953 CET	53	44003	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:03.989506960 CET	38445	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:03.996670008 CET	53	38445	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:04.680527925 CET	42480	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:04.691452980 CET	53	42480	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:04.695614100 CET	43199	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:04.704283953 CET	53	43199	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:05.430896997 CET	52345	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:05.438153982 CET	53	52345	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:05.449827909 CET	33265	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:05.456933975 CET	53	33265	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:06.216645002 CET	55028	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:06.224245071 CET	53	55028	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:06.231174946 CET	42786	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:06.238342047 CET	53	42786	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:06.948643923 CET	58554	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:06.955894947 CET	53	58554	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:06.961081028 CET	55774	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:06.968327999 CET	53	55774	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:07.690059900 CET	44952	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:07.697082996 CET	53	44952	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:07.720617056 CET	42673	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:07.728050947 CET	53	42673	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:08.432910919 CET	48268	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:08.440452099 CET	53	48268	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:08.448889017 CET	57507	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:08.456295013 CET	53	57507	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:09.142903090 CET	56065	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:09.149535894 CET	53	56065	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:09.150464058 CET	60651	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:09.157881021 CET	53	60651	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:09.842520952 CET	42487	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:09.850378990 CET	53	42487	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:09.853651047 CET	44658	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:09.866957903 CET	53	44658	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:10.561465979 CET	35399	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:10.568610907 CET	53	35399	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:10.569356918 CET	59993	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:10.576833963 CET	53	59993	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:11.301709890 CET	52871	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:11.312880993 CET	53	52871	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:11.313673973 CET	48737	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:11.322915077 CET	53	48737	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:12.033513069 CET	36017	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:12.040960073 CET	53	36017	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:12.042531013 CET	43758	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:12.050590992 CET	53	43758	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:12.760442019 CET	37175	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:12.769007921 CET	53	37175	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:12.778563976 CET	45530	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:12.785949945 CET	53	45530	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:13.506587982 CET	56821	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:13.514034033 CET	53	56821	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:13.515944004 CET	49572	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:13.522989988 CET	53	49572	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:14.216641903 CET	58136	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:14.224056959 CET	53	58136	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:14.240639925 CET	47657	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:14.247298956 CET	53	47657	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:18.580329895 CET	46466	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:18.587455034 CET	53	46466	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:18.603558064 CET	47906	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:18.611120939 CET	53	47906	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:19.384350061 CET	55794	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:19.393399954 CET	53	55794	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:19.453767061 CET	47536	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:19.461251020 CET	53	47536	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:20.160528898 CET	34055	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:20.167655945 CET	53	34055	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:20.168514013 CET	40079	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:20.175422907 CET	53	40079	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:20.870244980 CET	48139	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:20.877295971 CET	53	48139	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:20.889332056 CET	60405	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:20.896739006 CET	53	60405	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:21.582741022 CET	46784	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:21.590418100 CET	53	46784	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:21.591408014 CET	51597	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:21.597971916 CET	53	51597	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:22.298525095 CET	53739	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:22.305152893 CET	53	53739	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:22.306148052 CET	43306	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:22.313559055 CET	53	43306	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:23.018584967 CET	43709	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:23.025962114 CET	53	43709	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:23.027209997 CET	36591	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:23.033862114 CET	53	36591	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:23.729501963 CET	50794	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:23.736473083 CET	53	50794	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:23.738907099 CET	41229	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:23.746330976 CET	53	41229	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:24.440728903 CET	54896	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:24.448343039 CET	53	54896	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:24.449018002 CET	57013	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:24.456511974 CET	53	57013	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:25.135101080 CET	44421	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:25.142266035 CET	53	44421	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:25.143177032 CET	45159	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:25.150193930 CET	53	45159	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:25.849797010 CET	42246	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:25.856364012 CET	53	42246	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:25.857557058 CET	60792	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:25.865098000 CET	53	60792	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:26.553642035 CET	43575	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:26.561419010 CET	53	43575	8.8.8.8	192.168.2.13
Mar 5, 2025 12:48:26.562741995 CET	37670	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:48:26.570075035 CET	53	37670	8.8.8.8	192.168.2.13
Mar 5, 2025 12:49:53.306700945 CET	50715	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:49:53.313905954 CET	53	50715	8.8.8.8	192.168.2.13
Mar 5, 2025 12:49:53.314492941 CET	41027	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:49:53.323163986 CET	53	41027	8.8.8.8	192.168.2.13
Mar 5, 2025 12:49:54.009146929 CET	44862	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:49:54.016108990 CET	53	44862	8.8.8.8	192.168.2.13
Mar 5, 2025 12:49:54.016707897 CET	45633	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:49:54.023907900 CET	53	45633	8.8.8.8	192.168.2.13
Mar 5, 2025 12:49:54.726681948 CET	44116	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:49:54.734181881 CET	53	44116	8.8.8.8	192.168.2.13
Mar 5, 2025 12:49:54.734844923 CET	43337	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:49:54.742783070 CET	53	43337	8.8.8.8	192.168.2.13
Mar 5, 2025 12:49:55.419346094 CET	58629	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:49:55.426454067 CET	53	58629	8.8.8.8	192.168.2.13
Mar 5, 2025 12:49:55.427309036 CET	39389	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:49:55.433949947 CET	53	39389	8.8.8.8	192.168.2.13
Mar 5, 2025 12:49:56.141187906 CET	51279	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:49:56.149616957 CET	53	51279	8.8.8.8	192.168.2.13
Mar 5, 2025 12:49:56.150583029 CET	39770	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:49:56.159568071 CET	53	39770	8.8.8.8	192.168.2.13
Mar 5, 2025 12:49:56.851998091 CET	52490	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:49:56.859440088 CET	53	52490	8.8.8.8	192.168.2.13
Mar 5, 2025 12:49:56.860480070 CET	40434	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:49:56.867125988 CET	53	40434	8.8.8.8	192.168.2.13
Mar 5, 2025 12:49:57.551996946 CET	44982	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:49:57.560749054 CET	53	44982	8.8.8.8	192.168.2.13
Mar 5, 2025 12:49:57.562098980 CET	47785	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:49:57.569506884 CET	53	47785	8.8.8.8	192.168.2.13
Mar 5, 2025 12:49:58.283423901 CET	34355	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:49:58.290397882 CET	53	34355	8.8.8.8	192.168.2.13
Mar 5, 2025 12:49:58.291304111 CET	33354	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:49:58.298888922 CET	53	33354	8.8.8.8	192.168.2.13
Mar 5, 2025 12:49:58.990700006 CET	35164	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:49:58.997251987 CET	53	35164	8.8.8.8	192.168.2.13
Mar 5, 2025 12:49:58.998115063 CET	39184	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:49:59.005095959 CET	53	39184	8.8.8.8	192.168.2.13
Mar 5, 2025 12:49:59.699116945 CET	45766	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:49:59.706595898 CET	53	45766	8.8.8.8	192.168.2.13
Mar 5, 2025 12:49:59.707489014 CET	35507	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:49:59.714344978 CET	53	35507	8.8.8.8	192.168.2.13
Mar 5, 2025 12:50:00.413906097 CET	49426	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:50:00.421422005 CET	53	49426	8.8.8.8	192.168.2.13
Mar 5, 2025 12:50:00.422281981 CET	57347	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:50:00.429450035 CET	53	57347	8.8.8.8	192.168.2.13
Mar 5, 2025 12:50:01.113504887 CET	46997	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:50:01.120456934 CET	53	46997	8.8.8.8	192.168.2.13
Mar 5, 2025 12:50:01.121244907 CET	57093	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:50:01.128195047 CET	53	57093	8.8.8.8	192.168.2.13
Mar 5, 2025 12:50:01.816745043 CET	55622	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:50:01.824373007 CET	53	55622	8.8.8.8	192.168.2.13
Mar 5, 2025 12:50:01.825129986 CET	50465	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:50:01.831953049 CET	53	50465	8.8.8.8	192.168.2.13
Mar 5, 2025 12:50:02.533269882 CET	59063	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:50:02.542885065 CET	53	59063	8.8.8.8	192.168.2.13
Mar 5, 2025 12:50:02.543637037 CET	59092	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:50:02.551805019 CET	53	59092	8.8.8.8	192.168.2.13
Mar 5, 2025 12:50:04.238765001 CET	52617	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:50:04.248039007 CET	53	52617	8.8.8.8	192.168.2.13
Mar 5, 2025 12:50:04.255929947 CET	57446	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:50:04.262522936 CET	53	57446	8.8.8.8	192.168.2.13
Mar 5, 2025 12:50:05.121660948 CET	39122	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:50:05.129432917 CET	53	39122	8.8.8.8	192.168.2.13
Mar 5, 2025 12:50:05.130434036 CET	41229	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:50:05.139270067 CET	53	41229	8.8.8.8	192.168.2.13
Mar 5, 2025 12:50:05.842592001 CET	51143	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:50:05.850259066 CET	53	51143	8.8.8.8	192.168.2.13
Mar 5, 2025 12:50:05.850979090 CET	47017	53	192.168.2.13	8.8.8.8
Mar 5, 2025 12:50:05.858285904 CET	53	47017	8.8.8.8	192.168.2.13

Start time (UTC):	11:47:58
Start date (UTC):	05/03/2025
Path:	/tmp/rrrdsl.elf
Arguments:	/tmp/rrrdsl.elf
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Start time (UTC):	11:47:59
Start date (UTC):	05/03/2025
Path:	/tmp/rrrdsl.elf
Arguments:	-
File size:	5773336 bytes
MD5 hash:	0d6f61f82cf2f781c6eb0661071d42d9

Start time (UTC):	11:48:00
Start date (UTC):	05/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	11:48:06
Start date (UTC):	05/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	-
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	11:48:05
Start date (UTC):	05/03/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	11:48:07
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:48:11
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:48:13
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:48:16
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:48:18
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:48:21
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:48:22
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:48:24
Start date (UTC):	05/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	11:48:25
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:48:28
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report rrrdsl.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.izvp7T (deleted)

/var/log/kern.log

/var/log/syslog

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: rrrdsl.elf PID: 5445, Parent PID: 5367

General

File Activities

File Opened

File Deleted

File Read

File Written

File Moved

Process Activities

Process Forked

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: rrrdsl.elf PID: 5447, Parent PID: 5445

General

Linux Analysis Report
rrrdsl.elf

Start time (UTC):	11:48:31
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:48:34
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:48:37
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:48:41
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:48:44
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:48:47
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:48:50
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:48:53
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:48:56
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	11:49:00
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75