Create Interactive Tour

Linux Analysis Report
drea4.elf

Overview

General Information

Sample name:	drea4.elf
Analysis ID:	1630485
MD5:	b5e8d13878f5977fbcf5c17d077b7fc6
SHA1:	f8faa9fa607380f19bd7b017a567561a2f7482e4
SHA256:	a2a3d78a4c853464c0bdc960bbe43de7dbdbd3fb2209213c1be15770f35adf70
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	60
Range:	0 - 100

Signatures

Multi AV Scanner detection for submitted file

Sample deletes itself

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1630485
Start date and time:	2025-03-05 23:22:47 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	drea4.elf
Detection:	MAL
Classification:	mal60.spre.troj.evad.linELF@0/55@61/0

Runtime Messages

Command:	/tmp/drea4.elf
PID:	6254
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	kovey/cursinq was here, go away!
Standard Error:

Process Tree

system is lnxubuntu20

drea4.elf (PID: 6254, Parent: 6178, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/drea4.elf

drea4.elf New Fork (PID: 6256, Parent: 6254)

drea4.elf New Fork (PID: 6258, Parent: 6256)

drea4.elf New Fork (PID: 6260, Parent: 6256)

drea4.elf New Fork (PID: 6262, Parent: 6256)

systemd New Fork (PID: 6290, Parent: 1)

rsyslogd (PID: 6290, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

xfce4-panel New Fork (PID: 6291, Parent: 2063)

wrapper-2.0 (PID: 6291, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 6292, Parent: 2063)

wrapper-2.0 (PID: 6292, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 6293, Parent: 2063)

wrapper-2.0 (PID: 6293, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 6294, Parent: 2063)

wrapper-2.0 (PID: 6294, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

wrapper-2.0 New Fork (PID: 6323, Parent: 6294)

xfpm-power-backlight-helper (PID: 6323, Parent: 6294, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness

xfce4-panel New Fork (PID: 6295, Parent: 2063)

wrapper-2.0 (PID: 6295, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

systemd New Fork (PID: 6296, Parent: 1)

rsyslogd (PID: 6296, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

xfce4-panel New Fork (PID: 6299, Parent: 2063)

wrapper-2.0 (PID: 6299, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

dbus-daemon New Fork (PID: 6318, Parent: 6317)

xfconfd (PID: 6318, Parent: 6317, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

systemd New Fork (PID: 6345, Parent: 1)

rsyslogd (PID: 6345, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6368, Parent: 1)

rsyslogd (PID: 6368, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6374, Parent: 1)

rsyslogd (PID: 6374, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6383, Parent: 1)

rsyslogd (PID: 6383, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6387, Parent: 1)

rsyslogd (PID: 6387, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6411, Parent: 1)

rsyslogd (PID: 6411, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6417, Parent: 1)

rsyslogd (PID: 6417, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6438, Parent: 1)

rsyslogd (PID: 6438, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6461, Parent: 1)

rsyslogd (PID: 6461, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6483, Parent: 1)

rsyslogd (PID: 6483, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6508, Parent: 1)

rsyslogd (PID: 6508, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6532, Parent: 1)

rsyslogd (PID: 6532, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6555, Parent: 1)

rsyslogd (PID: 6555, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6576, Parent: 1)

rsyslogd (PID: 6576, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6583, Parent: 1)

rsyslogd (PID: 6583, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6603, Parent: 1)

rsyslogd (PID: 6603, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6624, Parent: 1)

rsyslogd (PID: 6624, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6646, Parent: 1)

rsyslogd (PID: 6646, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6670, Parent: 1)

rsyslogd (PID: 6670, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6693, Parent: 1)

rsyslogd (PID: 6693, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6700, Parent: 1)

rsyslogd (PID: 6700, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6724, Parent: 1)

rsyslogd (PID: 6724, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6750, Parent: 1)

rsyslogd (PID: 6750, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6775, Parent: 1)

rsyslogd (PID: 6775, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6797, Parent: 1)

rsyslogd (PID: 6797, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6806, Parent: 1)

rsyslogd (PID: 6806, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

cleanup

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: drea4.elf	Virustotal: Detection: 25%			Perma Link
Source: drea4.elf	ReversingLabs: Detection: 34%

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: raw.awaken-network.net. [malformed]

Source: global traffic

TCP traffic: 192.168.2.23:50628 -> 141.98.10.142:7733

Source: /usr/sbin/rsyslogd (PID: 6296)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6345)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6368)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6374)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6383)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6387)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6411)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6417)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6438)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6461)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6483)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6508)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6532)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6555)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6576)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6583)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6603)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6624)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6646)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6670)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6693)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6700)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6724)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6750)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6775)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6797)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6806)	Reads hosts file: /etc/hosts	Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43

Source: global traffic	DNS traffic detected: DNS query: raw.awaken-network.net
Source: global traffic	DNS traffic detected: DNS query: raw.awaken-network.net. [malformed]

Source: syslog.48.dr, syslog.84.dr, syslog.88.dr, syslog.44.dr, syslog.86.dr, syslog.82.dr, syslog.76.dr, syslog.52.dr, syslog.62.dr, syslog.74.dr, syslog.68.dr, syslog.78.dr, syslog.38.dr, syslog.50.dr, syslog.60.dr, syslog.80.dr, syslog.72.dr, syslog.64.dr, syslog.56.dr, syslog.42.dr, syslog.54.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/drea4.elf (PID: 6256)	SIGKILL sent: pid: 6260, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 847, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 912, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 918, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6262, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6290, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6291, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6292, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6293, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6294, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6295, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6296, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6299, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6318, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6345, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6368, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6374, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6383, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6387, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6411, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6417, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6438, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6461, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6483, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6508, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6532, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6555, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6576, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6583, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6603, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6624, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6646, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6670, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6693, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6700, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6724, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6750, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6775, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6797, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: sys_monitor_cnrbusyboxadbddockerdBlink_Cloudsystemdhttpshsshdbashmsg_centerlte_mgrmain_mgrpkarm7pkarm5pkarmpkarm6pkmipspkmpslpkx86/tmp/var/mnt/root/boot/sbin/home/dev/media/opt/../(deleted)x86armmipsmpslsh4arm5arm6%s/%s/data/local/tmp/bin/dev/null/dev/console/var/lib/dockerraw.awaken-network.netabcdefghijklmnopqrstuvwxyz/proc/%d/cmdline/proc/%d/proc/selfhttpd/proc/self/exe/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbin/poweroff/usr/bin/poweroff/usr/sbin/halt/usr/bin/halt

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/drea4.elf (PID: 6256)	SIGKILL sent: pid: 6260, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 847, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 912, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 918, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6262, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6290, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6291, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6292, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6293, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6294, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6295, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6296, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6299, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6318, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6345, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6368, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6374, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6383, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6387, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6411, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6417, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6438, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6461, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6483, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6508, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6532, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6555, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6576, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6583, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6603, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6624, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6646, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6670, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6693, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6700, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6724, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6750, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6775, result: successful	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	SIGKILL sent: pid: 6797, result: successful	Jump to behavior

Source: classification engine

Classification label: mal60.spre.troj.evad.linELF@0/55@61/0

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6291)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6292)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6293)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6294)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6295)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6295)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6295)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6295)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6318)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6318)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6318)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6318)	Directory: /home/saturnino/.config	Jump to behavior

Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/6351/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/6351/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/6353/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/6353/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/6352/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/6352/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/6355/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/6355/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/6354/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/6354/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/6236/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/6236/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/6236/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/6357/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/6357/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/6356/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/6356/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/1582/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/1582/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/1582/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/1579/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/1579/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/1579/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/1699/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/1699/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/1699/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/1698/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/1698/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/1698/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/1576/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/1576/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/1576/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/2307/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/2307/stat	Jump to behavior
Source: /tmp/drea4.elf (PID: 6258)	File opened: /proc/2307/stat	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6296)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6345)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6368)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6374)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6383)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6387)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6411)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6417)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6438)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6461)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6483)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6508)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6532)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6555)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6576)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6583)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6603)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6624)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6646)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6670)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6693)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6700)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6724)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6750)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6775)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6797)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6806)	Log file created: /var/log/kern.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/drea4.elf (PID: 6256)

File: /tmp/drea4.elf

Jump to behavior

Source: /tmp/drea4.elf (PID: 6254)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6291)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6292)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6293)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6294)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6295)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6296)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6299)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6345)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6368)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6374)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6383)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6387)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6411)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6417)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6438)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6461)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6483)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6508)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6532)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6555)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6576)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6583)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6603)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6624)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6646)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6670)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6693)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6700)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6724)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6750)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6775)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6797)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6806)	Queries kernel information via 'uname':	Jump to behavior

Source: drea4.elf, 6262.1.000056537f68c000.000056537f7ba000.rw-.sdmp	Binary or memory string: /arm/tmp/vmware-root_721-4290559889
Source: drea4.elf, 6262.1.000056537f68c000.000056537f7ba000.rw-.sdmp	Binary or memory string: !/data/local/tmp1/tmp/vmware-root_721-4290559889
Source: drea4.elf, 6262.1.000056537f68c000.000056537f7ba000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmtX
Source: drea4.elf, 6262.1.00007fa09c049000.00007fa09c051000.rw-.sdmp	Binary or memory string: vmware
Source: drea4.elf, 6262.1.000056537f7ba000.000056537f7db000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm/var/lib/emacsen-common/state/package/installed
Source: drea4.elf, 6254.1.00007fff896c1000.00007fff896e2000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.ttCdX7
Source: drea4.elf, 6262.1.00007fa09c049000.00007fa09c051000.rw-.sdmp	Binary or memory string: T/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-fwupd.service-gB0a9f/tmpX/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-logind.service-IofUpj\/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-logind.service-IofUpj/tmp$/tmp/vmware-root_721-4290559889P/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-upower.service-x0xO0i4/tmp/snap.lxd
Source: drea4.elf, 6262.1.000056537f7ba000.000056537f7db000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmtP
Source: drea4.elf, 6262.1.000056537f68c000.000056537f7ba000.rw-.sdmp	Binary or memory string: /tmp/vmware-root_721-4290559889
Source: drea4.elf, 6262.1.000056537f7ba000.000056537f7db000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm/var/lib/emacsen-common/state/package/installed1
Source: drea4.elf, 6254.1.000056537f68c000.000056537f7ba000.rw-.sdmp, drea4.elf, 6260.1.000056537f68c000.000056537f7ba000.rw-.sdmp, drea4.elf, 6262.1.000056537f68c000.000056537f7ba000.rw-.sdmp	Binary or memory string: SV!/etc/qemu-binfmt/arm
Source: drea4.elf, 6262.1.000056537f68c000.000056537f7ba000.rw-.sdmp	Binary or memory string: SV/arm/tmp/vmware-root_721-4290559889a/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-timedated.service-MVXQwjea/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-ModemManager.service-c4RYFitimedaa/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-ModemManager.service-c4RYFi/tmp.sA/var/lib/polkit-1/localauthority/90-mandatory.dQ/var/lib/emacsen-common/state/package/installed
Source: drea4.elf, 6254.1.000056537f68c000.000056537f7ba000.rw-.sdmp, drea4.elf, 6260.1.000056537f68c000.000056537f7ba000.rw-.sdmp, drea4.elf, 6262.1.000056537f68c000.000056537f7ba000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: drea4.elf, 6254.1.00007fff896c1000.00007fff896e2000.rw-.sdmp, drea4.elf, 6260.1.00007fff896c1000.00007fff896e2000.rw-.sdmp, drea4.elf, 6262.1.00007fff896c1000.00007fff896e2000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: drea4.elf, 6262.1.000056537f7ba000.000056537f7db000.rw-.sdmp	Binary or memory string: A/var/lib/polkit-1/localauthority/20-org.d!/var/lib/emacsen-common!/var/log/journal!/var/lib/sgml-basem/varQ/var/lib/polkit-1/localauthority/50-local.d/etc/qemu-binfmtP!/var/lib/hp4fa47433baee1 \|{
Source: drea4.elf, 6254.1.00007fff896c1000.00007fff896e2000.rw-.sdmp, drea4.elf, 6260.1.00007fff896c1000.00007fff896e2000.rw-.sdmp, drea4.elf, 6262.1.00007fff896c1000.00007fff896e2000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/drea4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/drea4.elf
Source: drea4.elf, 6254.1.00007fff896c1000.00007fff896e2000.rw-.sdmp	Binary or memory string: \|SV/tmp/qemu-open.ttCdX7:%

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
drea4.elf	25%	Virustotal		Browse
drea4.elf	34%	ReversingLabs	Linux.Backdoor.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
raw.awaken-network.net	141.98.10.142	true	false		high
raw.awaken-network.net. [malformed]	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.48.dr, syslog.84.dr, syslog.88.dr, syslog.44.dr, syslog.86.dr, syslog.82.dr, syslog.76.dr, syslog.52.dr, syslog.62.dr, syslog.74.dr, syslog.68.dr, syslog.78.dr, syslog.38.dr, syslog.50.dr, syslog.60.dr, syslog.80.dr, syslog.72.dr, syslog.64.dr, syslog.56.dr, syslog.42.dr, syslog.54.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
141.98.10.142	raw.awaken-network.net	Lithuania	209605	HOSTBALTICLT	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
141.98.10.142	jfeeps.elf	Get hash	malicious	Unknown	Browse
	eehah4.elf	Get hash	malicious	Unknown	Browse
	vjwe68k.elf	Get hash	malicious	Unknown	Browse
	rjfe686.elf	Get hash	malicious	Unknown	Browse
	efjepc.elf	Get hash	malicious	Unknown	Browse
	rrrdsl.elf	Get hash	malicious	Unknown	Browse
	eehah4.elf	Get hash	malicious	Unknown	Browse
	efefa7.elf	Get hash	malicious	Mirai	Browse
	vejfa5.elf	Get hash	malicious	Unknown	Browse
	rjfe686.elf	Get hash	malicious	Unknown	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	na.elf	Get hash	malicious	Prometei	Browse
	eehah4.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	rjfe686.elf	Get hash	malicious	Unknown	Browse
	rrrdsl.elf	Get hash	malicious	Unknown	Browse
	donk.mpsl.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	donk.arm6.elf	Get hash	malicious	Mirai	Browse
	donk.x86.elf	Get hash	malicious	Mirai	Browse
	donk.arm7.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	na.elf	Get hash	malicious	Prometei	Browse
	eehah4.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	rjfe686.elf	Get hash	malicious	Unknown	Browse
	rrrdsl.elf	Get hash	malicious	Unknown	Browse
	donk.mpsl.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	donk.arm6.elf	Get hash	malicious	Mirai	Browse
	donk.x86.elf	Get hash	malicious	Mirai	Browse
	donk.arm7.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.awaken-network.net	jfeeps.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	efjepc.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	141.98.10.142

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	jfeeps.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	eehah4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	rjfe686.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	donk.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	donk.mips.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	donk.arm6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
CANONICAL-ASGB	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	jfeeps.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	eehah4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	rjfe686.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	donk.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	donk.mips.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	donk.arm6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
HOSTBALTICLT	jfeeps.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	eehah4.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	vjwe68k.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	rjfe686.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	efjepc.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	eehah4.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	efefa7.elf	Get hash	malicious	Mirai	Browse	141.98.10.142
	vejfa5.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	rjfe686.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
INIT7CH	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	eehah4.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	rjfe686.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	donk.mpsl.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	donk.arm6.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	donk.x86.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	donk.arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.ttCdX7 (deleted)

Download File

Process:	/tmp/drea4.elf
File Type:	data
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.0536606896881855
Encrypted:	false
SSDEEP:	3:TghA4LiloHJN:TgWGilaJN
MD5:	483D6A09B2CA216506A99F8710FAB5BF
SHA1:	B0AEB578E506E3F7369C95EE5DAACB58F79C5541
SHA-256:	E4A0665D33137B88F25EE53F14032589A277B97D643F210CF387EB748E5E39B9
SHA-512:	6366E089E41B4A0CECD9B63B35A6ED1BDB4E96CEFBE795B93DE306720086CB7E7DDBFF25D50FFE75BC415C48056F7D552FF18E6597845BC473C728EA9423E13B
Malicious:	false
Reputation:	low
Preview:	/tmp/drea4.elf.nwlrbbmqbh

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	799
Entropy (8bit):	4.704404845899859
Encrypted:	false
SSDEEP:	24:pjy5hcgxy5SGgkxy5Nghby5Hkg/ly52g6y5JGgTy5njgxy5xmAIyXy5AdAIy+:tyjy1xyiyXly0yDyRIyD40yA/
MD5:	559D18A4F366113D26B8122EEA91B4A8
SHA1:	F05FF3D7B1F675111E8A9579D62CD82CF8A46085
SHA-256:	41FC191CA4063B200E26DACB8331EB166D28CD55C0E0BB28A6687C0CF13E7764
SHA-512:	6A754DC9A016A2CD5FE167D8A54007670BE82E506EAE968515B4AA11AFD8B1EF7B06C18941D299EB630D593A7BCF3B484D5B3AAF9D0CEDCEA9737976A33FF177
Malicious:	false
Reputation:	low
Preview:	Mar 5 16:25:39 galassia kernel: [ 541.865829] blocking signal 9: 6258 -> 1320.Mar 5 16:25:39 galassia kernel: [ 541.940365] blocking signal 9: 6258 -> 658.Mar 5 16:25:39 galassia kernel: [ 541.950470] blocking signal 9: 6258 -> 772.Mar 5 16:25:39 galassia kernel: [ 541.962010] blocking signal 9: 6258 -> 800.Mar 5 16:25:39 galassia kernel: [ 541.972084] blocking signal 9: 6258 -> 847.Mar 5 16:25:39 galassia kernel: [ 541.982355] blocking signal 9: 6258 -> 936.Mar 5 16:25:39 galassia kernel: [ 541.992148] blocking signal 9: 6258 -> 1320.Mar 5 16:25:39 galassia kernel: [ 542.253864] New task spawned: old: (tgid 6806, tid 6806), new (tgid: 6806, tid: 6807).Mar 5 16:25:39 galassia kernel: [ 542.254599] New task spawned: old: (tgid 6806, tid 6806), new (tgid: 6806, tid: 6808).

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	5.009190639709105
Encrypted:	false
SSDEEP:	48:p3FDwOPtVUR11yjy1xyiyXly0yDyRIyD40yAVjkCvxh/Oh:wOtVUR11yUxlGP8b+Vx4wxh/I
MD5:	E91E33D987E409D53A70529BF811EAB5
SHA1:	56C32E54D7E21F014E2A19FC05472BD358AE9393
SHA-256:	79240F5146CA782ED4BBAF2E8BF8075770051CBDA532BC159D23571261233DE3
SHA-512:	89B722F0B709F8AF0E74C11F335BA706657D7D41F94F5F19684AEFC9FD52BB2FE12E516E6D4CD585CBA37647AD7C710CAB6967EC8B3B0B168A4CAFFBC3FA4B9C
Malicious:	false
Reputation:	low
Preview:	Mar 5 16:25:38 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Mar 5 16:25:38 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Mar 5 16:25:39 galassia systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 28..Mar 5 16:25:39 galassia systemd[1]: Stopped System Logging Service..Mar 5 16:25:39 galassia systemd[1]: Starting System Logging Service....Mar 5 16:25:39 galassia systemd[1]: Started System Logging Service..Mar 5 16:25:39 galassia kernel: [ 541.865829] blocking signal 9: 6258 -> 1320.Mar 5 16:25:39 galassia kernel: [ 541.940365] blocking signal 9: 6258 -> 658.Mar 5 16:25:39 galassia kernel: [ 541.950470] blocking signal 9: 6258 -> 772.Mar 5 16:25:39 galassia kernel: [ 541.962010] blocking signal 9: 6258 -> 800.Mar 5 16:25:39 galassia kernel: [ 541.972084] blocking signal 9: 6258 -> 847.Mar 5 16:25:39 galassia kernel: [ 541.982355] blocking signal 9: 6258 -> 936.Mar 5 16:25:39 galassia ke

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	5.43781780338832
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	drea4.elf
File size:	150'336 bytes
MD5:	b5e8d13878f5977fbcf5c17d077b7fc6
SHA1:	f8faa9fa607380f19bd7b017a567561a2f7482e4
SHA256:	a2a3d78a4c853464c0bdc960bbe43de7dbdbd3fb2209213c1be15770f35adf70
SHA512:	558ae4b155d05c6a404ece7069d5ed85027dbf8ab2f2553e40223f2bda9ea87448810862598e1cb942fca11cfee01a95b2284ad2217a49a27ce4c1099b49c8b8
SSDEEP:	1536:EsmwJMyKjZ7XF0IZwepFb2IXM4V5RTYTltjGROfxOtpPiP7tIqilFgwywM/NZeLW:Esmw7E2IhFb64ZsBtjGUxj2fSC/A
TLSH:	D7E30845BC419B23C6D722BBFB5E428D772617A8D3EE720399256F20378B95B0E37142
File Content Preview:	.ELF...a..........(.........4....I......4. ...(.....................l...l...........................pI..............Q.td..................................-...L."....p..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	149936
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x1c0b0	0x0	0x6	AX	16
.fini	PROGBITS	0x24160	0x1c160	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x24174	0x1c174	0x3af8	0x0	0x2	A	4
.ctors	PROGBITS	0x28000	0x20000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x2800c	0x2000c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x28020	0x20020	0x4950	0x0	0x3	WA	32
.bss	NOBITS	0x2c970	0x24970	0xc598	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x24970	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x1fc6c	0x1fc6c	5.9223	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x20000	0x28000	0x28000	0x4970	0x10f08	0.4492	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 5, 2025 23:23:36.845518112 CET	46135	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:36.856759071 CET	53	46135	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:36.916392088 CET	56247	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:36.923350096 CET	53	56247	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:36.948611021 CET	39459	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:36.955486059 CET	53	39459	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:36.957478046 CET	39353	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:36.963979959 CET	53	39353	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:36.976660967 CET	46475	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:36.984833956 CET	53	46475	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:37.005979061 CET	53094	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:37.012485027 CET	53	53094	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:37.844405890 CET	55746	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:37.851246119 CET	53	55746	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:37.968041897 CET	35876	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:37.974848986 CET	53	35876	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:37.996628046 CET	52815	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:38.004296064 CET	53	52815	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:38.011467934 CET	56607	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:38.018290043 CET	53	56607	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:38.025103092 CET	36202	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:38.032217026 CET	53	36202	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:38.091654062 CET	34325	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:38.098229885 CET	53	34325	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:38.200135946 CET	44447	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:38.207076073 CET	53	44447	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:38.313924074 CET	46732	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:38.321099997 CET	53	46732	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:38.330636024 CET	42168	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:38.338208914 CET	53	42168	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:38.370556116 CET	49615	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:38.377285004 CET	53	49615	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:39.079602957 CET	48345	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:39.085998058 CET	53	48345	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:39.090806961 CET	57670	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:39.097470045 CET	53	57670	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:39.099021912 CET	38410	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:39.105815887 CET	53	38410	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:39.110621929 CET	36580	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:39.117214918 CET	53	36580	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:39.121381998 CET	44890	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:39.127908945 CET	53	44890	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:39.133375883 CET	50147	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:39.139663935 CET	53	50147	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:39.144233942 CET	41647	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:39.150863886 CET	53	41647	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:39.155966043 CET	38162	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:39.162635088 CET	53	38162	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:39.167876005 CET	42899	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:39.174566984 CET	53	42899	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:39.179804087 CET	43106	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:39.186388969 CET	53	43106	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:55.230313063 CET	40957	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:55.237174988 CET	53	40957	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:55.238974094 CET	53903	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:55.245721102 CET	53	53903	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:55.247145891 CET	35819	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:55.253865957 CET	53	35819	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:55.255336046 CET	41764	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:55.262190104 CET	53	41764	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:55.263673067 CET	48793	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:55.270508051 CET	53	48793	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:55.272510052 CET	48009	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:55.279690981 CET	53	48009	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:55.281436920 CET	37677	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:55.288561106 CET	53	37677	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:55.292067051 CET	45107	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:55.298624992 CET	53	45107	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:55.300239086 CET	43174	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:55.306906939 CET	53	43174	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:55.308356047 CET	45226	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:55.315129042 CET	53	45226	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:56.026211023 CET	34732	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:56.033411980 CET	53	34732	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:56.034611940 CET	54558	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:56.041892052 CET	53	54558	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:56.043325901 CET	57243	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:56.050796032 CET	53	57243	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:56.052334070 CET	53192	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:56.060842037 CET	53	53192	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:56.062474966 CET	50377	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:56.069679022 CET	53	50377	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:56.071343899 CET	34982	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:56.078411102 CET	53	34982	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:56.080027103 CET	40027	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:56.086993933 CET	53	40027	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:56.088207960 CET	55034	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:56.094935894 CET	53	55034	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:56.096362114 CET	51798	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:56.104281902 CET	53	51798	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:56.105952024 CET	37818	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:56.113147974 CET	53	37818	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:56.812356949 CET	43288	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:56.819427967 CET	53	43288	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:56.820615053 CET	35221	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:56.827215910 CET	53	35221	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:56.828304052 CET	44461	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:56.835128069 CET	53	44461	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:56.836225033 CET	51385	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:56.843244076 CET	53	51385	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:56.844160080 CET	36916	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:56.850826025 CET	53	36916	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:56.851833105 CET	49899	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:56.858354092 CET	53	49899	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:56.859544039 CET	42430	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:56.865988970 CET	53	42430	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:56.867078066 CET	40432	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:56.873718023 CET	53	40432	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:56.874706984 CET	46355	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:56.881170988 CET	53	46355	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:56.882488966 CET	42493	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:56.889153004 CET	53	42493	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:57.602740049 CET	57499	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:57.609453917 CET	53	57499	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:57.610877037 CET	41574	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:57.617548943 CET	53	41574	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:57.619086981 CET	49674	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:57.626717091 CET	53	49674	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:57.628031969 CET	49224	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:57.634752035 CET	53	49224	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:57.636363029 CET	39540	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:57.643018007 CET	53	39540	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:57.644438982 CET	55314	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:57.651173115 CET	53	55314	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:57.652559042 CET	59956	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:57.659061909 CET	53	59956	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:57.660298109 CET	56173	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:57.666949034 CET	53	56173	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:57.667876005 CET	60439	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:57.674384117 CET	53	60439	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:57.675821066 CET	47351	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:57.682482004 CET	53	47351	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:58.371929884 CET	46844	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:58.378479958 CET	53	46844	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:58.379318953 CET	52702	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:58.385941029 CET	53	52702	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:58.386758089 CET	48224	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:58.393261909 CET	53	48224	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:58.394110918 CET	42003	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:58.400980949 CET	53	42003	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:58.401839972 CET	55325	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:58.408567905 CET	53	55325	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:58.409369946 CET	35013	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:58.416320086 CET	53	35013	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:58.417136908 CET	43092	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:58.423893929 CET	53	43092	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:58.424743891 CET	34376	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:58.431370974 CET	53	34376	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:58.432302952 CET	51735	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:58.438692093 CET	53	51735	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:58.439482927 CET	55107	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:58.445919037 CET	53	55107	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:59.319071054 CET	51051	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:59.325848103 CET	53	51051	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:59.326853991 CET	60736	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:59.333677053 CET	53	60736	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:59.334589958 CET	38731	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:59.341099977 CET	53	38731	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:59.342122078 CET	48899	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:59.348889112 CET	53	48899	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:59.349715948 CET	57110	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:59.356458902 CET	53	57110	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:59.358289003 CET	55101	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:59.364718914 CET	53	55101	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:59.366548061 CET	46822	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:59.373246908 CET	53	46822	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:59.375562906 CET	49663	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:59.382128000 CET	53	49663	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:59.384269953 CET	38025	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:59.390862942 CET	53	38025	8.8.8.8	192.168.2.23
Mar 5, 2025 23:23:59.392807961 CET	52240	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:23:59.399244070 CET	53	52240	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:00.096858978 CET	40548	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:00.104967117 CET	53	40548	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:00.106030941 CET	35502	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:00.114092112 CET	53	35502	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:00.115143061 CET	37134	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:00.121642113 CET	53	37134	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:00.122699022 CET	47514	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:00.129223108 CET	53	47514	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:00.130317926 CET	39110	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:00.138386965 CET	53	39110	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:00.139472008 CET	37866	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:00.146683931 CET	53	37866	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:00.147743940 CET	32969	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:00.155877113 CET	53	32969	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:00.156996012 CET	52656	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:00.164936066 CET	53	52656	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:00.165973902 CET	41419	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:00.173693895 CET	53	41419	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:00.174727917 CET	60555	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:00.181077957 CET	53	60555	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:00.872098923 CET	47195	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:00.878922939 CET	53	47195	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:00.879957914 CET	34483	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:00.886535883 CET	53	34483	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:00.887492895 CET	51333	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:00.893999100 CET	53	51333	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:00.895248890 CET	48343	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:00.901710033 CET	53	48343	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:00.902652979 CET	52544	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:00.909117937 CET	53	52544	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:00.910711050 CET	43524	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:00.917689085 CET	53	43524	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:00.918713093 CET	34017	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:00.925170898 CET	53	34017	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:00.939122915 CET	39257	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:00.945813894 CET	53	39257	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:00.950789928 CET	47677	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:00.958686113 CET	53	47677	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:00.959830999 CET	44482	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:00.969153881 CET	53	44482	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:01.661279917 CET	51787	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:01.667726040 CET	53	51787	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:01.668854952 CET	60805	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:01.675422907 CET	53	60805	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:01.676541090 CET	42757	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:01.683479071 CET	53	42757	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:01.684494972 CET	45911	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:01.691001892 CET	53	45911	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:01.692056894 CET	49842	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:01.698745966 CET	53	49842	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:01.699790001 CET	43812	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:01.706279039 CET	53	43812	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:01.707364082 CET	47514	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:01.714330912 CET	53	47514	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:01.715374947 CET	47952	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:01.722126007 CET	53	47952	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:01.723124027 CET	58171	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:01.729672909 CET	53	58171	8.8.8.8	192.168.2.23
Mar 5, 2025 23:24:01.730739117 CET	51691	53	192.168.2.23	8.8.8.8
Mar 5, 2025 23:24:01.737190008 CET	53	51691	8.8.8.8	192.168.2.23

Start time (UTC):	22:23:35
Start date (UTC):	05/03/2025
Path:	/tmp/drea4.elf
Arguments:	/tmp/drea4.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	22:23:36
Start date (UTC):	05/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	22:23:45
Start date (UTC):	05/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	-
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	22:23:43
Start date (UTC):	05/03/2025
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	22:23:46
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:23:52
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:23:53
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:23:58
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:23:59
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:24:04
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:24:05
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:24:10
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:24:15
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:24:20
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:24:26
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report drea4.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.ttCdX7 (deleted)

/var/log/kern.log

/var/log/syslog

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: drea4.elf PID: 6254, Parent PID: 6178

General

File Activities

File Opened

File Deleted

File Read

File Written

File Moved

Process Activities

Process Forked

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: drea4.elf PID: 6256, Parent PID: 6254

General

Linux Analysis Report
drea4.elf

Start time (UTC):	22:24:31
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:24:36
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:24:41
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:24:42
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:24:47
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:24:52
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:24:57
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:25:02
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:25:07
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:25:13
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75