Create Interactive Tour

Linux Analysis Report
vejfa5.elf

Overview

General Information

Sample name:	vejfa5.elf
Analysis ID:	1630496
MD5:	60740c2feffa6dcc64209a36e4d183cd
SHA1:	6913507e8448d3a8b7add2a8b0f79adb0cd7f906
SHA256:	8b137bad03c3dadbda4dcebdf7372cf0863f55f33ed7c6f460d7de65fd2a0486
Tags:	elfuser-abuse_ch
Infos:

Detection

Score:	60
Range:	0 - 100

Signatures

Multi AV Scanner detection for submitted file

Sample deletes itself

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1630496
Start date and time:	2025-03-05 23:37:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	vejfa5.elf
Detection:	MAL
Classification:	mal60.spre.troj.evad.linELF@0/55@111/0

Runtime Messages

Command:	/tmp/vejfa5.elf
PID:	6236
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	kovey/cursinq was here, go away!
Standard Error:

Process Tree

system is lnxubuntu20

vejfa5.elf (PID: 6236, Parent: 6155, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/vejfa5.elf

vejfa5.elf New Fork (PID: 6238, Parent: 6236)

vejfa5.elf New Fork (PID: 6240, Parent: 6238)

vejfa5.elf New Fork (PID: 6241, Parent: 6238)

vejfa5.elf New Fork (PID: 6244, Parent: 6238)

systemd New Fork (PID: 6273, Parent: 1)

rsyslogd (PID: 6273, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

xfce4-panel New Fork (PID: 6274, Parent: 2063)

wrapper-2.0 (PID: 6274, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 6275, Parent: 2063)

wrapper-2.0 (PID: 6275, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 6276, Parent: 2063)

wrapper-2.0 (PID: 6276, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 6277, Parent: 2063)

wrapper-2.0 (PID: 6277, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

wrapper-2.0 New Fork (PID: 6300, Parent: 6277)

xfpm-power-backlight-helper (PID: 6300, Parent: 6277, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness

xfce4-panel New Fork (PID: 6278, Parent: 2063)

wrapper-2.0 (PID: 6278, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 6279, Parent: 2063)

wrapper-2.0 (PID: 6279, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"

systemd New Fork (PID: 6280, Parent: 1)

rsyslogd (PID: 6280, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

dbus-daemon New Fork (PID: 6299, Parent: 6298)

xfconfd (PID: 6299, Parent: 6298, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

systemd New Fork (PID: 6323, Parent: 1)

rsyslogd (PID: 6323, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6343, Parent: 1)

rsyslogd (PID: 6343, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6354, Parent: 1)

rsyslogd (PID: 6354, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6377, Parent: 1)

rsyslogd (PID: 6377, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6386, Parent: 1)

rsyslogd (PID: 6386, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6410, Parent: 1)

rsyslogd (PID: 6410, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6415, Parent: 1)

rsyslogd (PID: 6415, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6436, Parent: 1)

rsyslogd (PID: 6436, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6443, Parent: 1)

rsyslogd (PID: 6443, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6466, Parent: 1)

rsyslogd (PID: 6466, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6482, Parent: 1)

rsyslogd (PID: 6482, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6509, Parent: 1)

rsyslogd (PID: 6509, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6531, Parent: 1)

rsyslogd (PID: 6531, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6552, Parent: 1)

rsyslogd (PID: 6552, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6576, Parent: 1)

rsyslogd (PID: 6576, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6599, Parent: 1)

rsyslogd (PID: 6599, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6623, Parent: 1)

rsyslogd (PID: 6623, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6646, Parent: 1)

rsyslogd (PID: 6646, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6669, Parent: 1)

rsyslogd (PID: 6669, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6690, Parent: 1)

rsyslogd (PID: 6690, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6699, Parent: 1)

rsyslogd (PID: 6699, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6724, Parent: 1)

rsyslogd (PID: 6724, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6751, Parent: 1)

rsyslogd (PID: 6751, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6772, Parent: 1)

rsyslogd (PID: 6772, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6792, Parent: 1)

rsyslogd (PID: 6792, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6815, Parent: 1)

rsyslogd (PID: 6815, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

cleanup

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: vejfa5.elf	Virustotal: Detection: 25%			Perma Link
Source: vejfa5.elf	ReversingLabs: Detection: 34%

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: raw.awaken-network.net. [malformed]

Source: global traffic

TCP traffic: 192.168.2.23:50628 -> 141.98.10.142:7733

Source: /usr/sbin/rsyslogd (PID: 6280)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6323)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6343)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6354)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6377)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6386)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6410)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6415)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6436)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6443)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6466)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6482)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6509)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6531)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6552)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6576)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6599)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6623)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6646)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6669)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6690)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6699)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6724)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6751)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6772)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6792)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6815)	Reads hosts file: /etc/hosts	Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: global traffic	DNS traffic detected: DNS query: raw.awaken-network.net
Source: global traffic	DNS traffic detected: DNS query: raw.awaken-network.net. [malformed]

Source: syslog.48.dr, syslog.84.dr, syslog.88.dr, syslog.44.dr, syslog.86.dr, syslog.82.dr, syslog.76.dr, syslog.52.dr, syslog.62.dr, syslog.74.dr, syslog.68.dr, syslog.78.dr, syslog.38.dr, syslog.50.dr, syslog.32.dr, syslog.60.dr, syslog.80.dr, syslog.72.dr, syslog.64.dr, syslog.56.dr, syslog.42.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/vejfa5.elf (PID: 6238)	SIGKILL sent: pid: 6241, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 847, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 912, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 918, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6244, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6273, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6274, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6275, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6276, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6277, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6278, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6279, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6280, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6299, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6323, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6343, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6354, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6377, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6386, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6410, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6415, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6436, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6443, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6466, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6482, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6509, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6531, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6552, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6576, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6599, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6623, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6646, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6669, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6690, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6699, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6724, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6751, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6772, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6792, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: sys_monitor_cnrbusyboxadbddockerdBlink_Cloudsystemdhttpshsshdbashmsg_centerlte_mgrmain_mgrpkarm7pkarm5pkarmpkarm6pkmipspkmpslpkx86/tmp/var/mnt/root/boot/sbin/home/dev/media/opt/../(deleted)x86armmipsmpslsh4arm5arm6%s/%s/data/local/tmp/bin/dev/null/dev/console/var/lib/dockerraw.awaken-network.netabcdefghijklmnopqrstuvwxyz/proc/%d/cmdline/proc/%d/proc/selfhttpd/proc/self/exe/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbin/poweroff/usr/bin/poweroff/usr/sbin/halt/usr/bin/halt

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/vejfa5.elf (PID: 6238)	SIGKILL sent: pid: 6241, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 847, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 912, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 918, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 2077, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 2078, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 2079, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 2080, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 2083, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 2084, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 2114, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 2156, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6244, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6273, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6274, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6275, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6276, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6277, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6278, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6279, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6280, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6299, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6323, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6343, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6354, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6377, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6386, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6410, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6415, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6436, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6443, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6466, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6482, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6509, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6531, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6552, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6576, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6599, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6623, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6646, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6669, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6690, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6699, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6724, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6751, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6772, result: successful	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	SIGKILL sent: pid: 6792, result: successful	Jump to behavior

Source: classification engine

Classification label: mal60.spre.troj.evad.linELF@0/55@111/0

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6274)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6279)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6299)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6299)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6299)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6299)	Directory: /home/saturnino/.config	Jump to behavior

Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/1582/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/1582/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/1582/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/1579/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/1579/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/1579/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/1699/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/1699/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/1699/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/1698/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/1698/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/1698/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/1576/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/1576/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/1576/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/119/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/10/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/2307/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/2307/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/2307/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/12/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/13/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/13/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/13/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/6364/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/14/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/14/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/14/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/6363/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/15/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/15/stat	Jump to behavior
Source: /tmp/vejfa5.elf (PID: 6240)	File opened: /proc/15/stat	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6280)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6323)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6343)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6354)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6377)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6386)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6410)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6415)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6436)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6443)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6466)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6482)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6509)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6531)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6552)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6576)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6599)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6623)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6646)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6669)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6690)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6699)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6724)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6751)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6772)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6792)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6815)	Log file created: /var/log/kern.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/vejfa5.elf (PID: 6238)

File: /tmp/vejfa5.elf

Jump to behavior

Source: /tmp/vejfa5.elf (PID: 6236)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6274)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6275)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6276)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6277)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6278)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6279)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6280)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6323)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6343)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6354)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6377)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6386)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6410)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6415)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6436)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6443)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6466)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6482)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6509)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6531)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6552)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6576)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6599)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6623)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6646)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6669)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6690)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6699)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6724)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6751)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6772)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6792)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6815)	Queries kernel information via 'uname':	Jump to behavior

Source: vejfa5.elf, 6244.1.0000559a94208000.0000559a9422e000.rw-.sdmp	Binary or memory string: /arm/tmp/vmware-root_721-4290559889
Source: vejfa5.elf, 6236.1.00007ffdc66c2000.00007ffdc66e3000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.xlW8VI
Source: vejfa5.elf, 6244.1.0000559a940da000.0000559a94208000.rw-.sdmp	Binary or memory string: !/data/local/tmp1/tmp/vmware-root_721-4290559889
Source: vejfa5.elf, 6244.1.0000559a94208000.0000559a9422e000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt
Source: vejfa5.elf, 6244.1.00007f7fa0050000.00007f7fa0058000.rw-.sdmp	Binary or memory string: vmware
Source: vejfa5.elf, 6236.1.0000559a940da000.0000559a94208000.rw-.sdmp, vejfa5.elf, 6241.1.0000559a940da000.0000559a94208000.rw-.sdmp, vejfa5.elf, 6244.1.0000559a940da000.0000559a94208000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: vejfa5.elf, 6244.1.0000559a94208000.0000559a9422e000.rw-.sdmp	Binary or memory string: U/arm/tmp/vmware-root_721-4290559889a/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-ModemManager.service-c4RYFiervicea/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-ModemManager.service-c4RYFi/tmp.sa/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-timedated.service-OC6ykis
Source: vejfa5.elf, 6244.1.00007f7fa0050000.00007f7fa0058000.rw-.sdmp	Binary or memory string: T/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-fwupd.service-gB0a9f/tmpX/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-logind.service-IofUpj\/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-logind.service-IofUpj/tmp$/tmp/vmware-root_721-4290559889P/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-upower.service-x0xO0i4/tmp/snap.lxd
Source: vejfa5.elf, 6244.1.0000559a940da000.0000559a94208000.rw-.sdmp	Binary or memory string: /tmp/vmware-root_721-4290559889
Source: vejfa5.elf, 6236.1.00007ffdc66c2000.00007ffdc66e3000.rw-.sdmp, vejfa5.elf, 6241.1.00007ffdc66c2000.00007ffdc66e3000.rw-.sdmp, vejfa5.elf, 6244.1.00007ffdc66c2000.00007ffdc66e3000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/vejfa5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/vejfa5.elf
Source: vejfa5.elf, 6236.1.0000559a940da000.0000559a94208000.rw-.sdmp, vejfa5.elf, 6241.1.0000559a940da000.0000559a94208000.rw-.sdmp, vejfa5.elf, 6244.1.0000559a940da000.0000559a94208000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: vejfa5.elf, 6236.1.00007ffdc66c2000.00007ffdc66e3000.rw-.sdmp, vejfa5.elf, 6241.1.00007ffdc66c2000.00007ffdc66e3000.rw-.sdmp, vejfa5.elf, 6244.1.00007ffdc66c2000.00007ffdc66e3000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: vejfa5.elf, 6236.1.00007ffdc66c2000.00007ffdc66e3000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.xlW8VI:

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Hidden Files and Directories	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
vejfa5.elf	26%	Virustotal		Browse
vejfa5.elf	34%	ReversingLabs	Linux.Backdoor.Mirai

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
raw.awaken-network.net	141.98.10.142	true	false		high
raw.awaken-network.net. [malformed]	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.48.dr, syslog.84.dr, syslog.88.dr, syslog.44.dr, syslog.86.dr, syslog.82.dr, syslog.76.dr, syslog.52.dr, syslog.62.dr, syslog.74.dr, syslog.68.dr, syslog.78.dr, syslog.38.dr, syslog.50.dr, syslog.32.dr, syslog.60.dr, syslog.80.dr, syslog.72.dr, syslog.64.dr, syslog.56.dr, syslog.42.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
141.98.10.142	raw.awaken-network.net	Lithuania	209605	HOSTBALTICLT	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
141.98.10.142	efefa7.elf	Get hash	malicious	Mirai	Browse
	weje64.elf	Get hash	malicious	Unknown	Browse
	drea4.elf	Get hash	malicious	Unknown	Browse
	jfeeps.elf	Get hash	malicious	Unknown	Browse
	eehah4.elf	Get hash	malicious	Unknown	Browse
	vjwe68k.elf	Get hash	malicious	Unknown	Browse
	rjfe686.elf	Get hash	malicious	Unknown	Browse
	efjepc.elf	Get hash	malicious	Unknown	Browse
	rrrdsl.elf	Get hash	malicious	Unknown	Browse
	eehah4.elf	Get hash	malicious	Unknown	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	efefa7.elf	Get hash	malicious	Mirai	Browse
	weje64.elf	Get hash	malicious	Unknown	Browse
	drea4.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	eehah4.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	rjfe686.elf	Get hash	malicious	Unknown	Browse
	rrrdsl.elf	Get hash	malicious	Unknown	Browse
	donk.mpsl.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
91.189.91.42	efefa7.elf	Get hash	malicious	Mirai	Browse
	weje64.elf	Get hash	malicious	Unknown	Browse
	drea4.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	eehah4.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	rjfe686.elf	Get hash	malicious	Unknown	Browse
	rrrdsl.elf	Get hash	malicious	Unknown	Browse
	donk.mpsl.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.awaken-network.net	weje64.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	jfeeps.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	efjepc.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	141.98.10.142

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	efefa7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	weje64.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	drea4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	jfeeps.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	eehah4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	rjfe686.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	donk.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
CANONICAL-ASGB	efefa7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	weje64.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	drea4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	jfeeps.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	eehah4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	rjfe686.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	donk.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
HOSTBALTICLT	efefa7.elf	Get hash	malicious	Mirai	Browse	141.98.10.142
	weje64.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	drea4.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	jfeeps.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	eehah4.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	vjwe68k.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	rjfe686.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	efjepc.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
	eehah4.elf	Get hash	malicious	Unknown	Browse	141.98.10.142
INIT7CH	efefa7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	weje64.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	drea4.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	eehah4.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	rjfe686.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	donk.mpsl.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/tmp/qemu-open.xlW8VI (deleted)

Download File

Process:	/tmp/vejfa5.elf
File Type:	data
Category:	dropped
Size (bytes):	26
Entropy (8bit):	4.132944044980958
Encrypted:	false
SSDEEP:	3:TgOa8HJN:TgOHJN
MD5:	079B40630E4A0B76B23C3BCE169EF09D
SHA1:	2CEA90056BE9C627F34E568D62B4B3ABDCF5A24F
SHA-256:	70A13BE099FF5BB666A892A3B10CDBEB1E3D612FEDFBCFF8261E8225007A11CD
SHA-512:	CEA5628D3E159007A3218F1D99A6B987BCAAF441DCA5EBE7EDE2D5C1EE7B6EC8F09A13C60F95B4D43C4893724CC1AFE8F203B27FC9AADA49A8A9131F4444D36C
Malicious:	false
Reputation:	low
Preview:	/tmp/vejfa5.elf.nwlrbbmqbh

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	799
Entropy (8bit):	4.706911778902522
Encrypted:	false
SSDEEP:	24:ploHYV1inFBrNUdT5hku5UX5aKV5yAIKD5gAIKi:L6ycn5YTnUEYKsAf
MD5:	70D0368121380452AA9792C3DF06E790
SHA1:	7DB91A8FECA548C0860D0D085A64623961E59078
SHA-256:	D3F644141BAAB5B0486EDD869F27D644EF083AC340D17A4F412C05E093157A3A
SHA-512:	518DF5BFE09ACE4D2B1FEB3E704B093DA57F689F5942EAAD43B9BDF59B688883C275B2E131BADDB8D3F95C7ECEE896D012228C6EF0254185D1EA2484EDADBDA3
Malicious:	false
Reputation:	low
Preview:	Mar 5 16:39:59 galassia kernel: [ 539.904887] blocking signal 9: 6240 -> 1320.Mar 5 16:39:59 galassia kernel: [ 539.980298] blocking signal 9: 6240 -> 658.Mar 5 16:39:59 galassia kernel: [ 539.989219] blocking signal 9: 6240 -> 772.Mar 5 16:39:59 galassia kernel: [ 539.998991] blocking signal 9: 6240 -> 800.Mar 5 16:39:59 galassia kernel: [ 540.007268] blocking signal 9: 6240 -> 847.Mar 5 16:39:59 galassia kernel: [ 540.016152] blocking signal 9: 6240 -> 936.Mar 5 16:39:59 galassia kernel: [ 540.024611] blocking signal 9: 6240 -> 1320.Mar 5 16:39:59 galassia kernel: [ 540.239639] New task spawned: old: (tgid 6815, tid 6815), new (tgid: 6815, tid: 6816).Mar 5 16:39:59 galassia kernel: [ 540.239754] New task spawned: old: (tgid 6815, tid 6815), new (tgid: 6815, tid: 6817).

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	5.001629169521268
Encrypted:	false
SSDEEP:	24:pF3PD5loHYV0z1inFBrNUdT5hku5UX5aKV5yAIKD5gAIKEPcVRjN7Dqvc9uXP7qh:P3Fl6Oicn5YTnUEYKsAXPiRZevjeh
MD5:	0F07510CA3AFDCD0003D628892339518
SHA1:	5F0568547D3C06CE456C3CB8A35DF77DB333412B
SHA-256:	10FA268006177E350858964CE7071B46631A72DEECE9BBAC88B380B26BDAE66C
SHA-512:	29C2998F9A80B7270438D0D201430273D0033AB2862DF967E756C748675F8EA2EC5A1C9144DD0352F26D05BF9E1EA2113856E0ECB428894AF3AB03BBFDD8CD4C
Malicious:	false
Reputation:	low
Preview:	Mar 5 16:39:59 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Mar 5 16:39:59 galassia kernel: [ 539.904887] blocking signal 9: 6240 -> 1320.Mar 5 16:39:59 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Mar 5 16:39:59 galassia kernel: [ 539.980298] blocking signal 9: 6240 -> 658.Mar 5 16:39:59 galassia kernel: [ 539.989219] blocking signal 9: 6240 -> 772.Mar 5 16:39:59 galassia kernel: [ 539.998991] blocking signal 9: 6240 -> 800.Mar 5 16:39:59 galassia kernel: [ 540.007268] blocking signal 9: 6240 -> 847.Mar 5 16:39:59 galassia kernel: [ 540.016152] blocking signal 9: 6240 -> 936.Mar 5 16:39:59 galassia kernel: [ 540.024611] blocking signal 9: 6240 -> 1320.Mar 5 16:39:59 galassia kernel: [ 540.239639] New task spawned: old: (tgid 6815, tid 6815), new (tgid: 6815, tid: 6816).Mar 5 16:39:59 galassia kernel: [ 540.239754] New task spawned: old: (tgid 6815, tid 6815), new (tgid: 6815, tid: 6817).Mar 5 16:39:59

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	5.43272748395631
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	vejfa5.elf
File size:	146'240 bytes
MD5:	60740c2feffa6dcc64209a36e4d183cd
SHA1:	6913507e8448d3a8b7add2a8b0f79adb0cd7f906
SHA256:	8b137bad03c3dadbda4dcebdf7372cf0863f55f33ed7c6f460d7de65fd2a0486
SHA512:	ed71e03e9fb22d18cfa936cbd401b18a4e17b8f990853a4ba82901d9e0afb5450038b671a0b1582bcd9ad359c84b5f3f29952802e979fdc44a5f003ed90bd239
SSDEEP:	1536:u4GT4eOI5JJRES8dAW5T2hE+o4VFRXTHG1G437DOAzRM8SUyt8l/UKwywG/FVGaD:u4GFKJ5Tl4dXjG1Go59SLyfUXY
TLSH:	67E31941F9419F13C6D622BBFB5E428D372A17A8D3EE72039D256F21378685B0E3B542
File Content Preview:	.ELF...a..........(.........4....9......4. ...(.....................................................pI..............Q.td..................................-...L."....l..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x2
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	145840
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x1b328	0x0	0x6	AX	16
.fini	PROGBITS	0x233d8	0x1b3d8	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x233ec	0x1b3ec	0x3af8	0x0	0x2	A	4
.ctors	PROGBITS	0x2f000	0x1f000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x2f00c	0x1f00c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x2f020	0x1f020	0x4950	0x0	0x3	WA	32
.bss	NOBITS	0x33970	0x23970	0xc598	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x23970	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x1eee4	0x1eee4	5.9131	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x1f000	0x2f000	0x2f000	0x4970	0x10f08	0.4511	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 5, 2025 23:37:55.624039888 CET	192.168.2.23	8.8.8.8	0x630f	Standard query (0)	raw.awaken-network.net	A (IP address)	IN (0x0001)	false
Mar 5, 2025 23:37:55.650479078 CET	192.168.2.23	8.8.8.8	0xa02e	Standard query (0)	raw.awaken-network.net. [malformed]	256	323	false
Mar 5, 2025 23:37:55.668288946 CET	192.168.2.23	8.8.8.8	0xa02e	Standard query (0)	raw.awaken-network.net. [malformed]	256	323	false
Mar 5, 2025 23:37:55.677038908 CET	192.168.2.23	8.8.8.8	0xa02e	Standard query (0)	raw.awaken-network.net. [malformed]	256	323	false
Mar 5, 2025 23:37:55.687062979 CET	192.168.2.23	8.8.8.8	0xa02e	Standard query (0)	raw.awaken-network.net. [malformed]	256	323	false
Mar 5, 2025 23:37:55.698909998 CET	192.168.2.23	8.8.8.8	0xa02e	Standard query (0)	raw.awaken-network.net. [malformed]	256	323	false
Mar 5, 2025 23:37:56.469002962 CET	192.168.2.23	8.8.8.8	0x320c	Standard query (0)	raw.awaken-network.net. [malformed]	256	324	false
Mar 5, 2025 23:37:56.484014988 CET	192.168.2.23	8.8.8.8	0x320c	Standard query (0)	raw.awaken-network.net. [malformed]	256	324	false
Mar 5, 2025 23:37:56.500825882 CET	192.168.2.23	8.8.8.8	0x320c	Standard query (0)	raw.awaken-network.net. [malformed]	256	324	false
Mar 5, 2025 23:37:56.516127110 CET	192.168.2.23	8.8.8.8	0x320c	Standard query (0)	raw.awaken-network.net. [malformed]	256	324	false
Mar 5, 2025 23:37:56.535164118 CET	192.168.2.23	8.8.8.8	0x320c	Standard query (0)	raw.awaken-network.net. [malformed]	256	324	false
Mar 5, 2025 23:37:57.419447899 CET	192.168.2.23	8.8.8.8	0xd0e2	Standard query (0)	raw.awaken-network.net. [malformed]	256	325	false
Mar 5, 2025 23:37:57.475953102 CET	192.168.2.23	8.8.8.8	0xd0e2	Standard query (0)	raw.awaken-network.net. [malformed]	256	325	false
Mar 5, 2025 23:37:57.625680923 CET	192.168.2.23	8.8.8.8	0xd0e2	Standard query (0)	raw.awaken-network.net. [malformed]	256	325	false
Mar 5, 2025 23:37:57.645579100 CET	192.168.2.23	8.8.8.8	0xd0e2	Standard query (0)	raw.awaken-network.net. [malformed]	256	325	false
Mar 5, 2025 23:37:57.684237003 CET	192.168.2.23	8.8.8.8	0xd0e2	Standard query (0)	raw.awaken-network.net. [malformed]	256	325	false
Mar 5, 2025 23:37:58.449210882 CET	192.168.2.23	8.8.8.8	0x91cb	Standard query (0)	raw.awaken-network.net. [malformed]	256	326	false
Mar 5, 2025 23:37:58.462096930 CET	192.168.2.23	8.8.8.8	0x91cb	Standard query (0)	raw.awaken-network.net. [malformed]	256	326	false
Mar 5, 2025 23:37:58.475624084 CET	192.168.2.23	8.8.8.8	0x91cb	Standard query (0)	raw.awaken-network.net. [malformed]	256	326	false
Mar 5, 2025 23:37:58.489489079 CET	192.168.2.23	8.8.8.8	0x91cb	Standard query (0)	raw.awaken-network.net. [malformed]	256	326	false
Mar 5, 2025 23:37:58.502862930 CET	192.168.2.23	8.8.8.8	0x91cb	Standard query (0)	raw.awaken-network.net. [malformed]	256	326	false
Mar 5, 2025 23:37:59.308170080 CET	192.168.2.23	8.8.8.8	0x78f2	Standard query (0)	raw.awaken-network.net. [malformed]	256	327	false
Mar 5, 2025 23:37:59.327239990 CET	192.168.2.23	8.8.8.8	0x78f2	Standard query (0)	raw.awaken-network.net. [malformed]	256	327	false
Mar 5, 2025 23:37:59.345546007 CET	192.168.2.23	8.8.8.8	0x78f2	Standard query (0)	raw.awaken-network.net. [malformed]	256	327	false
Mar 5, 2025 23:37:59.364028931 CET	192.168.2.23	8.8.8.8	0x78f2	Standard query (0)	raw.awaken-network.net. [malformed]	256	327	false
Mar 5, 2025 23:37:59.381735086 CET	192.168.2.23	8.8.8.8	0x78f2	Standard query (0)	raw.awaken-network.net. [malformed]	256	327	false
Mar 5, 2025 23:38:00.198201895 CET	192.168.2.23	8.8.8.8	0xc969	Standard query (0)	raw.awaken-network.net. [malformed]	256	328	false
Mar 5, 2025 23:38:00.214648962 CET	192.168.2.23	8.8.8.8	0xc969	Standard query (0)	raw.awaken-network.net. [malformed]	256	328	false
Mar 5, 2025 23:38:00.233314991 CET	192.168.2.23	8.8.8.8	0xc969	Standard query (0)	raw.awaken-network.net. [malformed]	256	328	false
Mar 5, 2025 23:38:00.269912004 CET	192.168.2.23	8.8.8.8	0xc969	Standard query (0)	raw.awaken-network.net. [malformed]	256	328	false
Mar 5, 2025 23:38:00.285546064 CET	192.168.2.23	8.8.8.8	0xc969	Standard query (0)	raw.awaken-network.net. [malformed]	256	328	false
Mar 5, 2025 23:38:01.093363047 CET	192.168.2.23	8.8.8.8	0xcb1a	Standard query (0)	raw.awaken-network.net. [malformed]	256	329	false
Mar 5, 2025 23:38:01.112963915 CET	192.168.2.23	8.8.8.8	0xcb1a	Standard query (0)	raw.awaken-network.net. [malformed]	256	329	false
Mar 5, 2025 23:38:01.129523993 CET	192.168.2.23	8.8.8.8	0xcb1a	Standard query (0)	raw.awaken-network.net. [malformed]	256	329	false
Mar 5, 2025 23:38:01.146492004 CET	192.168.2.23	8.8.8.8	0xcb1a	Standard query (0)	raw.awaken-network.net. [malformed]	256	329	false
Mar 5, 2025 23:38:01.168735027 CET	192.168.2.23	8.8.8.8	0xcb1a	Standard query (0)	raw.awaken-network.net. [malformed]	256	329	false
Mar 5, 2025 23:38:02.115582943 CET	192.168.2.23	8.8.8.8	0x2eaa	Standard query (0)	raw.awaken-network.net. [malformed]	256	330	false
Mar 5, 2025 23:38:02.132328987 CET	192.168.2.23	8.8.8.8	0x2eaa	Standard query (0)	raw.awaken-network.net. [malformed]	256	330	false
Mar 5, 2025 23:38:02.147281885 CET	192.168.2.23	8.8.8.8	0x2eaa	Standard query (0)	raw.awaken-network.net. [malformed]	256	330	false
Mar 5, 2025 23:38:02.160948038 CET	192.168.2.23	8.8.8.8	0x2eaa	Standard query (0)	raw.awaken-network.net. [malformed]	256	330	false
Mar 5, 2025 23:38:02.174293041 CET	192.168.2.23	8.8.8.8	0x2eaa	Standard query (0)	raw.awaken-network.net. [malformed]	256	330	false
Mar 5, 2025 23:38:04.259660006 CET	192.168.2.23	8.8.8.8	0xf958	Standard query (0)	raw.awaken-network.net. [malformed]	256	332	false
Mar 5, 2025 23:38:04.272942066 CET	192.168.2.23	8.8.8.8	0xf958	Standard query (0)	raw.awaken-network.net. [malformed]	256	332	false
Mar 5, 2025 23:38:04.288352966 CET	192.168.2.23	8.8.8.8	0xf958	Standard query (0)	raw.awaken-network.net. [malformed]	256	332	false
Mar 5, 2025 23:38:04.302973986 CET	192.168.2.23	8.8.8.8	0xf958	Standard query (0)	raw.awaken-network.net. [malformed]	256	332	false
Mar 5, 2025 23:38:04.320802927 CET	192.168.2.23	8.8.8.8	0xf958	Standard query (0)	raw.awaken-network.net. [malformed]	256	332	false
Mar 5, 2025 23:38:05.180011988 CET	192.168.2.23	8.8.8.8	0xb21b	Standard query (0)	raw.awaken-network.net. [malformed]	256	333	false
Mar 5, 2025 23:38:05.208724022 CET	192.168.2.23	8.8.8.8	0xb21b	Standard query (0)	raw.awaken-network.net. [malformed]	256	333	false
Mar 5, 2025 23:38:05.241607904 CET	192.168.2.23	8.8.8.8	0xb21b	Standard query (0)	raw.awaken-network.net. [malformed]	256	333	false
Mar 5, 2025 23:38:05.287177086 CET	192.168.2.23	8.8.8.8	0xb21b	Standard query (0)	raw.awaken-network.net. [malformed]	256	333	false
Mar 5, 2025 23:38:05.306454897 CET	192.168.2.23	8.8.8.8	0xb21b	Standard query (0)	raw.awaken-network.net. [malformed]	256	333	false
Mar 5, 2025 23:38:06.075263023 CET	192.168.2.23	8.8.8.8	0x17b3	Standard query (0)	raw.awaken-network.net. [malformed]	256	334	false
Mar 5, 2025 23:38:06.087675095 CET	192.168.2.23	8.8.8.8	0x17b3	Standard query (0)	raw.awaken-network.net. [malformed]	256	334	false
Mar 5, 2025 23:38:06.101058006 CET	192.168.2.23	8.8.8.8	0x17b3	Standard query (0)	raw.awaken-network.net. [malformed]	256	334	false
Mar 5, 2025 23:38:06.114207983 CET	192.168.2.23	8.8.8.8	0x17b3	Standard query (0)	raw.awaken-network.net. [malformed]	256	334	false
Mar 5, 2025 23:38:06.292195082 CET	192.168.2.23	8.8.8.8	0x17b3	Standard query (0)	raw.awaken-network.net. [malformed]	256	334	false
Mar 5, 2025 23:38:07.092129946 CET	192.168.2.23	8.8.8.8	0x2bd	Standard query (0)	raw.awaken-network.net. [malformed]	256	335	false
Mar 5, 2025 23:38:07.108887911 CET	192.168.2.23	8.8.8.8	0x2bd	Standard query (0)	raw.awaken-network.net. [malformed]	256	335	false
Mar 5, 2025 23:38:07.122392893 CET	192.168.2.23	8.8.8.8	0x2bd	Standard query (0)	raw.awaken-network.net. [malformed]	256	335	false
Mar 5, 2025 23:38:07.136235952 CET	192.168.2.23	8.8.8.8	0x2bd	Standard query (0)	raw.awaken-network.net. [malformed]	256	335	false
Mar 5, 2025 23:38:07.154441118 CET	192.168.2.23	8.8.8.8	0x2bd	Standard query (0)	raw.awaken-network.net. [malformed]	256	335	false
Mar 5, 2025 23:38:07.929491997 CET	192.168.2.23	8.8.8.8	0x44b6	Standard query (0)	raw.awaken-network.net. [malformed]	256	335	false
Mar 5, 2025 23:38:07.939325094 CET	192.168.2.23	8.8.8.8	0x44b6	Standard query (0)	raw.awaken-network.net. [malformed]	256	335	false
Mar 5, 2025 23:38:07.948496103 CET	192.168.2.23	8.8.8.8	0x44b6	Standard query (0)	raw.awaken-network.net. [malformed]	256	335	false
Mar 5, 2025 23:38:07.957290888 CET	192.168.2.23	8.8.8.8	0x44b6	Standard query (0)	raw.awaken-network.net. [malformed]	256	335	false
Mar 5, 2025 23:38:07.966550112 CET	192.168.2.23	8.8.8.8	0x44b6	Standard query (0)	raw.awaken-network.net. [malformed]	256	335	false
Mar 5, 2025 23:38:08.702003002 CET	192.168.2.23	8.8.8.8	0x882c	Standard query (0)	raw.awaken-network.net. [malformed]	256	336	false
Mar 5, 2025 23:38:08.709353924 CET	192.168.2.23	8.8.8.8	0x882c	Standard query (0)	raw.awaken-network.net. [malformed]	256	336	false
Mar 5, 2025 23:38:08.716723919 CET	192.168.2.23	8.8.8.8	0x882c	Standard query (0)	raw.awaken-network.net. [malformed]	256	336	false
Mar 5, 2025 23:38:08.723956108 CET	192.168.2.23	8.8.8.8	0x882c	Standard query (0)	raw.awaken-network.net. [malformed]	256	336	false
Mar 5, 2025 23:38:08.733112097 CET	192.168.2.23	8.8.8.8	0x882c	Standard query (0)	raw.awaken-network.net. [malformed]	256	336	false
Mar 5, 2025 23:38:09.455188036 CET	192.168.2.23	8.8.8.8	0xe207	Standard query (0)	raw.awaken-network.net. [malformed]	256	337	false
Mar 5, 2025 23:38:09.462805986 CET	192.168.2.23	8.8.8.8	0xe207	Standard query (0)	raw.awaken-network.net. [malformed]	256	337	false
Mar 5, 2025 23:38:09.470048904 CET	192.168.2.23	8.8.8.8	0xe207	Standard query (0)	raw.awaken-network.net. [malformed]	256	337	false
Mar 5, 2025 23:38:09.477535963 CET	192.168.2.23	8.8.8.8	0xe207	Standard query (0)	raw.awaken-network.net. [malformed]	256	337	false
Mar 5, 2025 23:38:09.484931946 CET	192.168.2.23	8.8.8.8	0xe207	Standard query (0)	raw.awaken-network.net. [malformed]	256	337	false
Mar 5, 2025 23:38:10.216964960 CET	192.168.2.23	8.8.8.8	0x4a07	Standard query (0)	raw.awaken-network.net. [malformed]	256	338	false
Mar 5, 2025 23:38:10.224869967 CET	192.168.2.23	8.8.8.8	0x4a07	Standard query (0)	raw.awaken-network.net. [malformed]	256	338	false
Mar 5, 2025 23:38:10.232794046 CET	192.168.2.23	8.8.8.8	0x4a07	Standard query (0)	raw.awaken-network.net. [malformed]	256	338	false
Mar 5, 2025 23:38:10.240906954 CET	192.168.2.23	8.8.8.8	0x4a07	Standard query (0)	raw.awaken-network.net. [malformed]	256	338	false
Mar 5, 2025 23:38:10.249172926 CET	192.168.2.23	8.8.8.8	0x4a07	Standard query (0)	raw.awaken-network.net. [malformed]	256	338	false
Mar 5, 2025 23:38:10.976264954 CET	192.168.2.23	8.8.8.8	0xd29f	Standard query (0)	raw.awaken-network.net. [malformed]	256	338	false
Mar 5, 2025 23:38:10.983658075 CET	192.168.2.23	8.8.8.8	0xd29f	Standard query (0)	raw.awaken-network.net. [malformed]	256	338	false
Mar 5, 2025 23:38:10.991734028 CET	192.168.2.23	8.8.8.8	0xd29f	Standard query (0)	raw.awaken-network.net. [malformed]	256	338	false
Mar 5, 2025 23:38:10.999737024 CET	192.168.2.23	8.8.8.8	0xd29f	Standard query (0)	raw.awaken-network.net. [malformed]	256	339	false
Mar 5, 2025 23:38:11.007347107 CET	192.168.2.23	8.8.8.8	0xd29f	Standard query (0)	raw.awaken-network.net. [malformed]	256	339	false
Mar 5, 2025 23:38:11.732611895 CET	192.168.2.23	8.8.8.8	0x1e56	Standard query (0)	raw.awaken-network.net. [malformed]	256	339	false
Mar 5, 2025 23:38:11.739835978 CET	192.168.2.23	8.8.8.8	0x1e56	Standard query (0)	raw.awaken-network.net. [malformed]	256	339	false
Mar 5, 2025 23:38:11.748194933 CET	192.168.2.23	8.8.8.8	0x1e56	Standard query (0)	raw.awaken-network.net. [malformed]	256	339	false
Mar 5, 2025 23:38:11.756098032 CET	192.168.2.23	8.8.8.8	0x1e56	Standard query (0)	raw.awaken-network.net. [malformed]	256	339	false
Mar 5, 2025 23:38:11.763293028 CET	192.168.2.23	8.8.8.8	0x1e56	Standard query (0)	raw.awaken-network.net. [malformed]	256	339	false
Mar 5, 2025 23:38:12.501533985 CET	192.168.2.23	8.8.8.8	0x511	Standard query (0)	raw.awaken-network.net. [malformed]	256	340	false
Mar 5, 2025 23:38:12.509262085 CET	192.168.2.23	8.8.8.8	0x511	Standard query (0)	raw.awaken-network.net. [malformed]	256	340	false
Mar 5, 2025 23:38:12.517646074 CET	192.168.2.23	8.8.8.8	0x511	Standard query (0)	raw.awaken-network.net. [malformed]	256	340	false
Mar 5, 2025 23:38:12.525188923 CET	192.168.2.23	8.8.8.8	0x511	Standard query (0)	raw.awaken-network.net. [malformed]	256	340	false
Mar 5, 2025 23:38:12.533340931 CET	192.168.2.23	8.8.8.8	0x511	Standard query (0)	raw.awaken-network.net. [malformed]	256	340	false
Mar 5, 2025 23:38:13.280224085 CET	192.168.2.23	8.8.8.8	0xb660	Standard query (0)	raw.awaken-network.net. [malformed]	256	341	false
Mar 5, 2025 23:38:13.291002989 CET	192.168.2.23	8.8.8.8	0xb660	Standard query (0)	raw.awaken-network.net. [malformed]	256	341	false
Mar 5, 2025 23:38:13.301768064 CET	192.168.2.23	8.8.8.8	0xb660	Standard query (0)	raw.awaken-network.net. [malformed]	256	341	false
Mar 5, 2025 23:38:13.311925888 CET	192.168.2.23	8.8.8.8	0xb660	Standard query (0)	raw.awaken-network.net. [malformed]	256	341	false
Mar 5, 2025 23:38:13.322601080 CET	192.168.2.23	8.8.8.8	0xb660	Standard query (0)	raw.awaken-network.net. [malformed]	256	341	false
Mar 5, 2025 23:38:14.064507008 CET	192.168.2.23	8.8.8.8	0x3c4	Standard query (0)	raw.awaken-network.net. [malformed]	256	342	false
Mar 5, 2025 23:38:14.088912010 CET	192.168.2.23	8.8.8.8	0x3c4	Standard query (0)	raw.awaken-network.net. [malformed]	256	342	false
Mar 5, 2025 23:38:14.100409031 CET	192.168.2.23	8.8.8.8	0x3c4	Standard query (0)	raw.awaken-network.net. [malformed]	256	342	false
Mar 5, 2025 23:38:14.136142969 CET	192.168.2.23	8.8.8.8	0x3c4	Standard query (0)	raw.awaken-network.net. [malformed]	256	342	false
Mar 5, 2025 23:38:14.154144049 CET	192.168.2.23	8.8.8.8	0x3c4	Standard query (0)	raw.awaken-network.net. [malformed]	256	342	false
Mar 5, 2025 23:38:15.009215117 CET	192.168.2.23	8.8.8.8	0xcb20	Standard query (0)	raw.awaken-network.net. [malformed]	256	343	false
Mar 5, 2025 23:38:15.016673088 CET	192.168.2.23	8.8.8.8	0xcb20	Standard query (0)	raw.awaken-network.net. [malformed]	256	343	false
Mar 5, 2025 23:38:15.024183035 CET	192.168.2.23	8.8.8.8	0xcb20	Standard query (0)	raw.awaken-network.net. [malformed]	256	343	false
Mar 5, 2025 23:38:15.031276941 CET	192.168.2.23	8.8.8.8	0xcb20	Standard query (0)	raw.awaken-network.net. [malformed]	256	343	false
Mar 5, 2025 23:38:15.038881063 CET	192.168.2.23	8.8.8.8	0xcb20	Standard query (0)	raw.awaken-network.net. [malformed]	256	343	false

Start time (UTC):	22:37:54
Start date (UTC):	05/03/2025
Path:	/tmp/vejfa5.elf
Arguments:	/tmp/vejfa5.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	22:38:02
Start date (UTC):	05/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	-
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	22:37:55
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:38:06
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:38:11
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:38:13
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:38:18
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:38:20
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:38:25
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:38:30
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:38:31
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:38:36
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:38:41
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:38:46
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:38:51
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report vejfa5.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.xlW8VI (deleted)

/var/log/kern.log

/var/log/syslog

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: vejfa5.elf PID: 6236, Parent PID: 6155

General

File Activities

File Opened

File Deleted

File Read

File Written

File Moved

Process Activities

Process Forked

Prctl Requested

Thread Sleep

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: vejfa5.elf PID: 6238, Parent PID: 6236

General

Linux Analysis Report
vejfa5.elf

Start time (UTC):	22:38:57
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:39:02
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:39:07
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:39:12
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:39:17
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:39:23
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:39:28
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:39:33
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:39:38
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	22:39:43
Start date (UTC):	05/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75