Edit tour

Linux Analysis Report
boatnet.m68k.elf

Overview

General Information

Sample name:boatnet.m68k.elf
Analysis ID:1641136
MD5:7e25e275aa75dfa71ece064b3e456ad3
SHA1:82fa64827c45173508b2f3d51d8411337b434397
SHA256:76186cf724d37777161fc1b7ef726a77d4e58cc3503cc80d9b75aa27835c7aaf
Tags:elfMiraiuser-abuse_ch
Infos:

Detection

Mirai
Score:76
Range:0 - 100

Signatures

Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample tries to kill multiple processes (SIGKILL)
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Executes the "rm" command used to delete files or directories
Sample has stripped symbol table
Sample tries to kill a process (SIGKILL)
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1641136
Start date and time:2025-03-18 03:27:50 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 58s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:boatnet.m68k.elf
Detection:MAL
Classification:mal76.spre.troj.linELF@0/0@0/0
Command:/tmp/boatnet.m68k.elf
PID:6224
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
lzrd cock fest"/proc/"/exe
Standard Error:
  • system is lnxubuntu20
  • dash New Fork (PID: 6195, Parent: 4331)
  • rm (PID: 6195, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.Cs0ie8NMRW /tmp/tmp.09BWTqx8Ma /tmp/tmp.mVuRavtUwF
  • dash New Fork (PID: 6196, Parent: 4331)
  • rm (PID: 6196, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.Cs0ie8NMRW /tmp/tmp.09BWTqx8Ma /tmp/tmp.mVuRavtUwF
  • wrapper-2.0 (PID: 6235, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
  • wrapper-2.0 (PID: 6236, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
  • wrapper-2.0 (PID: 6237, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
  • wrapper-2.0 (PID: 6238, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
    • xfpm-power-backlight-helper (PID: 6247, Parent: 6238, MD5: 3d221ad23f28ca3259f599b1664e2427) Arguments: /usr/sbin/xfpm-power-backlight-helper --get-max-brightness
  • wrapper-2.0 (PID: 6239, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
  • wrapper-2.0 (PID: 6240, Parent: 2063, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
  • xfconfd (PID: 6249, Parent: 6248, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
boatnet.m68k.elfJoeSecurity_Mirai_8Yara detected MiraiJoe Security
    boatnet.m68k.elfLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
    • 0xc1e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc1f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc20c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc25c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc2ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc2c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc2d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc2e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc2fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc34c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    • 0xc374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
    boatnet.m68k.elfLinux_Trojan_Gafgyt_ea92cca8unknownunknown
    • 0xc735:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
    SourceRuleDescriptionAuthorStrings
    6227.1.00007f601c001000.00007f601c00f000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      6227.1.00007f601c001000.00007f601c00f000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0xc1e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc1f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc20c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc25c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc2ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc2c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc2d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc2e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc2fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc34c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xc374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      6227.1.00007f601c001000.00007f601c00f000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
      • 0xc735:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
      6224.1.00007f601c001000.00007f601c00f000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
        6224.1.00007f601c001000.00007f601c00f000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
        • 0xc1e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc1f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc20c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc220:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc234:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc248:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc25c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc2ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc2c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc2d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc2e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc2fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc34c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        • 0xc374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
        Click to see the 4 entries
        No Suricata rule has matched

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: boatnet.m68k.elfAvira: detected
        Source: boatnet.m68k.elfVirustotal: Detection: 64%Perma Link
        Source: boatnet.m68k.elfReversingLabs: Detection: 63%
        Source: global trafficTCP traffic: 192.168.2.23:51502 -> 209.141.36.93:3778
        Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
        Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
        Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownTCP traffic detected without corresponding DNS query: 209.141.36.93
        Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443

        System Summary

        barindex
        Source: boatnet.m68k.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: boatnet.m68k.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: 6227.1.00007f601c001000.00007f601c00f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: 6227.1.00007f601c001000.00007f601c00f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: 6224.1.00007f601c001000.00007f601c00f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: 6224.1.00007f601c001000.00007f601c00f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: Process Memory Space: boatnet.m68k.elf PID: 6227, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
        Source: Process Memory Space: boatnet.m68k.elf PID: 6227, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 2018, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 2077, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 2078, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 2079, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 2080, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 2083, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 2084, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 2114, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 2156, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 6235, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 6236, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 6237, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 6238, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 6239, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 6240, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 6249, result: successfulJump to behavior
        Source: ELF static info symbol of initial sample.symtab present: no
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 2018, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 2077, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 2078, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 2079, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 2080, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 2083, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 2084, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 2114, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 2156, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 6235, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 6236, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 6237, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 6238, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 6239, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 6240, result: successfulJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)SIGKILL sent: pid: 6249, result: successfulJump to behavior
        Source: boatnet.m68k.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: boatnet.m68k.elf, type: SAMPLEMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: 6227.1.00007f601c001000.00007f601c00f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: 6227.1.00007f601c001000.00007f601c00f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: 6224.1.00007f601c001000.00007f601c00f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: 6224.1.00007f601c001000.00007f601c00f000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: Process Memory Space: boatnet.m68k.elf PID: 6227, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
        Source: Process Memory Space: boatnet.m68k.elf PID: 6227, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
        Source: classification engineClassification label: mal76.spre.troj.linELF@0/0@0/0
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/local/share/fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /home/saturnino/.local/share/fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /home/saturnino/.fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/X11/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/cMap/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/cmap/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/opentype/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/type1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/X11/Type1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/X11/encodings/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/X11/misc/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/X11/util/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/cmap/adobe-cns1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/cmap/adobe-gb1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/cmap/adobe-japan1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/cmap/adobe-japan2/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/cmap/adobe-korea1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/opentype/malayalam/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/opentype/mathjax/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/opentype/noto/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/opentype/urw-base35/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/Gargi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/Gubbi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/Nakula/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/Navilu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/Sahadeva/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/Sarai/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/abyssinica/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/ancient-scripts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/dejavu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/droid/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/freefont/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/kacst/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/kacst-one/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/lao/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/lato/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/liberation/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/liberation2/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/lohit-assamese/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/lohit-bengali/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/lohit-kannada/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/lohit-oriya/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/lohit-tamil/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/lohit-telugu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/malayalam/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/noto/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/openoffice/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/padauk/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/pagul/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/samyak/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/samyak-fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/sinhala/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/tibetan-machine/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/tlwg/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/truetype/ubuntu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/type1/urw-base35/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Directory: /usr/share/fonts/X11/encodings/large/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/local/share/fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /home/saturnino/.local/share/fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /home/saturnino/.fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/X11/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/cMap/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/cmap/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/opentype/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/type1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/X11/Type1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/X11/encodings/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/X11/misc/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/X11/util/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/cmap/adobe-cns1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/cmap/adobe-gb1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/cmap/adobe-japan1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/cmap/adobe-japan2/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/cmap/adobe-korea1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/opentype/malayalam/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/opentype/mathjax/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/opentype/noto/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/opentype/urw-base35/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/Gargi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/Gubbi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/Nakula/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/Navilu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/Sahadeva/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/Sarai/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/abyssinica/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/ancient-scripts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/dejavu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/droid/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/freefont/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/kacst/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/kacst-one/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/lao/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/lato/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/liberation/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/liberation2/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/lohit-assamese/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/lohit-bengali/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/lohit-kannada/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/lohit-oriya/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/lohit-tamil/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/lohit-telugu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/malayalam/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/noto/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/openoffice/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/padauk/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/pagul/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/samyak/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/samyak-fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/sinhala/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/tibetan-machine/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/tlwg/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/truetype/ubuntu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/type1/urw-base35/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /usr/share/fonts/X11/encodings/large/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /home/saturnino/.cacheJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /home/saturnino/.localJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Directory: /home/saturnino/.configJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /home/saturnino/.Xdefaults-galassiaJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/local/share/fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /home/saturnino/.local/share/fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /home/saturnino/.fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/X11/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/cMap/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/cmap/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/opentype/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/type1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/X11/Type1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/X11/encodings/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/X11/misc/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/X11/util/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/cmap/adobe-cns1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/cmap/adobe-gb1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/cmap/adobe-japan1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/cmap/adobe-japan2/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/cmap/adobe-korea1/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/opentype/malayalam/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/opentype/mathjax/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/opentype/noto/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/opentype/urw-base35/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/Gargi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/Gubbi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/Nakula/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/Navilu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/Sahadeva/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/Sarai/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/abyssinica/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/ancient-scripts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/dejavu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/droid/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/freefont/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/kacst/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/kacst-one/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/lao/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/lato/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/liberation/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/liberation2/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/lohit-assamese/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/lohit-bengali/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/lohit-kannada/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/lohit-oriya/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/lohit-tamil/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/lohit-telugu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/malayalam/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/noto/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/openoffice/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/padauk/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/pagul/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/samyak/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/samyak-fonts/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/sinhala/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/tibetan-machine/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/tlwg/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/truetype/ubuntu/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/type1/urw-base35/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Directory: /usr/share/fonts/X11/encodings/large/.uuidJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6249)Directory: /home/saturnino/.cacheJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6249)Directory: /home/saturnino/.localJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6249)Directory: /home/saturnino/.configJump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 6249)Directory: /home/saturnino/.configJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/6236/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/6235/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1582/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/2033/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/2275/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/3088/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1612/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1579/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1699/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1335/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1698/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/2028/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1334/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1576/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/2302/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/3236/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/2025/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/2146/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/910/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/912/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/4446/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/6229/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/517/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/759/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/4447/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/4448/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/4449/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/2307/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/918/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/6240/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1594/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/2285/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/2281/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1349/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1623/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/761/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1622/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/884/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1983/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/2038/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1344/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1465/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1586/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1463/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/2156/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/800/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/6238/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/801/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/6237/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1629/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/6239/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1627/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1900/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/4470/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/4472/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/3021/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/491/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/2294/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/2050/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1877/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/772/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1633/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1599/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1632/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/774/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1477/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/654/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/896/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1476/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1872/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/2048/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/655/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1475/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/2289/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/656/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/777/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/657/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/6249/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/658/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/419/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/936/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1639/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/4503/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1638/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/2208/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/2180/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/4481/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/6145/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1809/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1494/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1890/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/2063/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/2062/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1888/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1886/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/420/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1489/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/785/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1642/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/788/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/667/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/789/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/4478/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/1648/cmdlineJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6226)File opened: /proc/6033/cmdlineJump to behavior
        Source: /usr/bin/dash (PID: 6195)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.Cs0ie8NMRW /tmp/tmp.09BWTqx8Ma /tmp/tmp.mVuRavtUwFJump to behavior
        Source: /usr/bin/dash (PID: 6196)Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.Cs0ie8NMRW /tmp/tmp.09BWTqx8Ma /tmp/tmp.mVuRavtUwFJump to behavior
        Source: /tmp/boatnet.m68k.elf (PID: 6224)Queries kernel information via 'uname': Jump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6238)Queries kernel information via 'uname': Jump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6239)Queries kernel information via 'uname': Jump to behavior
        Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 6240)Queries kernel information via 'uname': Jump to behavior
        Source: boatnet.m68k.elf, 6224.1.00007ffd4f8bf000.00007ffd4f8e0000.rw-.sdmp, boatnet.m68k.elf, 6227.1.00007ffd4f8bf000.00007ffd4f8e0000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-m68k/tmp/boatnet.m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/boatnet.m68k.elf
        Source: boatnet.m68k.elf, 6224.1.00005585480c0000.0000558548145000.rw-.sdmp, boatnet.m68k.elf, 6227.1.00005585480c0000.0000558548145000.rw-.sdmpBinary or memory string: U!/etc/qemu-binfmt/m68k
        Source: boatnet.m68k.elf, 6224.1.00007ffd4f8bf000.00007ffd4f8e0000.rw-.sdmp, boatnet.m68k.elf, 6227.1.00007ffd4f8bf000.00007ffd4f8e0000.rw-.sdmpBinary or memory string: /usr/bin/qemu-m68k
        Source: boatnet.m68k.elf, 6224.1.00005585480c0000.0000558548145000.rw-.sdmp, boatnet.m68k.elf, 6227.1.00005585480c0000.0000558548145000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/m68k

        Stealing of Sensitive Information

        barindex
        Source: Yara matchFile source: boatnet.m68k.elf, type: SAMPLE
        Source: Yara matchFile source: 6227.1.00007f601c001000.00007f601c00f000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 6224.1.00007f601c001000.00007f601c00f000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: boatnet.m68k.elf PID: 6227, type: MEMORYSTR

        Remote Access Functionality

        barindex
        Source: Yara matchFile source: boatnet.m68k.elf, type: SAMPLE
        Source: Yara matchFile source: 6227.1.00007f601c001000.00007f601c00f000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: 6224.1.00007f601c001000.00007f601c00f000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: boatnet.m68k.elf PID: 6227, type: MEMORYSTR
        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
        Hidden Files and Directories
        1
        OS Credential Dumping
        11
        Security Software Discovery
        Remote ServicesData from Local System1
        Encrypted Channel
        Exfiltration Over Other Network Medium1
        Service Stop
        CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
        File Deletion
        LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
        Non-Standard Port
        Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive1
        Application Layer Protocol
        Automated ExfiltrationData Encrypted for Impact
        No configs have been found
        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1641136 Sample: boatnet.m68k.elf Startdate: 18/03/2025 Architecture: LINUX Score: 76 24 209.141.36.93, 3778, 51502, 51504 PONYNETUS United States 2->24 26 109.202.202.202, 80 INIT7CH Switzerland 2->26 28 2 other IPs or domains 2->28 30 Malicious sample detected (through community Yara rule) 2->30 32 Antivirus / Scanner detection for submitted sample 2->32 34 Multi AV Scanner detection for submitted file 2->34 36 Yara detected Mirai 2->36 7 dash rm boatnet.m68k.elf 2->7         started        9 xfce4-panel wrapper-2.0 2->9         started        11 dash rm 2->11         started        13 6 other processes 2->13 signatures3 process4 process5 15 boatnet.m68k.elf 7->15         started        18 boatnet.m68k.elf 7->18         started        20 boatnet.m68k.elf 7->20         started        22 wrapper-2.0 xfpm-power-backlight-helper 9->22         started        signatures6 38 Sample tries to kill multiple processes (SIGKILL) 15->38

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand
        SourceDetectionScannerLabelLink
        boatnet.m68k.elf64%VirustotalBrowse
        boatnet.m68k.elf64%ReversingLabsLinux.Backdoor.Mirai
        boatnet.m68k.elf100%AviraEXP/ELF.Gafgyt.D
        No Antivirus matches
        No Antivirus matches
        No Antivirus matches

        Download Network PCAP: filteredfull

        No contacted domains info
        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs
        IPDomainCountryFlagASNASN NameMalicious
        209.141.36.93
        unknownUnited States
        53667PONYNETUSfalse
        109.202.202.202
        unknownSwitzerland
        13030INIT7CHfalse
        91.189.91.43
        unknownUnited Kingdom
        41231CANONICAL-ASGBfalse
        91.189.91.42
        unknownUnited Kingdom
        41231CANONICAL-ASGBfalse
        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        209.141.36.93boatnet.x86.elfGet hashmaliciousMiraiBrowse
          boatnet.sh4.elfGet hashmaliciousMiraiBrowse
            boatnet.arm.elfGet hashmaliciousMiraiBrowse
              boatnet.arm7.elfGet hashmaliciousMiraiBrowse
                boatnet.ppc.elfGet hashmaliciousMiraiBrowse
                  boatnet.mips.elfGet hashmaliciousMiraiBrowse
                    boatnet.mpsl.elfGet hashmaliciousMiraiBrowse
                      109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
                      • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
                      91.189.91.43boatnet.arc.elfGet hashmaliciousMiraiBrowse
                        sync.arm5.elfGet hashmaliciousUnknownBrowse
                          sync.x86_64.elfGet hashmaliciousUnknownBrowse
                            sync.x86.elfGet hashmaliciousUnknownBrowse
                              sync.mipsel.elfGet hashmaliciousUnknownBrowse
                                sync.arm6.elfGet hashmaliciousUnknownBrowse
                                  sync.mips.elfGet hashmaliciousUnknownBrowse
                                    gigab.mips.elfGet hashmaliciousUnknownBrowse
                                      na.elfGet hashmaliciousPrometeiBrowse
                                        na.elfGet hashmaliciousPrometeiBrowse
                                          91.189.91.42boatnet.arc.elfGet hashmaliciousMiraiBrowse
                                            sync.arm7.elfGet hashmaliciousUnknownBrowse
                                              sync.arm5.elfGet hashmaliciousUnknownBrowse
                                                sync.x86_64.elfGet hashmaliciousUnknownBrowse
                                                  sync.x86.elfGet hashmaliciousUnknownBrowse
                                                    sync.mipsel.elfGet hashmaliciousUnknownBrowse
                                                      sync.arm6.elfGet hashmaliciousUnknownBrowse
                                                        sync.mips.elfGet hashmaliciousUnknownBrowse
                                                          gigab.mips.elfGet hashmaliciousUnknownBrowse
                                                            na.elfGet hashmaliciousPrometeiBrowse
                                                              No context
                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                              CANONICAL-ASGBboatnet.sh4.elfGet hashmaliciousMiraiBrowse
                                                              • 185.125.190.26
                                                              boatnet.arc.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              sync.arm7.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 185.125.190.26
                                                              sync.arm5.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              sync.sparc.elfGet hashmaliciousUnknownBrowse
                                                              • 185.125.190.26
                                                              sync.x86_64.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              sync.x86.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              sync.mipsel.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              sync.arm6.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              CANONICAL-ASGBboatnet.sh4.elfGet hashmaliciousMiraiBrowse
                                                              • 185.125.190.26
                                                              boatnet.arc.elfGet hashmaliciousMiraiBrowse
                                                              • 91.189.91.42
                                                              sync.arm7.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 185.125.190.26
                                                              sync.arm5.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              sync.sparc.elfGet hashmaliciousUnknownBrowse
                                                              • 185.125.190.26
                                                              sync.x86_64.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              sync.x86.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              sync.mipsel.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              sync.arm6.elfGet hashmaliciousUnknownBrowse
                                                              • 91.189.91.42
                                                              PONYNETUSboatnet.x86.elfGet hashmaliciousMiraiBrowse
                                                              • 209.141.36.93
                                                              boatnet.sh4.elfGet hashmaliciousMiraiBrowse
                                                              • 209.141.36.93
                                                              boatnet.arm.elfGet hashmaliciousMiraiBrowse
                                                              • 209.141.36.93
                                                              boatnet.arm7.elfGet hashmaliciousMiraiBrowse
                                                              • 209.141.36.93
                                                              boatnet.ppc.elfGet hashmaliciousMiraiBrowse
                                                              • 209.141.36.93
                                                              kworker.elfGet hashmaliciousUnknownBrowse
                                                              • 198.98.48.4
                                                              arm.elfGet hashmaliciousMiraiBrowse
                                                              • 107.189.4.201
                                                              mpsl.elfGet hashmaliciousMiraiBrowse
                                                              • 107.189.4.201
                                                              arm7.elfGet hashmaliciousMiraiBrowse
                                                              • 107.189.4.201
                                                              Q3N5HdmTIp.exeGet hashmaliciousUnknownBrowse
                                                              • 107.189.1.160
                                                              INIT7CHboatnet.arc.elfGet hashmaliciousMiraiBrowse
                                                              • 109.202.202.202
                                                              sync.arm7.elfGet hashmaliciousUnknownBrowse
                                                              • 109.202.202.202
                                                              sync.arm5.elfGet hashmaliciousUnknownBrowse
                                                              • 109.202.202.202
                                                              sync.x86_64.elfGet hashmaliciousUnknownBrowse
                                                              • 109.202.202.202
                                                              sync.x86.elfGet hashmaliciousUnknownBrowse
                                                              • 109.202.202.202
                                                              sync.mipsel.elfGet hashmaliciousUnknownBrowse
                                                              • 109.202.202.202
                                                              sync.arm6.elfGet hashmaliciousUnknownBrowse
                                                              • 109.202.202.202
                                                              sync.mips.elfGet hashmaliciousUnknownBrowse
                                                              • 109.202.202.202
                                                              gigab.mips.elfGet hashmaliciousUnknownBrowse
                                                              • 109.202.202.202
                                                              na.elfGet hashmaliciousPrometeiBrowse
                                                              • 109.202.202.202
                                                              No context
                                                              No context
                                                              No created / dropped files found
                                                              File type:ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
                                                              Entropy (8bit):6.254940650982078
                                                              TrID:
                                                              • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                              File name:boatnet.m68k.elf
                                                              File size:54'932 bytes
                                                              MD5:7e25e275aa75dfa71ece064b3e456ad3
                                                              SHA1:82fa64827c45173508b2f3d51d8411337b434397
                                                              SHA256:76186cf724d37777161fc1b7ef726a77d4e58cc3503cc80d9b75aa27835c7aaf
                                                              SHA512:6840d5cb0ddf40e526674026eb93ca3058ca12b4626c94ff4c26f2b3149ae92435b5b63490dcf60c08d45d6835e5879415eb0c132343c5908ff52e34857de4e1
                                                              SSDEEP:768:gduPBFnHooqR8qOCKiucH4Kg9e+TK806MMUVjzkfQXObHud2oGm:r/hqapMDg9eqK806MHdkfQX6HuCm
                                                              TLSH:CC330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85
                                                              File Content Preview:.ELF.......................D...4.........4. ...(.................................. ....................(.......... .dt.Q............................NV..a....da.....N^NuNV..J9....f>"y.... QJ.g.X.#.....N."y.... QJ.f.A.....J.g.Hy....N.X.........N^NuNV..N^NuN

                                                              ELF header

                                                              Class:ELF32
                                                              Data:2's complement, big endian
                                                              Version:1 (current)
                                                              Machine:MC68000
                                                              Version Number:0x1
                                                              Type:EXEC (Executable file)
                                                              OS/ABI:UNIX - System V
                                                              ABI Version:0
                                                              Entry Point Address:0x80000144
                                                              Flags:0x0
                                                              ELF Header Size:52
                                                              Program Header Offset:52
                                                              Program Header Size:32
                                                              Number of Program Headers:3
                                                              Section Header Offset:54532
                                                              Section Header Size:40
                                                              Number of Section Headers:10
                                                              Header String Table Index:9
                                                              NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                              NULL0x00x00x00x00x0000
                                                              .initPROGBITS0x800000940x940x140x00x6AX002
                                                              .textPROGBITS0x800000a80xa80xc12e0x00x6AX004
                                                              .finiPROGBITS0x8000c1d60xc1d60xe0x00x6AX002
                                                              .rodataPROGBITS0x8000c1e40xc1e40x10b20x00x2A002
                                                              .ctorsPROGBITS0x8000f29c0xd29c0x80x00x3WA004
                                                              .dtorsPROGBITS0x8000f2a40xd2a40x80x00x3WA004
                                                              .dataPROGBITS0x8000f2b00xd2b00x2140x00x3WA004
                                                              .bssNOBITS0x8000f4c40xd4c40x2a00x00x3WA004
                                                              .shstrtabSTRTAB0x00xd4c40x3e0x00x0001
                                                              TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                              LOAD0x00x800000000x800000000xd2960xd2966.29050x5R E0x2000.init .text .fini .rodata
                                                              LOAD0xd29c0x8000f29c0x8000f29c0x2280x4c83.03460x6RW 0x2000.ctors .dtors .data .bss
                                                              GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

                                                              Download Network PCAP: filteredfull

                                                              • Total Packets: 130
                                                              • 3778 undefined
                                                              • 443 (HTTPS)
                                                              • 80 (HTTP)
                                                              TimestampSource PortDest PortSource IPDest IP
                                                              Mar 18, 2025 03:28:30.231709003 CET515023778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:30.236535072 CET377851502209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:30.236582994 CET515023778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:30.240150928 CET515023778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:30.245198965 CET377851502209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:30.245258093 CET515023778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:30.249870062 CET377851502209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:30.835325003 CET377851502209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:30.836138010 CET515023778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:30.836138010 CET515023778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:30.836697102 CET515043778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:30.841444016 CET377851504209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:30.841528893 CET515043778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:30.842300892 CET515043778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:30.847019911 CET377851504209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:30.847065926 CET515043778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:30.851768017 CET377851504209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:31.413887024 CET377851504209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:31.414092064 CET515043778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:31.414237976 CET515043778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:31.414788008 CET515063778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:31.419492006 CET377851506209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:31.419549942 CET515063778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:31.420336962 CET515063778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:31.426760912 CET377851506209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:31.426804066 CET515063778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:31.433451891 CET377851506209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:31.930147886 CET43928443192.168.2.2391.189.91.42
                                                              Mar 18, 2025 03:28:32.018354893 CET377851506209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:32.018567085 CET515063778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:32.018629074 CET515063778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:32.019162893 CET515083778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:32.023854017 CET377851508209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:32.023912907 CET515083778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:32.024766922 CET515083778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:32.029434919 CET377851508209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:32.029480934 CET515083778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:32.034174919 CET377851508209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:32.603257895 CET377851508209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:32.603393078 CET515083778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:32.603439093 CET515083778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:32.603940010 CET515103778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:32.608650923 CET377851510209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:32.608736992 CET515103778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:32.609374046 CET515103778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:32.614039898 CET377851510209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:32.614106894 CET515103778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:32.618724108 CET377851510209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:33.187798023 CET377851510209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:33.188020945 CET515103778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:33.188147068 CET515103778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:33.188770056 CET515123778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:33.193456888 CET377851512209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:33.193577051 CET515123778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:33.194297075 CET515123778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:33.199093103 CET377851512209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:33.199171066 CET515123778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:33.203829050 CET377851512209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:33.769015074 CET377851512209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:33.769191027 CET515123778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:33.769263029 CET515123778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:33.770170927 CET515143778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:33.774837971 CET377851514209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:33.774914980 CET515143778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:33.775710106 CET515143778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:33.780369043 CET377851514209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:33.780412912 CET515143778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:33.785105944 CET377851514209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:34.365600109 CET377851514209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:34.365720987 CET515143778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:34.365757942 CET515143778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:34.366214991 CET515163778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:34.370893955 CET377851516209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:34.370975018 CET515163778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:34.371473074 CET515163778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:34.376190901 CET377851516209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:34.376230955 CET515163778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:34.380850077 CET377851516209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:34.971514940 CET377851516209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:34.971709013 CET515163778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:34.971862078 CET515163778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:34.972316027 CET515183778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:34.976957083 CET377851518209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:34.977018118 CET515183778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:34.977590084 CET515183778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:34.982208967 CET377851518209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:34.982279062 CET515183778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:34.987169027 CET377851518209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:36.090483904 CET377851518209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:36.090504885 CET377851518209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:36.090527058 CET377851518209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:36.090549946 CET515183778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:36.090549946 CET515183778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:36.090590000 CET515183778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:36.090590000 CET515183778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:36.090647936 CET377851518209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:36.090701103 CET515183778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:36.091770887 CET515203778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:36.096415997 CET377851520209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:36.096466064 CET515203778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:36.099863052 CET515203778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:36.104476929 CET377851520209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:36.104521036 CET515203778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:36.109132051 CET377851520209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:36.712332010 CET377851520209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:36.712404966 CET515203778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:36.712451935 CET515203778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:36.714411974 CET515223778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:36.721226931 CET377851522209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:36.721290112 CET515223778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:36.725155115 CET515223778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:36.734285116 CET377851522209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:36.734344006 CET515223778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:36.740400076 CET377851522209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:37.305294991 CET42836443192.168.2.2391.189.91.43
                                                              Mar 18, 2025 03:28:37.352638960 CET377851522209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:37.352726936 CET515223778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:37.352756977 CET515223778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:37.354675055 CET515243778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:37.359416008 CET377851524209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:37.359541893 CET515243778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:37.364315033 CET515243778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:37.368918896 CET377851524209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:37.368968010 CET515243778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:37.373622894 CET377851524209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:37.956300020 CET377851524209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:37.956403971 CET515243778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:37.958899021 CET515243778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:37.973417044 CET515263778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:37.978158951 CET377851526209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:37.978224993 CET515263778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:37.982654095 CET515263778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:37.987252951 CET377851526209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:37.987297058 CET515263778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:37.991903067 CET377851526209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:38.559022903 CET377851526209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:38.559084892 CET515263778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:38.559124947 CET515263778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:38.561387062 CET515283778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:38.566078901 CET377851528209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:38.566133976 CET515283778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:38.570650101 CET515283778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:38.575417042 CET377851528209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:38.575469017 CET515283778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:38.580102921 CET377851528209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:38.841063023 CET4251680192.168.2.23109.202.202.202
                                                              Mar 18, 2025 03:28:39.136912107 CET377851528209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:39.136967897 CET515283778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:39.137017965 CET515283778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:39.138473988 CET515303778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:39.143137932 CET377851530209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:39.143203974 CET515303778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:39.147162914 CET515303778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:39.151802063 CET377851530209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:39.151865005 CET515303778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:39.156498909 CET377851530209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:39.743786097 CET377851530209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:39.743851900 CET515303778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:39.743887901 CET515303778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:39.745397091 CET515323778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:39.750080109 CET377851532209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:39.750152111 CET515323778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:39.754738092 CET515323778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:39.759396076 CET377851532209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:39.759480000 CET515323778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:39.764118910 CET377851532209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:40.321656942 CET377851532209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:40.321762085 CET515323778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:40.321762085 CET515323778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:40.323448896 CET515343778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:40.328197956 CET377851534209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:40.328253984 CET515343778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:40.333000898 CET515343778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:40.337634087 CET377851534209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:40.337676048 CET515343778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:40.342361927 CET377851534209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:40.901274920 CET377851534209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:40.905005932 CET515343778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:40.905051947 CET515343778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:40.933218002 CET515363778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:40.937978029 CET377851536209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:40.938072920 CET515363778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:40.941696882 CET515363778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:40.946350098 CET377851536209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:40.946403980 CET515363778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:40.951064110 CET377851536209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:41.511210918 CET377851536209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:41.511347055 CET515363778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:41.511396885 CET515363778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:41.512969017 CET515383778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:41.517642975 CET377851538209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:41.517703056 CET515383778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:41.521848917 CET515383778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:41.526549101 CET377851538209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:41.526592016 CET515383778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:41.531384945 CET377851538209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:51.527443886 CET515383778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:51.532310009 CET377851538209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:51.689275026 CET377851538209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:28:51.689395905 CET515383778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:28:53.431112051 CET43928443192.168.2.2391.189.91.42
                                                              Mar 18, 2025 03:29:03.669794083 CET42836443192.168.2.2391.189.91.43
                                                              Mar 18, 2025 03:29:09.812908888 CET4251680192.168.2.23109.202.202.202
                                                              Mar 18, 2025 03:29:34.385415077 CET43928443192.168.2.2391.189.91.42
                                                              Mar 18, 2025 03:29:51.737245083 CET515383778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:29:51.741981983 CET377851538209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:29:51.898191929 CET377851538209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:29:51.898401976 CET515383778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:30:51.949094057 CET515383778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:30:51.954219103 CET377851538209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:30:52.110569954 CET377851538209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:30:52.110656023 CET515383778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:31:52.146786928 CET515383778192.168.2.23209.141.36.93
                                                              Mar 18, 2025 03:31:52.151681900 CET377851538209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:31:52.308886051 CET377851538209.141.36.93192.168.2.23
                                                              Mar 18, 2025 03:31:52.309046030 CET515383778192.168.2.23209.141.36.93

                                                              System Behavior

                                                              Start time (UTC):02:28:24
                                                              Start date (UTC):18/03/2025
                                                              Path:/usr/bin/dash
                                                              Arguments:-
                                                              File size:129816 bytes
                                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                              Start time (UTC):02:28:24
                                                              Start date (UTC):18/03/2025
                                                              Path:/usr/bin/rm
                                                              Arguments:rm -f /tmp/tmp.Cs0ie8NMRW /tmp/tmp.09BWTqx8Ma /tmp/tmp.mVuRavtUwF
                                                              File size:72056 bytes
                                                              MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                                              Start time (UTC):02:28:24
                                                              Start date (UTC):18/03/2025
                                                              Path:/usr/bin/dash
                                                              Arguments:-
                                                              File size:129816 bytes
                                                              MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                                              Start time (UTC):02:28:24
                                                              Start date (UTC):18/03/2025
                                                              Path:/usr/bin/rm
                                                              Arguments:rm -f /tmp/tmp.Cs0ie8NMRW /tmp/tmp.09BWTqx8Ma /tmp/tmp.mVuRavtUwF
                                                              File size:72056 bytes
                                                              MD5 hash:aa2b5496fdbfd88e38791ab81f90b95b

                                                              Start time (UTC):02:28:29
                                                              Start date (UTC):18/03/2025
                                                              Path:/tmp/boatnet.m68k.elf
                                                              Arguments:/tmp/boatnet.m68k.elf
                                                              File size:4463432 bytes
                                                              MD5 hash:cd177594338c77b895ae27c33f8f86cc

                                                              Start time (UTC):02:28:29
                                                              Start date (UTC):18/03/2025
                                                              Path:/tmp/boatnet.m68k.elf
                                                              Arguments:-
                                                              File size:4463432 bytes
                                                              MD5 hash:cd177594338c77b895ae27c33f8f86cc

                                                              Start time (UTC):02:28:29
                                                              Start date (UTC):18/03/2025
                                                              Path:/tmp/boatnet.m68k.elf
                                                              Arguments:-
                                                              File size:4463432 bytes
                                                              MD5 hash:cd177594338c77b895ae27c33f8f86cc

                                                              Start time (UTC):02:28:29
                                                              Start date (UTC):18/03/2025
                                                              Path:/tmp/boatnet.m68k.elf
                                                              Arguments:-
                                                              File size:4463432 bytes
                                                              MD5 hash:cd177594338c77b895ae27c33f8f86cc

                                                              Start time (UTC):02:28:34
                                                              Start date (UTC):18/03/2025
                                                              Path:/usr/bin/xfce4-panel
                                                              Arguments:-
                                                              File size:375768 bytes
                                                              MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                                                              Start time (UTC):02:28:34
                                                              Start date (UTC):18/03/2025
                                                              Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                                              Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 12582920 systray "Notification Area" "Area where notification icons appear"
                                                              File size:35136 bytes
                                                              MD5 hash:ac0b8a906f359a8ae102244738682e76

                                                              Start time (UTC):02:28:34
                                                              Start date (UTC):18/03/2025
                                                              Path:/usr/bin/xfce4-panel
                                                              Arguments:-
                                                              File size:375768 bytes
                                                              MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                                                              Start time (UTC):02:28:34
                                                              Start date (UTC):18/03/2025
                                                              Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                                              Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 12582921 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"
                                                              File size:35136 bytes
                                                              MD5 hash:ac0b8a906f359a8ae102244738682e76

                                                              Start time (UTC):02:28:34
                                                              Start date (UTC):18/03/2025
                                                              Path:/usr/bin/xfce4-panel
                                                              Arguments:-
                                                              File size:375768 bytes
                                                              MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                                                              Start time (UTC):02:28:34
                                                              Start date (UTC):18/03/2025
                                                              Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                                              Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 12582922 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"
                                                              File size:35136 bytes
                                                              MD5 hash:ac0b8a906f359a8ae102244738682e76

                                                              Start time (UTC):02:28:34
                                                              Start date (UTC):18/03/2025
                                                              Path:/usr/bin/xfce4-panel
                                                              Arguments:-
                                                              File size:375768 bytes
                                                              MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                                                              Start time (UTC):02:28:34
                                                              Start date (UTC):18/03/2025
                                                              Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                                              Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 12582923 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
                                                              File size:35136 bytes
                                                              MD5 hash:ac0b8a906f359a8ae102244738682e76

                                                              Start time (UTC):02:28:37
                                                              Start date (UTC):18/03/2025
                                                              Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                                              Arguments:-
                                                              File size:35136 bytes
                                                              MD5 hash:ac0b8a906f359a8ae102244738682e76

                                                              Start time (UTC):02:28:37
                                                              Start date (UTC):18/03/2025
                                                              Path:/usr/sbin/xfpm-power-backlight-helper
                                                              Arguments:/usr/sbin/xfpm-power-backlight-helper --get-max-brightness
                                                              File size:14656 bytes
                                                              MD5 hash:3d221ad23f28ca3259f599b1664e2427

                                                              Start time (UTC):02:28:34
                                                              Start date (UTC):18/03/2025
                                                              Path:/usr/bin/xfce4-panel
                                                              Arguments:-
                                                              File size:375768 bytes
                                                              MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                                                              Start time (UTC):02:28:34
                                                              Start date (UTC):18/03/2025
                                                              Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                                              Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 12582924 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"
                                                              File size:35136 bytes
                                                              MD5 hash:ac0b8a906f359a8ae102244738682e76

                                                              Start time (UTC):02:28:34
                                                              Start date (UTC):18/03/2025
                                                              Path:/usr/bin/xfce4-panel
                                                              Arguments:-
                                                              File size:375768 bytes
                                                              MD5 hash:a15b657c7d54ac1385f1f15004ea6784

                                                              Start time (UTC):02:28:34
                                                              Start date (UTC):18/03/2025
                                                              Path:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
                                                              Arguments:/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 12582925 actions "Action Buttons" "Log out, lock or other system actions"
                                                              File size:35136 bytes
                                                              MD5 hash:ac0b8a906f359a8ae102244738682e76

                                                              Start time (UTC):02:28:37
                                                              Start date (UTC):18/03/2025
                                                              Path:/usr/bin/dbus-daemon
                                                              Arguments:-
                                                              File size:249032 bytes
                                                              MD5 hash:3089d47e3f3ab84cd81c48fd406d7a8c

                                                              Start time (UTC):02:28:37
                                                              Start date (UTC):18/03/2025
                                                              Path:/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
                                                              Arguments:/usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd
                                                              File size:112880 bytes
                                                              MD5 hash:4c7a0d6d258bb970905b19b84abcd8e9