Create Interactive Tour

Linux Analysis Report
morte.sh4.elf

Overview

General Information

Sample name:	morte.sh4.elf
Analysis ID:	1646185
MD5:	42b2d15d32b87dfbab5daf1b76d7ce76
SHA1:	7c3d3dd043b5ff31aebec14b14be9c498b6679d1
SHA256:	131f936760e0d6bd8a91765fdf63bc55a668f77e05e86ba29e14ae265118c037
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Okiru

Score:	84
Range:	0 - 100

Signatures

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Gafgyt

Yara detected Okiru

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1646185
Start date and time:	2025-03-23 15:27:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	morte.sh4.elf
Detection:	MAL
Classification:	mal84.spre.troj.linELF@0/47@3/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/morte.sh4.elf
PID:	6239
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

morte.sh4.elf (PID: 6239, Parent: 6162, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/morte.sh4.elf

morte.sh4.elf New Fork (PID: 6241, Parent: 6239)

morte.sh4.elf New Fork (PID: 6247, Parent: 6241)

morte.sh4.elf New Fork (PID: 6248, Parent: 6241)

systemd New Fork (PID: 6254, Parent: 1)

journalctl (PID: 6254, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6275, Parent: 1)

dbus-daemon (PID: 6275, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6289, Parent: 1)

rsyslogd (PID: 6289, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6290, Parent: 1860)

pulseaudio (PID: 6290, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

gvfsd-fuse New Fork (PID: 6291, Parent: 2038)

fusermount (PID: 6291, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6296, Parent: 1)

systemd-journald (PID: 6296, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6298, Parent: 1)

dbus-daemon (PID: 6298, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6301, Parent: 1)

rsyslogd (PID: 6301, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6310, Parent: 1)

systemd-logind (PID: 6310, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

gdm3 New Fork (PID: 6370, Parent: 1320)

Default (PID: 6370, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6371, Parent: 1320)

Default (PID: 6371, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6372, Parent: 1320)

Default (PID: 6372, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6375, Parent: 1)

agetty (PID: 6375, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6376, Parent: 1)

gpu-manager (PID: 6376, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6377, Parent: 6376)

sh (PID: 6377, Parent: 6376, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6378, Parent: 6377)

grep (PID: 6378, Parent: 6377, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6379, Parent: 6376)

sh (PID: 6379, Parent: 6376, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6380, Parent: 6379)

grep (PID: 6380, Parent: 6379, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6381, Parent: 6376)

sh (PID: 6381, Parent: 6376, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6382, Parent: 6381)

grep (PID: 6382, Parent: 6381, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6383, Parent: 6376)

sh (PID: 6383, Parent: 6376, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6384, Parent: 6383)

grep (PID: 6384, Parent: 6383, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6385, Parent: 6376)

sh (PID: 6385, Parent: 6376, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6386, Parent: 6385)

grep (PID: 6386, Parent: 6385, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6387, Parent: 6376)

sh (PID: 6387, Parent: 6376, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6388, Parent: 6387)

grep (PID: 6388, Parent: 6387, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6389, Parent: 6376)

sh (PID: 6389, Parent: 6376, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6390, Parent: 6389)

grep (PID: 6390, Parent: 6389, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6392, Parent: 6376)

sh (PID: 6392, Parent: 6376, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6393, Parent: 6392)

grep (PID: 6393, Parent: 6392, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6394, Parent: 1)

journalctl (PID: 6394, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6399, Parent: 1)

generate-config (PID: 6399, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6400, Parent: 6399)

pkill (PID: 6400, Parent: 6399, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6401, Parent: 1)

gdm-wait-for-drm (PID: 6401, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6406, Parent: 1)

gdm3 (PID: 6406, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6409, Parent: 6406)

plymouth (PID: 6409, Parent: 6406, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6425, Parent: 6406)

gdm-session-worker (PID: 6425, Parent: 6406, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6429, Parent: 6425)

gdm-wayland-session (PID: 6429, Parent: 6425, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6431, Parent: 6429)

dbus-daemon (PID: 6431, Parent: 6429, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6433, Parent: 6431)

dbus-daemon New Fork (PID: 6434, Parent: 6433)

false (PID: 6434, Parent: 6433, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6435, Parent: 6429)

dbus-run-session (PID: 6435, Parent: 6429, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6438, Parent: 6435)

dbus-daemon (PID: 6438, Parent: 6435, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6439, Parent: 6406)

Default (PID: 6439, Parent: 6406, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6440, Parent: 6406)

Default (PID: 6440, Parent: 6406, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6410, Parent: 1)

accounts-daemon (PID: 6410, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6416, Parent: 6410)

language-validate (PID: 6416, Parent: 6410, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6417, Parent: 6416)

language-options (PID: 6417, Parent: 6416, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6418, Parent: 6417)

sh (PID: 6418, Parent: 6417, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6419, Parent: 6418)

locale (PID: 6419, Parent: 6418, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6420, Parent: 6418)

grep (PID: 6420, Parent: 6418, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6421, Parent: 1)

polkitd (PID: 6421, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6464, Parent: 1860)

dbus-daemon (PID: 6464, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6467, Parent: 1860)

pulseaudio (PID: 6467, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6468, Parent: 1)

rtkit-daemon (PID: 6468, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
morte.sh4.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
morte.sh4.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security

Memory Dumps

Source	Rule	Description	Author
6248.1.00007fb8f8400000.00007fb8f841a000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6248.1.00007fb8f8400000.00007fb8f841a000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
6241.1.00007fb8f8400000.00007fb8f841a000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6241.1.00007fb8f8400000.00007fb8f841a000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
6247.1.00007fb8f8400000.00007fb8f841a000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6247.1.00007fb8f8400000.00007fb8f841a000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
6239.1.00007fb8f8400000.00007fb8f841a000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6239.1.00007fb8f8400000.00007fb8f841a000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: morte.sh4.elf PID: 6239	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: morte.sh4.elf PID: 6241	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: morte.sh4.elf PID: 6247	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: morte.sh4.elf PID: 6248	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Click to see the 7 entries

String: lbyte/proc/%d/net/tcp %*d: %*x:%x/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraJoshohajime902i13BzSxLxBxeYHOHO-LUGO7HOHO-U79OLJuYfouyf87NiGGeR69xdSO190Ij1XLOLKIKEEEDDEekjheory98escansh4MDMAfdevalvexscanspcMELTEDNINJAREALZflexsonskidsscanx86MISAKI-U79OLfoAxi102kxeswodjwodjwojMmKiy7f87lfreecookiex86sysgpufrgegesysupdater0DnAzepdNiGGeRD0nks69frgreu0x766f6964NiGGeRd0nks1337gafturasgbsigboa120i3UI49OaF3geaevaiolmao123123aOfurain0n4H34DggTrexewwasads1293194hjXDOthLaLosnggtwget-log1337SoraLOADERSAIAKINAggtq1378bfp919GRB1Q2SAIAKUSOggtr14FaSEXSLAVE1337ggtt1902a3u912u3u4haetrghbr19ju3dSORAojkf120hehahejeje922U2JDJA901F91SlaVLav12helpmedaddthhhhh2wgg9qphbqSlav3Th3seD3viceshzSmYZjYMQ5GbfSoRAxD123LOLiaGv5aA3SoRAxD420LOLinsomni640277SoraBeReppin1337ipcamCache66tlGg9QjUYfouyf876ke3TOKYO3lyEeaXul2dULCVxh93OfjHZ2zTY2gD6MZvKc7KU6rmMkiy6f87lA023UU4U24UIUTheWeekndmioribitchesA5p9TheWeekndsmnblkjpoiAbAdTokyosnebAkiruU8inTznetstatsAlexW9RCAKM20TnewnetwordAyo215WordnloadsBAdAsVWordmanenotyakuzaaBelchWordnetsobpBigN0gg0r420X0102I34fofhasfhiafhoiX19I239124UIUoismXSHJEHHEIIHWOolsVNwo12DeportedDeportedXkTer0GbA1onry0v03FortniteDownLOLZY0urM0mGaypussyfartlmaojkGrAcEnIgGeRaNnYvdGkqndCOqGeoRBe6BEGuiltyCrownZEuS69s4beBsEQhdHOHO-KSNDOZEuz69sat1234aj93hJ23scanHAalie293z0k2LscanJoshoARMHellInSideayyyGangShitscanJoshoARM5HighFryb1glscanJoshoARM6IWhPyucDbJboatnetzscanJoshoARM7IuYgujeIqnbtbatrtahzexsexscanJoshoM68KJJDUHEWBBBIBscanJoshoMIPSJSDGIEVIVAVIGcKbVkzGOPascanJoshoMPSLccADscanJoshoPPCKAZEN-OIU97chickenxingsscanJoshoSH4yakuskzm8KAZEN-PO78HcleanerscanJoshoSPCKAZEN-U79OLdbeefscanJoshoX86yakuz4c24KETASHI32ddrwelperscanarm5zPnr6HpQj2Kaishi-Iz90Ydeexecscanarm6zdrtfxcgyKatrina32doCP3fVjscanarm7zxcfhuioKsif91je39scanm68kKuasadvrhelperl33t_feetl33tl33tfeetscanmipsKuasaBinsMateeQnOhRk85rscanmpslLOLHHHOHOHBUIeXK20CL12ZnyamezyQBotBladeSPOOKYhikariwasherep4029x91xx32uhj4gbejhwizardzhra.outboatnetdbgcondiheroshimaskid.dbglzrdPownedSecurity69.aresfxlyazsxhyUNSTABLEunstable_is_the_story_of_the_universemoobotjnsd9sdoilayourmomgaeissdfjiougsiojOasisSEGRJIJHFVNHSNHEIHFOSapep999KOWAI-BAdAsVKOWAI-SADjHKipU7Ylairdropmalwareyour_verry_fucking_gayBig-Bro-Brightsefaexecshirololieagle.For-Gai-Mezy0x6axNLcloqkisvspookymythSwergjmioGKILLEJW(IU(JIWERGFJGJWJRGHetrhwewrtheIuFdKssCxzjSDFJIjioOnrYoXd666ewrtkjokethajbdf89wu823AAaasrdgsWsGA4@F6FGhostWuzHere666BOGOMIPSbeastmodedvrHelperbestmodesfc6aJfIuYDemon.xeno-is-godICY-P-0ODIJgSHUIHIfhwrgLhu87VhvQPzlunadakuexecbinTacoBellGodYololigangExecutionorbitclientAmne

Source: global traffic

TCP traffic: 192.168.2.23:46292 -> 176.65.142.252:7575

Source: global traffic

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6301)

Reads hosts file: /etc/hosts

Jump to behavior

Source: /tmp/morte.sh4.elf (PID: 6241)	Socket: 127.0.0.1:65407	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6406)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6431)	Socket: unknown address family	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.142.252
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.142.252
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.142.252
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.142.252
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.142.252
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.142.252
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.35.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 53070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53070
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Sample tries to kill a massive number of system processes

Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 491, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 720, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 721, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 759, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 761, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 772, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 774, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 777, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 793, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 797, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 141, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 144, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 157, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 201, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 208, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 209, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 210, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 211, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 212, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 213, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 214, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 215, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 217, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 218, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 346, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 379, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 420, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 517, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 654, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 655, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 656, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 657, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 667, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 670, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 675, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 677, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 896, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent to PID below 1000: pid: 910, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1389, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1476, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1809, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 4509, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6074, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6222, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6223, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6254, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6275, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6288, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6289, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6290, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2009, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2033, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2128, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2281, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2285, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2294, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2307, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 4442, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 4443, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 4476, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 4481, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 4487, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6085, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6187, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6195, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6241, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6247, result: unknown	Jump to behavior

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: busyboxxx
Source: Initial sample	String containing 'busybox' found: busyboxx
Source: Initial sample	String containing 'busybox' found: lbyte/proc/%d/net/tcp %d: %x:%x/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraJoshohajime902i13BzSxLxBxeYHOHO-LUGO7HOHO-U79OLJuYfouyf87NiGGeR69xdSO190Ij1XLOLKIKEEEDDEekjheory98escansh4MDMAfdevalvexscanspcMELTEDNINJAREALZflexsonskidsscanx86MISAKI-U79OLfoAxi102kxeswodjwodjwojMmKiy7f87lfreecookiex86sysgpufrgegesysupdater0DnAzepdNiGGeRD0nks69frgreu0x766f6964NiGGeRd0nks1337gafturasgbsigboa120i3UI49OaF3geaevaiolmao123123aOfurain0n4H34DggTrexewwasads1293194hjXDOthLaLosnggtwget-log1337SoraLOADERSAIAKINAggtq1378bfp919

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1389, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1476, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1809, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 4509, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6074, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6222, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6223, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6254, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6275, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6288, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6289, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6290, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2009, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2033, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2128, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2281, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2285, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2294, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2307, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 4442, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 4443, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 4476, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 4481, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 4487, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6085, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6187, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6195, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6241, result: successful	Jump to behavior
Source: /tmp/morte.sh4.elf (PID: 6247)	SIGKILL sent: pid: 6247, result: unknown	Jump to behavior

Source: classification engine

Classification label: mal84.spre.troj.linELF@0/47@3/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6275)	File: /proc/6275/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6291)	File: /proc/6291/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6298)	File: /proc/6298/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6431)	File: /proc/6431/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6464)	File: /proc/6464/mounts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6296)	File: /run/systemd/journal/streams/.#9:76531GFWuti	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File: /run/systemd/journal/streams/.#9:76610sDBuSg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File: /run/systemd/journal/streams/.#9:76620I5GD6g	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File: /run/systemd/journal/streams/.#9:76621rjD9ci	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File: /run/systemd/journal/streams/.#9:76622JO1t7f	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File: /run/systemd/journal/streams/.#9:76624eNVj4g	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File: /run/systemd/journal/streams/.#9:76625Tl3DHg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File: /run/systemd/journal/streams/.#9:76632fZ7LGi	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File: /run/systemd/journal/streams/.#9:76633K89hHf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File: /run/systemd/journal/streams/.#9:76647EfPwif	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File: /run/systemd/journal/streams/.#9:76648XfDYAf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File: /run/systemd/journal/streams/.#9:76649AUzQXf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File: /run/systemd/journal/streams/.#9:76650LveVTf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File: /run/systemd/journal/streams/.#9:76687OS5Ghi	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File: /run/systemd/journal/streams/.#9:766991C4kBg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File: /run/systemd/journal/streams/.#9:76791zGQ3Ph	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File: /run/systemd/journal/streams/.#9:76918Qjljrh	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File: /run/systemd/journal/streams/.#9:76965fvg5Ef	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File: /run/systemd/journal/streams/.#9:76967Yn15fi	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File: /run/systemd/journal/streams/.#9:770038a79xg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File: /run/systemd/journal/streams/.#9:770091D6kAi	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File: /run/systemd/journal/streams/.#9:77904KLEqjg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File: /run/systemd/journal/streams/.#9:779460Yxjtf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File: /run/systemd/journal/streams/.#9:78056JoETzi	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6310)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6310)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6310)	File: /run/systemd/seats/.#seat05OYkgl	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6310)	File: /run/systemd/users/.#127hbZwcm	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6310)	File: /run/systemd/users/.#127TzGpgj	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6310)	File: /run/systemd/seats/.#seat0KhdCRm	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6310)	File: /run/systemd/users/.#127CKbOEi	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6310)	File: /run/systemd/users/.#127lR5bxm	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6310)	File: /run/systemd/users/.#127K84Vbj	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6310)	File: /run/systemd/users/.#127OBxvTk	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6429)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6410)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6410)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6421)	Directory: /root/.cache	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6296/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6296/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6296/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6296/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6296/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6296/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6298/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6410/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6410/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6410/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6410/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6410/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6410/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6410/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6310/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6310/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6310/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6310/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6310/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6310/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6310/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6310/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6310/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6310/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6310/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6310/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6310/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6310/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6431/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6431/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6431/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6431/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6431/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6431/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6431/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2078/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2078/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2078/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2078/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2078/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2078/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2078/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2033/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2033/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2033/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2033/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2033/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2033/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2033/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2077/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2077/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2077/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2077/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2077/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2077/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2077/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2097/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2097/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2097/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2097/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2097/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2097/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2097/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2074/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2074/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2074/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2074/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2074/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2074/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2074/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6391/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6391/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6391/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6391/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6391/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6391/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/6391/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2050/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2050/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2050/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2050/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2050/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2050/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	File opened: /proc/2050/cgroup	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6377)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6379)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6381)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6383)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6385)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6387)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6389)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6392)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6418)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Source: /bin/sh (PID: 6378)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6380)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6382)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6384)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6386)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6388)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6390)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6393)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6420)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6400)

Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6296)

Reads from proc file: /proc/meminfo

Jump to behavior

Source: /sbin/agetty (PID: 6375)

Reads version info: /etc/issue

Jump to behavior

Source: /usr/sbin/gdm3 (PID: 6406)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6406)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6410)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6410)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6301)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6301)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 6376)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 6376)

Truncated file: /var/log/gpu-manager.log

Jump to behavior

Source: /usr/bin/pkill (PID: 6400)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6467)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /tmp/morte.sh4.elf (PID: 6239)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6289)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6296)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6301)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6375)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6376)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6425)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6467)	Queries kernel information via 'uname':	Jump to behavior

Source: morte.sh4.elf, 6239.1.00007ffea3bfd000.00007ffea3c1e000.rw-.sdmp, morte.sh4.elf, 6241.1.00007ffea3bfd000.00007ffea3c1e000.rw-.sdmp, morte.sh4.elf, 6247.1.00007ffea3bfd000.00007ffea3c1e000.rw-.sdmp, morte.sh4.elf, 6248.1.00007ffea3bfd000.00007ffea3c1e000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: morte.sh4.elf, 6239.1.00007ffea3bfd000.00007ffea3c1e000.rw-.sdmp, morte.sh4.elf, 6241.1.00007ffea3bfd000.00007ffea3c1e000.rw-.sdmp, morte.sh4.elf, 6247.1.00007ffea3bfd000.00007ffea3c1e000.rw-.sdmp, morte.sh4.elf, 6248.1.00007ffea3bfd000.00007ffea3c1e000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/morte.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/morte.sh4.elf
Source: morte.sh4.elf, 6239.1.000055c88c8ec000.000055c88c94f000.rw-.sdmp, morte.sh4.elf, 6241.1.000055c88c8ec000.000055c88c94f000.rw-.sdmp, morte.sh4.elf, 6247.1.000055c88c8ec000.000055c88c94f000.rw-.sdmp, morte.sh4.elf, 6248.1.000055c88c8ec000.000055c88c94f000.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: morte.sh4.elf, 6247.1.00007ffea3bfd000.00007ffea3c1e000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.kjxufA
Source: morte.sh4.elf, 6239.1.000055c88c8ec000.000055c88c94f000.rw-.sdmp, morte.sh4.elf, 6241.1.000055c88c8ec000.000055c88c94f000.rw-.sdmp, morte.sh4.elf, 6247.1.000055c88c8ec000.000055c88c94f000.rw-.sdmp, morte.sh4.elf, 6248.1.000055c88c8ec000.000055c88c94f000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4
Source: morte.sh4.elf, 6247.1.00007ffea3bfd000.00007ffea3c1e000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.kjxufA

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6410)

Logged in records file read: /var/log/wtmp

Jump to behavior

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: morte.sh4.elf, type: SAMPLE
Source: Yara match	File source: 6248.1.00007fb8f8400000.00007fb8f841a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6241.1.00007fb8f8400000.00007fb8f841a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6247.1.00007fb8f8400000.00007fb8f841a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6239.1.00007fb8f8400000.00007fb8f841a000.r-x.sdmp, type: MEMORY

Yara detected Okiru

Source: Yara match	File source: morte.sh4.elf, type: SAMPLE
Source: Yara match	File source: 6248.1.00007fb8f8400000.00007fb8f841a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6241.1.00007fb8f8400000.00007fb8f841a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6247.1.00007fb8f8400000.00007fb8f841a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6239.1.00007fb8f8400000.00007fb8f841a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: morte.sh4.elf PID: 6239, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: morte.sh4.elf PID: 6241, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: morte.sh4.elf PID: 6247, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: morte.sh4.elf PID: 6248, type: MEMORYSTR

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match	File source: morte.sh4.elf, type: SAMPLE
Source: Yara match	File source: 6248.1.00007fb8f8400000.00007fb8f841a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6241.1.00007fb8f8400000.00007fb8f841a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6247.1.00007fb8f8400000.00007fb8f841a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6239.1.00007fb8f8400000.00007fb8f841a000.r-x.sdmp, type: MEMORY

Yara detected Okiru

Source: Yara match	File source: morte.sh4.elf, type: SAMPLE
Source: Yara match	File source: 6248.1.00007fb8f8400000.00007fb8f841a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6241.1.00007fb8f8400000.00007fb8f841a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6247.1.00007fb8f8400000.00007fb8f841a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6239.1.00007fb8f8400000.00007fb8f841a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: morte.sh4.elf PID: 6239, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: morte.sh4.elf PID: 6241, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: morte.sh4.elf PID: 6247, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: morte.sh4.elf PID: 6248, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
morte.sh4.elf	45%	Virustotal		Browse
morte.sh4.elf	36%	ReversingLabs	Linux.Trojan.Mirai

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.35.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.213.35.25	unknown	United States	41231	CANONICAL-ASGB	false
176.65.142.252	unknown	Germany	8649	WEBTRAFFICDE	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.213.35.25	morte.arm.elf	Get hash	malicious	Gafgyt, Okiru	Browse
	rjfe686.elf	Get hash	malicious	Unknown	Browse
	weje64.elf	Get hash	malicious	Unknown	Browse
	vjwe68k.elf	Get hash	malicious	Unknown	Browse
	eehah4.elf	Get hash	malicious	Unknown	Browse
	drea4.elf	Get hash	malicious	Unknown	Browse
	rrrdsl.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	weje64.elf	Get hash	malicious	Unknown	Browse
	efefa7.elf	Get hash	malicious	Mirai	Browse
176.65.142.252	morte.mips.elf	Get hash	malicious	Gafgyt, Okiru	Browse
	morte.arm.elf	Get hash	malicious	Gafgyt, Okiru	Browse
	morte.x86.elf	Get hash	malicious	Okiru	Browse
	morte.m68k.elf	Get hash	malicious	Gafgyt, Okiru	Browse
	morte.ppc.elf	Get hash	malicious	Okiru	Browse
	morte.mpsl.elf	Get hash	malicious	Gafgyt, Okiru	Browse
	morte.x64.elf	Get hash	malicious	Gafgyt, Okiru	Browse
	morte.ppc.elf	Get hash	malicious	Unknown	Browse
	morte.mpsl.elf	Get hash	malicious	Unknown	Browse
	raw_cbot.exe	Get hash	malicious	Unknown	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	morte.arm5.elf	Get hash	malicious	Okiru	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	miner.elf	Get hash	malicious	Unknown	Browse
	morte.arm.elf	Get hash	malicious	Gafgyt, Okiru	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	morte.arm.elf	Get hash	malicious	Gafgyt, Okiru	Browse	162.213.35.24
	morte.arm6.elf	Get hash	malicious	Gafgyt, Okiru	Browse	162.213.35.24
	morte.m68k.elf	Get hash	malicious	Gafgyt, Okiru	Browse	162.213.35.25
	sshd.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	.i.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	drea4.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	efea6.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	morte.arm5.elf	Get hash	malicious	Okiru	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	miner.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	morte.arm.elf	Get hash	malicious	Gafgyt, Okiru	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
WEBTRAFFICDE	morte.mips.elf	Get hash	malicious	Gafgyt, Okiru	Browse	176.65.142.252
	morte.arm.elf	Get hash	malicious	Gafgyt, Okiru	Browse	176.65.142.252
	morte.x86.elf	Get hash	malicious	Okiru	Browse	176.65.142.252
	morte.m68k.elf	Get hash	malicious	Gafgyt, Okiru	Browse	176.65.142.252
	morte.ppc.elf	Get hash	malicious	Okiru	Browse	176.65.142.252
	morte.mpsl.elf	Get hash	malicious	Gafgyt, Okiru	Browse	176.65.142.252
	morte.x64.elf	Get hash	malicious	Gafgyt, Okiru	Browse	176.65.142.252
	morte.ppc.elf	Get hash	malicious	Unknown	Browse	176.65.142.252
	morte.mpsl.elf	Get hash	malicious	Unknown	Browse	176.65.142.252
	file2.bin.exe	Get hash	malicious	RHADAMANTHYS	Browse	176.65.142.216
INIT7CH	morte.arm5.elf	Get hash	malicious	Okiru	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	miner.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	morte.arm.elf	Get hash	malicious	Gafgyt, Okiru	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	na.elf	Get hash	malicious	Prometei	Browse	109.202.202.202
CANONICAL-ASGB	morte.arm5.elf	Get hash	malicious	Okiru	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	miner.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	morte.arm.elf	Get hash	malicious	Gafgyt, Okiru	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42
	Aqua.mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	na.elf	Get hash	malicious	Prometei	Browse	91.189.91.42

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

Source: morte.sh4.elf	Virustotal: Detection: 45%			Perma Link
Source: morte.sh4.elf	ReversingLabs: Detection: 36%

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:z:z
MD5:	1E46AAD31C48AA19358BF6ED971A11DE
SHA1:	501A2DB1A6604E467EE5B1BF8152355E683CD5F1
SHA-256:	CEA58BF40567DAD536BD18577B1A5495187F40280EF42A5439A38B24F5C64643
SHA-512:	C7378A2C11F781B5A732F5BAFED6384BB6B1676DF47AF0268E5406F4264F820BA196C3F6ABBB24DBCE4D91B89F6EAE43BBEB17E94E906182CF5F5F3276559BD0
Malicious:	false
Reputation:	low
Preview:	6406.

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.535578696166821
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsInVTATEBwpeMqjsv:SbFuFyLVIg1BG+f+MsI5jEeZji4s
MD5:	92841FD80876D43F91ADA416781412E7
SHA1:	301DD54AAAA9193B963BC9B808489675824F22A4
SHA-256:	8E2136CF6A06FAC1C3B6E15E3097F6F9DF42B532B99C48EB6116CC2927FE2686
SHA-512:	BB716F31D9F68BAB6E3EA2F63748ACD0261D7C4FFD05C31CA171EB02890B7DB0A72F1E2B9E0683A03178EA057B1B883490BC87A6DCCA9184D15234B17599BE2C
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f14bc5067fb5476a8f863011f42de4e8.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351415
Encrypted:	false
SSDEEP:	3:Mlc1sXlXEWtl/EB:8cQ+yl8
MD5:	83E6E70838385B0E1CB39D9F08939A49
SHA1:	EDD87810348EE943719056C0BE4366E2A10095B7
SHA-256:	6C9EDE52C74DBC1210AAA23892F7BD37E1359C4BBA5730406D4D08DAA25BB124
SHA-512:	1BFBD29DD2DF46509673618D57522FFC3A7C3BADC294865D4A2935FDB13E3A35238D64071011742F714F497AA1E2D9AB45778E249D6E0EE5EA69702EEDEE1B93
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................z..g.'......................................

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1963
Entropy (8bit):	4.89260209082447
Encrypted:	false
SSDEEP:	24:ptc3cfcqqxdZ4pdZeSuYmug4ugXug/4kXYAvPYA2+V14Ad0pYrOVJrp6wrCQU:Y3cfE742vEv1fVUYrwrpBrCn
MD5:	F52413D28FD125B2CDC1B0CF2991ADCC
SHA1:	C4E3EEC5CD898C50F0AE4B37DADB8B605639864B
SHA-256:	184EE0A6F82666354626FDC19FB8EFD781BB70ACF41451A114C12A5E407CEAF8
SHA-512:	DF04F7335E3805646618FC39018775C65A60443D20F9F7B902F861439B40C5A8EEFDE71D978E13FE983E1288084D27F50A6812A066923EC4F6F25DAF496A0434
Malicious:	false
Preview:	Mar 23 09:28:12 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session closed for user gdm.Mar 23 09:28:12 galassia gdm-password]: pam_unix(gdm-password:session): session closed for user saturnino.Mar 23 09:28:13 galassia gdm-password]: pam_systemd(gdm-password:session): Failed to release session: No session '2' known.Mar 23 09:28:13 galassia systemd-logind[6310]: Failed to add user by file name 127, ignoring: Invalid argument.Mar 23 09:28:13 galassia systemd-logind[6310]: Failed to add user by file name 1000, ignoring: Invalid argument.Mar 23 09:28:13 galassia systemd-logind[6310]: User enumeration failed: Invalid argument.Mar 23 09:28:13 galassia systemd-logind[6310]: User of session c2 not known..Mar 23 09:28:13 galassia systemd-logind[6310]: User of session 2 not known..Mar 23 09:28:13 galassia systemd-logind[6310]: User of session c1 not known..Mar 23 09:28:13 galassia systemd-logind[6310]: Session enumeration failed: No such file or directory.Mar 23 0

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.229463282315143
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	morte.sh4.elf
File size:	127'760 bytes
MD5:	42b2d15d32b87dfbab5daf1b76d7ce76
SHA1:	7c3d3dd043b5ff31aebec14b14be9c498b6679d1
SHA256:	131f936760e0d6bd8a91765fdf63bc55a668f77e05e86ba29e14ae265118c037
SHA512:	be42734abf56ff0c010abfdf900fc7dcf70cd3ab72520775dd1f82ec67bea9ba47ee23b85176cd3edb1c1d18500eeb18c57847dbcb24f4d890aad3978b000806
SSDEEP:	1536:SaChwt50KbR+qmDVzLC3NKyzVghkeAYUH0fWH8UWs63Q7Ckjcm6l61d6VXW:SPhEdvmDV/KUy5epGWWHuB3y3640X
TLSH:	80C37C73CC256E69D664D1B8B070CFB81F53A52481875FBE56AAC2B48047D8DFA093B8
File Content Preview:	.ELF.....................@.4...X.......4. ...(...............@...@.t...t.....................B...B..Q..............Q.td............................././"O.n........#.@........#.*@,i...o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	127320
Section Header Size:	40
Number of Section Headers:	11
Header String Table Index:	10

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x30	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0x16940	0x0	0x6	AX	32
.fini	PROGBITS	0x416a20	0x16a20	0x24	0x0	0x6	AX	4
.rodata	PROGBITS	0x416a44	0x16a44	0x2f30	0x0	0x2	A	4
.ctors	PROGBITS	0x42a000	0x1a000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x42a00c	0x1a00c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x42a020	0x1a020	0x50e0	0x0	0x3	WA	32
.got	PROGBITS	0x42f100	0x1f100	0x14	0x4	0x3	WA	4
.bss	NOBITS	0x42f114	0x1f114	0x46c4	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x1f114	0x43	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x19974	0x19974	6.9283	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x1a000	0x42a000	0x42a000	0x5114	0x97d8	1.0078	0x6	RW	0x10000	.ctors .dtors .data .got .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 23, 2025 15:28:00.336191893 CET	46292	7575	192.168.2.23	176.65.142.252
Mar 23, 2025 15:28:00.540757895 CET	7575	46292	176.65.142.252	192.168.2.23
Mar 23, 2025 15:28:00.540826082 CET	46292	7575	192.168.2.23	176.65.142.252
Mar 23, 2025 15:28:00.591638088 CET	46292	7575	192.168.2.23	176.65.142.252
Mar 23, 2025 15:28:00.796267986 CET	7575	46292	176.65.142.252	192.168.2.23
Mar 23, 2025 15:28:00.796313047 CET	46292	7575	192.168.2.23	176.65.142.252
Mar 23, 2025 15:28:00.999397039 CET	7575	46292	176.65.142.252	192.168.2.23
Mar 23, 2025 15:28:03.717747927 CET	42836	443	192.168.2.23	91.189.91.43
Mar 23, 2025 15:28:04.485665083 CET	42516	80	192.168.2.23	109.202.202.202
Mar 23, 2025 15:28:04.836123943 CET	46292	7575	192.168.2.23	176.65.142.252
Mar 23, 2025 15:28:05.039251089 CET	7575	46292	176.65.142.252	192.168.2.23
Mar 23, 2025 15:28:05.039362907 CET	46292	7575	192.168.2.23	176.65.142.252
Mar 23, 2025 15:28:05.377594948 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:05.377636909 CET	443	53070	162.213.35.25	192.168.2.23
Mar 23, 2025 15:28:05.377734900 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.155713081 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.155740976 CET	443	53070	162.213.35.25	192.168.2.23
Mar 23, 2025 15:28:08.369858980 CET	443	53070	162.213.35.25	192.168.2.23
Mar 23, 2025 15:28:08.370323896 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.370323896 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.370323896 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.370338917 CET	443	53070	162.213.35.25	192.168.2.23
Mar 23, 2025 15:28:08.370353937 CET	443	53070	162.213.35.25	192.168.2.23
Mar 23, 2025 15:28:08.370445013 CET	443	53070	162.213.35.25	192.168.2.23
Mar 23, 2025 15:28:08.370868921 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.370868921 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.370877028 CET	443	53070	162.213.35.25	192.168.2.23
Mar 23, 2025 15:28:08.370992899 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.416320086 CET	443	53070	162.213.35.25	192.168.2.23
Mar 23, 2025 15:28:08.552850962 CET	443	53070	162.213.35.25	192.168.2.23
Mar 23, 2025 15:28:08.552977085 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.552977085 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.552977085 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.552997112 CET	443	53070	162.213.35.25	192.168.2.23
Mar 23, 2025 15:28:08.553009033 CET	443	53070	162.213.35.25	192.168.2.23
Mar 23, 2025 15:28:08.553020000 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.553020954 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.553029060 CET	443	53070	162.213.35.25	192.168.2.23
Mar 23, 2025 15:28:08.553045988 CET	443	53070	162.213.35.25	192.168.2.23
Mar 23, 2025 15:28:08.553066015 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.553066015 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.553066015 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.553076982 CET	443	53070	162.213.35.25	192.168.2.23
Mar 23, 2025 15:28:08.553090096 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.553090096 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.553102970 CET	443	53070	162.213.35.25	192.168.2.23
Mar 23, 2025 15:28:08.553133011 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.553149939 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.553165913 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.553268909 CET	443	53070	162.213.35.25	192.168.2.23
Mar 23, 2025 15:28:08.553334951 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.553359032 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.553545952 CET	443	53070	162.213.35.25	192.168.2.23
Mar 23, 2025 15:28:08.553584099 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.553606033 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.553689957 CET	443	53070	162.213.35.25	192.168.2.23
Mar 23, 2025 15:28:08.553725004 CET	443	53070	162.213.35.25	192.168.2.23
Mar 23, 2025 15:28:08.553745985 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.553764105 CET	443	53070	162.213.35.25	192.168.2.23
Mar 23, 2025 15:28:08.553793907 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.553793907 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.553807020 CET	443	53070	162.213.35.25	192.168.2.23
Mar 23, 2025 15:28:08.553813934 CET	443	53070	162.213.35.25	192.168.2.23
Mar 23, 2025 15:28:08.963068962 CET	443	53070	162.213.35.25	192.168.2.23
Mar 23, 2025 15:28:08.963184118 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.963184118 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:08.963196039 CET	443	53070	162.213.35.25	192.168.2.23
Mar 23, 2025 15:28:08.963207006 CET	443	53070	162.213.35.25	192.168.2.23
Mar 23, 2025 15:28:08.963237047 CET	443	53070	162.213.35.25	192.168.2.23
Mar 23, 2025 15:28:08.964189053 CET	53070	443	192.168.2.23	162.213.35.25
Mar 23, 2025 15:28:18.819869995 CET	43928	443	192.168.2.23	91.189.91.42
Mar 23, 2025 15:28:31.106093884 CET	42836	443	192.168.2.23	91.189.91.43
Mar 23, 2025 15:28:35.201704979 CET	42516	80	192.168.2.23	109.202.202.202
Mar 23, 2025 15:28:59.774442911 CET	43928	443	192.168.2.23	91.189.91.42

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 23, 2025 15:28:04.640734911 CET	53198	53	192.168.2.23	1.1.1.1
Mar 23, 2025 15:28:04.640789986 CET	37258	53	192.168.2.23	1.1.1.1
Mar 23, 2025 15:28:04.740077019 CET	53	53198	1.1.1.1	192.168.2.23
Mar 23, 2025 15:28:04.740220070 CET	53	37258	1.1.1.1	192.168.2.23
Mar 23, 2025 15:28:05.261933088 CET	52977	53	192.168.2.23	1.1.1.1
Mar 23, 2025 15:28:05.361345053 CET	53	52977	1.1.1.1	192.168.2.23

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 23, 2025 15:28:07.637255907 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Mar 23, 2025 15:29:27.654041052 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2025-03-23 14:28:08 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2025-03-23 14:28:08 UTC	25	IN	HTTP/1.1 100 Continue
2025-03-23 14:28:08 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2025-03-23 14:28:08 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2025-03-23 14:28:08 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2025-03-23 14:28:08 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2025-03-23 14:28:08 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2025-03-23 14:28:08 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2025-03-23 14:28:08 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2025-03-23 14:28:08 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2025-03-23 14:28:08 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2025-03-23 14:28:08 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2025-03-23 14:28:08 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Sun, 23 Mar 2025 14:28:08 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	14:27:59
Start date (UTC):	23/03/2025
Path:	/tmp/morte.sh4.elf
Arguments:	/tmp/morte.sh4.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	14:28:00
Start date (UTC):	23/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	14:28:01
Start date (UTC):	23/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report morte.sh4.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/6434/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:76531GFWuti

/run/systemd/journal/streams/.#9:76610sDBuSg

/run/systemd/journal/streams/.#9:76620I5GD6g

/run/systemd/journal/streams/.#9:76621rjD9ci

/run/systemd/journal/streams/.#9:76622JO1t7f

/run/systemd/journal/streams/.#9:76624eNVj4g

/run/systemd/journal/streams/.#9:76625Tl3DHg

/run/systemd/journal/streams/.#9:76632fZ7LGi

/run/systemd/journal/streams/.#9:76633K89hHf

/run/systemd/journal/streams/.#9:76647EfPwif

/run/systemd/journal/streams/.#9:76648XfDYAf

/run/systemd/journal/streams/.#9:76649AUzQXf

/run/systemd/journal/streams/.#9:76650LveVTf

/run/systemd/journal/streams/.#9:76687OS5Ghi

/run/systemd/journal/streams/.#9:766991C4kBg

/run/systemd/journal/streams/.#9:76791zGQ3Ph

/run/systemd/journal/streams/.#9:76918Qjljrh

/run/systemd/journal/streams/.#9:76965fvg5Ef

/run/systemd/journal/streams/.#9:76967Yn15fi

/run/systemd/journal/streams/.#9:770038a79xg

/run/systemd/journal/streams/.#9:770091D6kAi

/run/systemd/journal/streams/.#9:77904KLEqjg

Linux Analysis Report
morte.sh4.elf

Start time (UTC):	14:28:03
Start date (UTC):	23/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	14:28:04
Start date (UTC):	23/03/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	14:28:05
Start date (UTC):	23/03/2025
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	14:28:10
Start date (UTC):	23/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	14:28:06
Start date (UTC):	23/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	14:28:07
Start date (UTC):	23/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	14:28:08
Start date (UTC):	23/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	14:28:11
Start date (UTC):	23/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	14:28:14
Start date (UTC):	23/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	14:28:25
Start date (UTC):	23/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75