Edit tour

Linux Analysis Report
morte.spc.elf

Overview

General Information

Sample name:morte.spc.elf
Analysis ID:1646565
MD5:10a7630b1c4f6197ba7238e1aa73fc23
SHA1:9ee8f039504be1f6c3be53a1fd98a13104e58fc2
SHA256:eca6a4443db7bd57f56b223beb49e08dd878e57bb2b377b58bfe3c6d5356f66f
Tags:elfuser-abuse_ch
Infos:

Detection

Okiru
Score:60
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Yara detected Okiru
Contains symbols with names commonly found in malware
Creates hidden files and/or directories
Found strings indicative of a multi-platform dropper
Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable
Sample has stripped symbol table
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1646565
Start date and time:2025-03-24 05:58:21 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 10m 45s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:morte.spc.elf
Detection:MAL
Classification:mal60.troj.linELF@0/51@0/0
Cookbook Comments:
  • Analysis time extended to 480s due to sleep detection in submitted sample
Command:/tmp/morte.spc.elf
PID:6241
Exit Code:255
Exit Code Info:
Killed:False
Standard Output:

Standard Error:/lib/ld-uClibc.so.0: No such file or directory
  • system is lnxubuntu20
  • morte.spc.elf (PID: 6241, Parent: 6165, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/morte.spc.elf
  • systemd New Fork (PID: 6290, Parent: 1)
  • fstrim (PID: 6290, Parent: 1, MD5: 72cd771da16ce70f2601ba29d880bd00) Arguments: /sbin/fstrim --fstab --verbose --quiet
  • systemd New Fork (PID: 6291, Parent: 1)
  • logrotate (PID: 6291, Parent: 1, MD5: ff9f6831debb63e53a31ff8057143af6) Arguments: /usr/sbin/logrotate /etc/logrotate.conf
  • systemd New Fork (PID: 6292, Parent: 1)
  • install (PID: 6292, Parent: 1, MD5: 55e2520049dc6a62e8c94732e36cdd54) Arguments: /usr/bin/install -d -o man -g man -m 0755 /var/cache/man
  • systemd New Fork (PID: 6346, Parent: 1)
  • find (PID: 6346, Parent: 1, MD5: b68ef002f84cc54dd472238ba7df80ab) Arguments: /usr/bin/find /var/cache/man -type f -name *.gz -atime +6 -delete
  • systemd New Fork (PID: 6460, Parent: 1)
  • mandb (PID: 6460, Parent: 1, MD5: 1dda5ea0027ecf1c2db0f5a3de7e6941) Arguments: /usr/bin/mandb --quiet
  • cleanup
SourceRuleDescriptionAuthorStrings
morte.spc.elfJoeSecurity_OkiruYara detected OkiruJoe Security
    SourceRuleDescriptionAuthorStrings
    6241.1.00007f7cac011000.00007f7cac01b000.r-x.sdmpJoeSecurity_OkiruYara detected OkiruJoe Security
      Process Memory Space: morte.spc.elf PID: 6241JoeSecurity_OkiruYara detected OkiruJoe Security
        No Suricata rule has matched

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: morte.spc.elfReversingLabs: Detection: 33%
        Source: morte.spc.elfString: morte/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busybox/proc/%d/net/tcp %*d: %*x:%x/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/run/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraJoshohajime902i13BzSxLxBxeYHOHO-LUGO7HOHO-U79OLJuYfouyf87NiGGeR69xdSO190Ij1XLOLKIKEEEDDEekjheory98escansh4MDMAfdevalvexscanspcMELTEDNINJAREALZflexsonskidsscanx86MISAKI-U79OLfoAxi102kxeswodjwodjwojMmKiy7f87lfreecookiex86sysgpufrgegesysupdater0DnAzepdNiGGeRD0nks69frgreu0x766f6964NiGGeRd0nks1337gafturasgbsigboa120i3UI49OaF3geaevaiolmao123123aOfurain0n4H34DggTrexewwasads1293194hjXDOthLaLosnggtwget-log1337SoraLOADERSAIAKINAggtq1378bfp919GRB1Q2SAIAKUSOggtr14FaSEXSLAVE1337ggtt1902a3u912u3u4haetrghbr19ju3dSORAojkf120hehahejeje922U2JDJA901F91SlaVLav12helpmedaddthhhhh2wgg9qphbqSlav3Th3seD3viceshzSmYZjYMQ5GbfSoRAxD123LOLiaGv5aA3SoRAxD420LOLinsomni640277SoraBeReppin1337ipcamCache66tlGg9QjUYfouyf876ke3TOKYO3lyEeaXul2dULCVxh93OfjHZ2zTY2gD6MZvKc7KU6rmMkiy6f87lA023UU4U24UIUTheWeekndmioribitchesA5p9TheWeekndsmnblkjpoiAbAdTokyosnebAkiruU8inTznetstatsAlexW9RCAKM20TnewnetwordAyo215WordnloadsBAdAsVWordmanenotyakuzaaBelchWordnetsobpBigN0gg0r420X0102I34fofhasfhiafhoiX19I239124UIUoismXSHJEHHEIIHWOolsVNwo12DeportedDeportedXkTer0GbA1onry0v03FortniteDownLOLZY0urM0mGaypussyfartlmaojkGrAcEnIgGeRaNnYvdGkqndCOqGeoRBe6BEGuiltyCrownZEuS69s4beBsEQhdHOHO-KSNDOZEuz69sat1234aj93hJ23scanHAalie293z0k2LscanJoshoARMHellInSideayyyGangShitscanJoshoARM5HighFryb1glscanJoshoARM6IWhPyucDbJboatnetzscanJoshoARM7IuYgujeIqnbtbatrtahzexsexscanJoshoM68KJJDUHEWBBBIBscanJoshoMIPSJSDGIEVIVAVIGcKbVkzGOPascanJoshoMPSLccADscanJoshoPPCKAZEN-OIU97chickenxingsscanJoshoSH4yakuskzm8KAZEN-PO78HcleanerscanJoshoSPCKAZEN-U79OLdbeefscanJoshoX86yakuz4c24KETASHI32ddrwelperscanarm5zPnr6HpQj2Kaishi-Iz90Ydeexecscanarm6zdrtfxcgyKatrina32doCP3fVjscanarm7zxcfhuioKsif91je39scanm68kKuasadvrhelperl33t_feetl33tl33tfeetscanmipsKuasaBinsMateeQnOhRk85rscanmpslLOLHHHOHOHBUIeXK20CL12ZnyamezyQBotBladeSPOOKYhikariwasherep4029x91xx32uhj4gbejhwizardzhra.outboatnetdbgcondiheroshimaskid.dbglzrdPownedSecurity69.aresfxlyazsxhyUNSTABLEunstable_is_the_story_of_the_universemoobotjnsd9sdoilayourmomgaeissdfjiougsiojOasisSEGRJIJHFVNHSNHEIHFOSapep999KOWAI-BAdAsVKOWAI-SADjHKipU7Ylairdropmalwareyour_verry_fucking_gayBig-Bro-Brightsefaexecshirololieagle.For-Gai-Mezy0x6axNLcloqkisvspookymythSwergjmioGKILLEJW(IU(JIWERGFJGJWJRGHetrhwewrtheIuFdKssCxzjSDFJIjioOnrYoXd666ewrtkjokethajbdf89wu823AAaasrdgsWsGA4@F6FGhostWuzHere666BOGOMIPSbeastmodedvrHelperbestmodesfc6aJfIuYDemon.xeno-is-godICY-P-0ODIJgSHUIHIfhwrgLhu87VhvQPzlunadakuexecbinTacoBellGodYololigangExecutionorbitclientA
        Source: global trafficTCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
        Source: global trafficTCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
        Source: global trafficTCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
        Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
        Source: unknownTCP traffic detected without corresponding DNS query: 109.202.202.202
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.42
        Source: unknownTCP traffic detected without corresponding DNS query: 91.189.91.43
        Source: unknownNetwork traffic detected: HTTP traffic on port 43928 -> 443
        Source: unknownNetwork traffic detected: HTTP traffic on port 42836 -> 443

        System Summary

        barindex
        Source: ELF static info symbol of initial sampleName: attack_method_greeth
        Source: ELF static info symbol of initial sampleName: attack_method_greip
        Source: ELF static info symbol of initial sampleName: attack_method_std
        Source: ELF static info symbol of initial sampleName: attack_method_tcpack
        Source: ELF static info symbol of initial sampleName: attack_method_tcpstomp
        Source: ELF static info symbol of initial sampleName: attack_method_tcpsyn
        Source: ELF static info symbol of initial sampleName: attack_method_tcpxmas
        Source: ELF static info symbol of initial sampleName: attack_method_udpdns
        Source: ELF static info symbol of initial sampleName: attack_method_udpgeneric
        Source: ELF static info symbol of initial sampleName: attack_method_udpplain
        Source: Initial sampleString containing 'busybox' found: busybox
        Source: Initial sampleString containing 'busybox' found: /bin/busybox
        Source: Initial sampleString containing 'busybox' found: busyboxxx
        Source: Initial sampleString containing 'busybox' found: busyboxx
        Source: Initial sampleString containing 'busybox' found: morte/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busybox/proc/%d/net/tcp %*d: %*x:%x/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/run/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraJoshohajime902i13BzSxLxBxeYHOHO-LUGO7HOHO-U79OLJuYfouyf87NiGGeR69xdSO190Ij1XLOLKIKEEEDDEekjheory98escansh4MDMAfdevalvexscanspcMELTEDNINJAREALZflexsonskidsscanx86MISAKI-U79OLfoAxi102kxeswodjwodjwojMmKiy7f87lfreecookiex86sysgpufrgegesysupdater0DnAzepdNiGGeRD0nks69frgreu0x766f6964NiGGeRd0nks1337gafturasgbsigboa120i3UI49OaF3geaevaiolmao123123aOfurain0n4H34DggTrexewwasads1293194hjXDOthLaLosnggtwget-log1337SoraLOADERSAIAKINAggtq1378bfp
        Source: ELF static info symbol of initial sample.symtab present: no
        Source: classification engineClassification label: mal60.troj.linELF@0/51@0/0
        Source: /usr/sbin/logrotate (PID: 6291)Directory: //.Jump to behavior
        Source: /usr/bin/find (PID: 6346)Directory: //.Jump to behavior
        Source: /usr/bin/mandb (PID: 6460)Directory: /var/cache/man/.manpathJump to behavior
        Source: /tmp/morte.spc.elf (PID: 6241)Queries kernel information via 'uname': Jump to behavior
        Source: /usr/bin/find (PID: 6346)Queries kernel information via 'uname': Jump to behavior
        Source: 6460.22.drBinary or memory string: -9915837702310A--gzvmware kernel module
        Source: 6460.22.drBinary or memory string: -1116261022170A--gzQEMU User Emulator
        Source: 6460.22.drBinary or memory string: qemu-or1k
        Source: 6460.22.drBinary or memory string: qemu-riscv64
        Source: 6460.22.drBinary or memory string: {cqemu
        Source: 6460.22.drBinary or memory string: qemu-arm
        Source: 6460.22.drBinary or memory string: (qemu
        Source: 6460.22.drBinary or memory string: qemu-tilegx
        Source: 6460.22.drBinary or memory string: qemu-hppa
        Source: 6460.22.drBinary or memory string: q{rqemu%
        Source: 6460.22.drBinary or memory string: )qemu
        Source: 6460.22.drBinary or memory string: vmware-toolbox-cmd
        Source: 6460.22.drBinary or memory string: qemu-ppc
        Source: 6460.22.drBinary or memory string: Tqemu9
        Source: morte.spc.elf, 6241.1.00007fffed5f5000.00007fffed616000.rw-.sdmpBinary or memory string: /usr/bin/qemu-sparc
        Source: 6460.22.drBinary or memory string: qemu-aarch64_be
        Source: 6460.22.drBinary or memory string: 0qemu9
        Source: 6460.22.drBinary or memory string: qemu-sparc64
        Source: 6460.22.drBinary or memory string: qemu-mips64
        Source: 6460.22.drBinary or memory string: vV:qemu9
        Source: 6460.22.drBinary or memory string: qemu-ppc64le
        Source: 6460.22.drBinary or memory string: <glib::param::uint64Glib::Param::UInt643pm315820097650A--gzWrapper for uint64 parameters in GLibx86_64-linux-gnu-ld.gold-1116112426130B--gzThe GNU ELF linkerprinter-profile-1115804162510A--gzProfile using X-Rite ColorMunki and Argyll CMSgrub-fstest-1116214898500A--gzdebug tool for GRUB filesystem driversxdg-user-dir-1115483406210A--gzFind an XDG user dirkmodsign-1115569251480A--gzKernel module signing toolsensible-editor-1115739932820A--gzsensible editing, paging, and web browsingminesMines6615854478170Cgnome-mines-gzinputattach-1115708189280A--gzattach a serial line to an input-layer devicegapplication-1116155671180A--gzD-Bus application launcherip-tunnel-8815816145190A--gztunnel configurationkoi8rxterm-1116140167530A--gzX terminal emulator for KOI8-R environmentsfoo2hiperc-wrapper-1115804162510A-tgzConvert Postscript into a HIPERC printer streamcryptsetup-reencrypt-8816002888050A--gztool for offline LUKS device re-encryptionsyndaemon-1115861716810A--gza program that monitors keyboard activity and disables the touchpad when the keyboard is being used.gslj-1115980290200B--gzFormat and print text for LaserJet printer using ghostscriptfile2brl-1115757179490A--gzTranslate an xml or a text file into an embosser-ready braille filexfdesktop-settings-1115793419820A--gzDesktop settings for Xfceua-1115856013570B--gzManage Ubuntu Advantage services from Canonicallatin4-7715812813670B--gzISO 8859-4 character set encoded in octal, decimal, and hexadecimalsane-genesys-5516003468200A--gzSANE backend for GL646, GL841, GL843, GL847 and GL124 based USB flatbed scannerspdftohtml-1115853266670A--gzprogram to convert PDF files into HTML, XML and PNG imagesbluetooth-sendto-1116015653360A--gzGTK application for transferring files over Bluetoothqemu-ppc64-1116261022170B--gzQEMU User Emulatorcache_metadata_size-8815811608350A--gzEstimate the size of the metadata device needed for a given configuration.net::dbus::exporterNet::DBus::Exporter3pm315773746310A--gzExport object methods and signals to the bussane-pint-5516003468200A--gzSANE backend for scanners that use the PINT device driverbpf-helpers7-7715812813670A--gzlist of eBPF helper functionsfull-4415812813670A--gzalways full devicelogin-1115906478670A--gzbegin session on the systemcups-snmp-8815877390340A--gzcups snmp backend (deprecated)ordchr-3am315728089600A--gzconvert characters to strings and vice versasosreport-1116092694050A--gzCollect and package diagnostic and support datatop-1115827827270A--gzdisplay Linux processesuri::_punycodeURI::_punycode3pm315811897880A--gzencodes Unicode string in Punycodettytty4tty1systemd-localed-8816268940210B--gzLocale bus mechanismlvmsadc-8815816289110
        Source: 6460.22.drBinary or memory string: vmware
        Source: 6460.22.drBinary or memory string: qemu-cris
        Source: 6460.22.drBinary or memory string: libvmtools
        Source: 6460.22.drBinary or memory string: qemu-m68k
        Source: 6460.22.drBinary or memory string: qemu-xtensa
        Source: 6460.22.drBinary or memory string: 9qemu
        Source: 6460.22.drBinary or memory string: qemu-sh4
        Source: 6460.22.drBinary or memory string: Dprezip-bin-1116269780060A--gzprefix zip delta word list compressor/decompressornameif-8815490444730A--gzname network interfaces based on MAC addressesxdg-user-dirs-update-1115483406210A--gzUpdate XDG user dir configurationip-link-8815816145190A--gznetwork device configurationhpsa-4415812813670A--gzHP Smart Array SCSI driverhd4-4415812813670A--gzMFM/IDE hard disk devicessane-canon630u-5516003468200A--gzSANE backend for the Canon 630u USB flatbed scannersg_copy_results-8815825816070A--gzsend SCSI RECEIVE COPY RESULTS command (XCOPY related)grub-macbless-8816214898500A--gzbless a mac file/directoryntfstruncate-8815568625640A-tgztruncate a file on an NTFS volumelessfile-1115936459130B--gz"input preprocessor" for less.sane-artec-5516003468200A--gzSANE backend for Artec flatbed scannersrmdir-1115676799200A--gzremove empty directoriessystemd-networkd-wait-online.service-8816268940210A--gzWait for network to come onlinemkfs.ntfs-8815568625640B-tgzcreate an NTFS file systemsg_inq-8815825816070A--gzissue SCSI INQUIRY command and/or decode its responseradattr.so-8815955079440Cpppd-radattr-gzc_rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valuestc-htb-8815816145190A--gzHierarchy Token Bucketgvfs-open-1115868766090A--gzsg_rbuf-8815825816070A--gzreads data using SCSI READ BUFFER commandglib-compile-schemas-1116155671180A--gzGSettings schema compileropenssl-srp-1ssl116164130370B--gzmaintain SRP password fileopenssl-rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valueslibvmtools-3315837702310A--gzvmware shared librarypasswd5-5515906478670A--gzthe password filenet::dbus::dumperNet::DBus::Dumper3pm315773746310A--gzStringify Net::DBus objects suitable for printingsane-hp4200-5516003468200A--gzSANE backend for Hewlett-Packard 4200 scannersposixoptions-7715812813670A--gzoptional parts of the POSIX standardnetworkmanager.confNetworkManager.conf5516002723180A--gzNetworkManager configuration fileownership-8815771238010A--gzCompaq ownership tag retrieveroakdecode-1115804162510A--gzDecode an OAKT printer stream into human readable form.gvfs-save-1115868766090A--gzmkfs.minix-8815953177680A--gzmake a Minix filesystemuri7-7715812813670A--gzuniform resource identifier (URI), including a URL or URNedit-1115714399500B--gzexecute programs via entries in the mailcap filegit-diff-files-1116148628880A--gzCompares files in the working tree and the index.ldaprc-5516136581350Cldap.conf-gzpactl-1116219586470A--gzControl a running PulseAudio sound servertempfile-1115756848240A--gzcreate a temporary file in a safe mannerhp-check-1115857238880A--gzDependency/Vers
        Source: 6460.22.drBinary or memory string: .qemu{
        Source: 6460.22.drBinary or memory string: qemu-ppc64abi32
        Source: 6460.22.drBinary or memory string: qemu-ppc64
        Source: 6460.22.drBinary or memory string: qemu-i386
        Source: 6460.22.drBinary or memory string: qemu-x86_64
        Source: morte.spc.elf, 6241.1.000056076a30d000.000056076a372000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/sparc
        Source: 6460.22.drBinary or memory string: H~6\nqemu*q
        Source: 6460.22.drBinary or memory string: @qemu
        Source: 6460.22.drBinary or memory string: Fqqemu
        Source: 6460.22.drBinary or memory string: N4qemu
        Source: 6460.22.drBinary or memory string: ~6\nqemu*q
        Source: 6460.22.drBinary or memory string: qemu-mips64el
        Source: 6460.22.drBinary or memory string: hqemu
        Source: 6460.22.drBinary or memory string: &mqemu
        Source: 6460.22.drBinary or memory string: $qemu
        Source: 6460.22.drBinary or memory string: qemu-sparc
        Source: 6460.22.drBinary or memory string: qemu-microblaze
        Source: 6460.22.drBinary or memory string: qemu-user
        Source: 6460.22.drBinary or memory string: qemu-aarch64
        Source: 6460.22.drBinary or memory string: qemu-sh4eb
        Source: 6460.22.drBinary or memory string: iqemu
        Source: 6460.22.drBinary or memory string: qemu-mipsel
        Source: 6460.22.drBinary or memory string: qemuP`
        Source: 6460.22.drBinary or memory string: qemu-alpha
        Source: 6460.22.drBinary or memory string: qemu-microblazeel
        Source: 6460.22.drBinary or memory string: \qemu
        Source: 6460.22.drBinary or memory string: qemu-xtensaeb
        Source: 6460.22.drBinary or memory string: qemu-mipsn32el
        Source: 6460.22.drBinary or memory string: SAqemu
        Source: morte.spc.elf, 6241.1.000056076a30d000.000056076a372000.rw-.sdmpBinary or memory string: V!/etc/qemu-binfmt/sparc
        Source: 6460.22.drBinary or memory string: Vqemu
        Source: 6460.22.drBinary or memory string: qemu-mipsn32
        Source: 6460.22.drBinary or memory string: qemuAU
        Source: 6460.22.drBinary or memory string: qemu-riscv32
        Source: 6460.22.drBinary or memory string: qemu-sparc32plus
        Source: morte.spc.elf, 6241.1.00007fffed5f5000.00007fffed616000.rw-.sdmpBinary or memory string: rx86_64/usr/bin/qemu-sparc/tmp/morte.spc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/morte.spc.elf
        Source: 6460.22.drBinary or memory string: 7,qemu
        Source: 6460.22.drBinary or memory string: qemu-s390x
        Source: 6460.22.drBinary or memory string: vmware-checkvm
        Source: 6460.22.drBinary or memory string: qemu-nios2
        Source: 6460.22.drBinary or memory string: qemu-armeb
        Source: 6460.22.drBinary or memory string: -4415868968400A--gzVMware SVGA video driver
        Source: 6460.22.drBinary or memory string: 7xml::parser::style::streamXML::Parser::Style::Stream3pm315701248990A--gzStream style for XML::Parsersystemd-timedated-8816268940210B--gzTime and date bus mechanismxfce4-keyboard-settings-1115867081120A--gzKeyboard settings for Xfcepygettext2-1115841026830B--gzPython equivalent of xgettext(1)sudoedit-8816110660620B--gzexecute a command as another userintro7-7715812813670A--gzintroduction to overview and miscellany sectionsprof-1115812813670A--gzread and display shared object profiling datadhclient.conf-5516219398220A--gzDHCP client configuration filepam_group-8815953742440A--gzPAM module for group accesssystemd-ask-password-1116268940210A--gzQuery the user for a system passwordupdate-dictcommon-hunspell-8815422954860A--gzrebuild hunspell database and emacsen stuffqemu-nios2-1116261022170B--gzQEMU User Emulatorlwp::useragentLWP::UserAgent3pm315750405830A--gzWeb user agent classgpgcompose-1115838662460A--gzGenerate a stream of OpenPGP packetsecho-1115676799200A--gzdisplay a line of textio::socket::ssl::utilsIO::Socket::SSL::Utils3pm315817106800A--gz- loading, storing, creating certificates and keyscurl-1116268709580A--gztransfer a URLgetcap-8815819434600A--gzexamine file capabilitieszegrep-1115762517060B--gzsearch possibly compressed files for a regular expressiongrub-syslinux2cfg-1116214898500A--gztransform syslinux config into grub.cfgrtc-4415812813670A--gzreal-time clockglib::codegenGlib::CodeGen3pm315820097650A--gzcode generation utilities for Glib-based bindings.wpa_cli-8816146062790A--gzWPA command line clientiso_8859_3-7715812813670B--gzISO 8859-3 character set encoded in octal, decimal, and hexadecimaliso_8859-9-7715812813670A-tgzISO 8859-9 character set encoded in octal, decimal, and hexadecimallvextend-8815816289110A--gzAdd space to a logical volumeresolvectl-1116268940210A--gzResolve domain names, IPV4 and IPv6 addresses, DNS resource records, and services; introspect and reconfigure the DNS resolverchgrp-1115676799200A--gzchange group ownershipsystemd-cgls-1116268940210A--gzRecursively show control group contentspygettext3.8-1113852085880A--gzPython equivalent of xgettext(1)ping4-8815804258830B--gzsend ICMP ECHO_REQUEST to network hostsidmapwb-8816000845410A--gzwinbind ID mapping plugin for cifs-utilsapturl-gtk-8815799493830B--gzgraphical apt-protocol interpreting package installersane-epsonds-5516003468200A--gzSANE backend for EPSON ESC/I-2 scannersgvfs-monitor-file-1115868766090A--gzrstart-1115829564830A--gza sample implementation of a Remote Start clientgit-stage-1116148628880A--gzAdd file contents to the staging areatc-pedit-8815816145190A--gzgeneric packet editor actioniptables-save-881582899
        Source: 6460.22.drBinary or memory string: I_qemu
        Source: 6460.22.drBinary or memory string: -1116261022170B--gzQEMU User Emulator
        Source: 6460.22.drBinary or memory string: -3315837702310A--gzvmware shared library
        Source: 6460.22.drBinary or memory string: qemu-mips
        Source: 6460.22.drBinary or memory string: qemuj\
        Source: 6460.22.drBinary or memory string: {qemuQ&
        Source: 6460.22.drBinary or memory string: Wgnome-text-editor-111629209547491759146B--gztext editor for the GNOME Desktopx11::protocol::connection::filehandleX11::Protocol::Connection::FileHandle3pm314314075500A--gzPerl module base class for FileHandle-based X11 connectionshtbHTB8815816145190Ctc-htb-gzcifscreds-1116000845410A--gzmanage NTLM credentials in kernel keyringiwconfig-8815490049440A--gzconfigure a wireless network interfaceossl_store-file-7ssl716164130370A--gzThe store 'file' scheme loadertc-stab-8815816145190A--gzGeneric size table manipulationsnotifier-7715877390340A--gzcups notification interfaceqemu-arm-1116261022170B--gzQEMU User EmulatorgemfileGemfile5516263767190Cgemfile2.7-gzglib::object::subclassGlib::Object::Subclass3pm315820097650A--gzregister a perl class as a GObject classnetcat-111612200165426646725B--gzarbitrary TCP and UDP connections and listensdpkg::changelog::parseDpkg::Changelog::Parse3perl315849439740A--gzgeneric changelog parser for dpkg-parsechangelogmpris-proxy-1116243432320A--gzBluetooth mpris-proxybundle-pristine2.7-1116263767190A--gzRestores installed gems to their pristine conditionfsck.ext3-8815816604980B--gzcheck a Linux ext2/ext3/ext4 file systemvolname-1115625752510A--gzreturn volume nameiso-8859-9-7715812813670B--gzISO 8859-9 character set encoded in octal, decimal, and hexadecimalheadhead1HEAD1psd-4415812813670A--gzdriver for SCSI disk driveschrt-1115953177680A--gzmanipulate the real-time attributes of a processvcs-4415812813670A--gzvirtual console memorygit-upload-archive-1116148628880A--gzSend archive back to git-archivenet::dbus::binding::message::errorNet::DBus::Binding::Message::Error3pm315773746310A--gza message encoding a method call errorpkcs11.conf-5516097870510A--gzConfiguration files for PKCS#11 modulessfill-1115227593860A--gzsecure free disk and inode space wiper (secure_deletion toolkit)ldattach-8815953177680A--gzattach a line discipline to a serial linethin_restore-8815811608350A--gzrestore thin provisioning metadata file to device or file.phar.phar7.4-1116254980150B--gzPHAR (PHP archive) command line toolbundle-outdated2.7-1116263767190A--gzList installed gems with newer versions availablemail::addressMail::Address3pm315640244160A--gzparse mail addressesopenssl-ca-1ssl116164130370B--gzsample minimal CA applicationchardet3-1115765858900A--gzuniversal character encoding detectorerb2.7-1116263767190A--gzRuby Templatingchktrust-1115826667350A--gzCheck the trust of a PE executable.sg_raw-8815825816070A--gzsend arbitrary SCSI command to a devicegvfs-trash-1115868766090A--gzintro1-1115812813670A--gzintroduction to user commandsmailcap-5515714399500A--gzmetamail capabilities filegigoloGigolo1gig
        Source: 6460.22.drBinary or memory string: vmware-xferlogs

        Stealing of Sensitive Information

        barindex
        Source: Yara matchFile source: morte.spc.elf, type: SAMPLE
        Source: Yara matchFile source: 6241.1.00007f7cac011000.00007f7cac01b000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: morte.spc.elf PID: 6241, type: MEMORYSTR

        Remote Access Functionality

        barindex
        Source: Yara matchFile source: morte.spc.elf, type: SAMPLE
        Source: Yara matchFile source: 6241.1.00007f7cac011000.00007f7cac01b000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: morte.spc.elf PID: 6241, type: MEMORYSTR
        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity Information1
        Scripting
        Valid AccountsWindows Management Instrumentation1
        Scripting
        Path Interception1
        Hidden Files and Directories
        OS Credential Dumping11
        Security Software Discovery
        Remote ServicesData from Local System1
        Encrypted Channel
        Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
        Application Layer Protocol
        Exfiltration Over BluetoothNetwork Denial of Service
        No configs have been found
        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1646565 Sample: morte.spc.elf Startdate: 24/03/2025 Architecture: LINUX Score: 60 14 109.202.202.202, 80 INIT7CH Switzerland 2->14 16 91.189.91.42, 443 CANONICAL-ASGB United Kingdom 2->16 18 91.189.91.43, 443 CANONICAL-ASGB United Kingdom 2->18 20 Multi AV Scanner detection for submitted file 2->20 22 Yara detected Okiru 2->22 24 Contains symbols with names commonly found in malware 2->24 6 systemd install 2->6         started        8 systemd find 2->8         started        10 systemd logrotate 2->10         started        12 3 other processes 2->12 signatures3 process4

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand
        SourceDetectionScannerLabelLink
        morte.spc.elf33%ReversingLabsLinux.Trojan.Mirai
        No Antivirus matches
        No Antivirus matches
        No Antivirus matches

        Download Network PCAP: filteredfull

        No contacted domains info
        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs
        IPDomainCountryFlagASNASN NameMalicious
        109.202.202.202
        unknownSwitzerland
        13030INIT7CHfalse
        91.189.91.43
        unknownUnited Kingdom
        41231CANONICAL-ASGBfalse
        91.189.91.42
        unknownUnited Kingdom
        41231CANONICAL-ASGBfalse
        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        109.202.202.202kpLwzBouH4.elfGet hashmaliciousUnknownBrowse
        • ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
        91.189.91.43arm7.elfGet hashmaliciousMiraiBrowse
          morte.sh4.elfGet hashmaliciousGafgyt, OkiruBrowse
            na.elfGet hashmaliciousPrometeiBrowse
              na.elfGet hashmaliciousPrometeiBrowse
                sh4.elfGet hashmaliciousUnknownBrowse
                  morte.arm5.elfGet hashmaliciousOkiruBrowse
                    arm6.elfGet hashmaliciousUnknownBrowse
                      morte.m68k.elfGet hashmaliciousGafgyt, OkiruBrowse
                        morte.arm.elfGet hashmaliciousGafgyt, OkiruBrowse
                          arm7.elfGet hashmaliciousMiraiBrowse
                            91.189.91.42arm7.elfGet hashmaliciousMiraiBrowse
                              morte.sh4.elfGet hashmaliciousGafgyt, OkiruBrowse
                                na.elfGet hashmaliciousPrometeiBrowse
                                  na.elfGet hashmaliciousPrometeiBrowse
                                    sh4.elfGet hashmaliciousUnknownBrowse
                                      ppc.elfGet hashmaliciousUnknownBrowse
                                        morte.arm5.elfGet hashmaliciousOkiruBrowse
                                          arm6.elfGet hashmaliciousUnknownBrowse
                                            morte.m68k.elfGet hashmaliciousGafgyt, OkiruBrowse
                                              morte.arm.elfGet hashmaliciousGafgyt, OkiruBrowse
                                                No context
                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                CANONICAL-ASGBarm7.elfGet hashmaliciousMiraiBrowse
                                                • 91.189.91.42
                                                morte.sh4.elfGet hashmaliciousGafgyt, OkiruBrowse
                                                • 91.189.91.42
                                                na.elfGet hashmaliciousPrometeiBrowse
                                                • 91.189.91.42
                                                na.elfGet hashmaliciousPrometeiBrowse
                                                • 91.189.91.42
                                                sh4.elfGet hashmaliciousUnknownBrowse
                                                • 91.189.91.42
                                                ppc.elfGet hashmaliciousUnknownBrowse
                                                • 91.189.91.42
                                                na.elfGet hashmaliciousPrometeiBrowse
                                                • 185.125.190.26
                                                morte.arm5.elfGet hashmaliciousOkiruBrowse
                                                • 91.189.91.42
                                                arm6.elfGet hashmaliciousUnknownBrowse
                                                • 91.189.91.42
                                                morte.m68k.elfGet hashmaliciousGafgyt, OkiruBrowse
                                                • 91.189.91.42
                                                CANONICAL-ASGBarm7.elfGet hashmaliciousMiraiBrowse
                                                • 91.189.91.42
                                                morte.sh4.elfGet hashmaliciousGafgyt, OkiruBrowse
                                                • 91.189.91.42
                                                na.elfGet hashmaliciousPrometeiBrowse
                                                • 91.189.91.42
                                                na.elfGet hashmaliciousPrometeiBrowse
                                                • 91.189.91.42
                                                sh4.elfGet hashmaliciousUnknownBrowse
                                                • 91.189.91.42
                                                ppc.elfGet hashmaliciousUnknownBrowse
                                                • 91.189.91.42
                                                na.elfGet hashmaliciousPrometeiBrowse
                                                • 185.125.190.26
                                                morte.arm5.elfGet hashmaliciousOkiruBrowse
                                                • 91.189.91.42
                                                arm6.elfGet hashmaliciousUnknownBrowse
                                                • 91.189.91.42
                                                morte.m68k.elfGet hashmaliciousGafgyt, OkiruBrowse
                                                • 91.189.91.42
                                                INIT7CHarm7.elfGet hashmaliciousMiraiBrowse
                                                • 109.202.202.202
                                                morte.sh4.elfGet hashmaliciousGafgyt, OkiruBrowse
                                                • 109.202.202.202
                                                na.elfGet hashmaliciousPrometeiBrowse
                                                • 109.202.202.202
                                                na.elfGet hashmaliciousPrometeiBrowse
                                                • 109.202.202.202
                                                sh4.elfGet hashmaliciousUnknownBrowse
                                                • 109.202.202.202
                                                ppc.elfGet hashmaliciousUnknownBrowse
                                                • 109.202.202.202
                                                morte.arm5.elfGet hashmaliciousOkiruBrowse
                                                • 109.202.202.202
                                                arm6.elfGet hashmaliciousUnknownBrowse
                                                • 109.202.202.202
                                                morte.m68k.elfGet hashmaliciousGafgyt, OkiruBrowse
                                                • 109.202.202.202
                                                morte.arm.elfGet hashmaliciousGafgyt, OkiruBrowse
                                                • 109.202.202.202
                                                No context
                                                No context
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):622592
                                                Entropy (8bit):4.657516417799966
                                                Encrypted:false
                                                SSDEEP:6144:rb7cWWov4H5N80nuDSyvxYCWZ0/VmpRELAR/QuU/MzUCl1NZ:H4WWoGgvSiOp2kl
                                                MD5:0C99179B6C5CFE82203424AD7DAD0D8F
                                                SHA1:CAC50B64B1352723FF8F58BB1B103B93C396539B
                                                SHA-256:CEC6859D12C6A981ACA4D7C88F6E62E9616FB4D765C4A52147A7DA7BAD4F2420
                                                SHA-512:4226FDE9F558FFEF2107C330DB942E7E665C51C520A840221541AD255D0995AF64101C69D42C4BD43037364CC4D152851625A53DC56CC188DC28A3DC8C5602F6
                                                Malicious:false
                                                Reputation:high, very likely benign file
                                                Preview:.W.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):1.6070136442091312
                                                Encrypted:false
                                                SSDEEP:48:bhVGQeUzGLIsWUMZJ5CggJHtheYdiKNHTlJ8NK:bhVGaGLIWMZXZgxeYtzll
                                                MD5:D0CA2EBA9E7A17D4680AA9DDC5F88946
                                                SHA1:270F443EFF85209052AE8FFA86660AFB0FAAD39B
                                                SHA-256:9504DC65F8B4E057D0939FA3B2C640FC703D0290EE19381836BAA5EB3EFBADBD
                                                SHA-512:9F999B0467E396E78A91F0BFE56E191DB9D9AFA6DC47858F3427CB44A39D5A13A206542A471CE15C8851674A234B9A7A49AAB7E6D5AF8D080BBC99C2BA3C56D8
                                                Malicious:false
                                                Reputation:high, very likely benign file
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):0.45676214072558463
                                                Encrypted:false
                                                SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
                                                MD5:EE429C7E8B222AFF73C611A8C358B661
                                                SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
                                                SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
                                                SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
                                                Malicious:false
                                                Reputation:high, very likely benign file
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):2.24195239843379
                                                Encrypted:false
                                                SSDEEP:96:bhHY2DzMnpU0QMiloesQdUTn3WVE0UnknJfsWdv0SBpEVvsb6eZeGfRL+:dYKM+oagn3WW5nkniWdv0SAVE6eZee6
                                                MD5:4DF08004EE4C5384C02376841F2B50BC
                                                SHA1:C02E58212CA012913390B4C1CCD64DD3353009EE
                                                SHA-256:F4D6A62A734E2844B99F3AD0EB480373AFBE56B29C0CFC9C70D9DFDF19D95C02
                                                SHA-512:6146001CA7028F58595235F244AE8FC4ECAEA3E95C83276514FC704E91B7596678E74CDE9963D680F2493F9C04AFDEBC4DB5094E2AB7C1A949E9378307AE0116
                                                Malicious:false
                                                Reputation:high, very likely benign file
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):0.45676214072558463
                                                Encrypted:false
                                                SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
                                                MD5:EE429C7E8B222AFF73C611A8C358B661
                                                SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
                                                SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
                                                SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
                                                Malicious:false
                                                Reputation:high, very likely benign file
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):45056
                                                Entropy (8bit):4.162844629489196
                                                Encrypted:false
                                                SSDEEP:768:gMGrknsA3KVtOOcmGMrTJDEEf5R5OHNiVDdtq5:/GrkncXD+qqHNGLq
                                                MD5:7F0DB89537AF2B5FFFDD97C093799E0B
                                                SHA1:B24BD41E28472EDC8BD07CAE5D96E7607F79C9E7
                                                SHA-256:CA438B11642219F8BB2C6542DCDACEE74C6D19D9A70C3030BF836DE13CF4E2ED
                                                SHA-512:17B19323776149F5C54914A248AFD3DA12F30E86516ECDAE69147BC27C0DFE555D816E1B1236919A1C4C0D4E50C106AEC7AF26C866ADA7F3E9AFAEF421D4849C
                                                Malicious:false
                                                Preview:.W.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):45056
                                                Entropy (8bit):0.20558603354177746
                                                Encrypted:false
                                                SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
                                                MD5:55880A8B73FD160B73198E09A21C83DB
                                                SHA1:5EB780702D2501747AF46F7525EF5C635EC5E64C
                                                SHA-256:66BD4C98AF40E2E208AC102ACD0F555A6C118E7258D91B833BE1D53EBFFB7BBB
                                                SHA-512:388924B8CAE80CCA6CA8E5109D0239A963A66CC0454450223EC7FB2A188F6F05E49632E535DC06E49DF6D007B221AA6B3D5F23C80203BCC861FF95EFA10AC1F9
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):20480
                                                Entropy (8bit):2.469907427008948
                                                Encrypted:false
                                                SSDEEP:96:bhj9SeW/8iDdO/tktuGWTaZxzn3zbHGc2WjAXGBCgfd6Dgzs30z8ztvpWF4DXst:99PGo9Tmn3zbNBSw/fd6Oz8ztQSDXo
                                                MD5:3DBF4FF017D406F407BFBC2011BCAE9E
                                                SHA1:FF64864ACA18DFA7869715CE8AA5ECC3DABA54B6
                                                SHA-256:640C040F364061A5825E913682798C9BC8E1081088894D3FEB2C3EC39D02A379
                                                SHA-512:3DCC8F432487C532A1F69D321EB57EFE5CFE65AA3C99B81EA1A56613F8F460EA9ED7D2031615F2E60A3F2EE279D411848E5387CC8B8D5F28D8F8D0055D72489B
                                                Malicious:false
                                                Preview:.W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):20480
                                                Entropy (8bit):0.3847690842836057
                                                Encrypted:false
                                                SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
                                                MD5:F0B902DEA5EF122A0B1F0F496DDC781B
                                                SHA1:90176D320A9C3601787D53CC346DC743367D53F1
                                                SHA-256:CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
                                                SHA-512:3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):0.5882948808594274
                                                Encrypted:false
                                                SSDEEP:12:Ey20yaajjjjjjjjjjjjjjjjjjjjjjjjjjGjjjjjjjjjjjjjjjjjjjjjjjjjjjjjp:bhjz+9Ab
                                                MD5:09F6ED1A60B8A4203EA97CF5926C6AFF
                                                SHA1:C28F4E393D55AD057E3C7608741904B796F67076
                                                SHA-256:56664D61D0BB8BF34CCA28C73CB314CB73EA1C4FAC64D2208B43F63C009FC855
                                                SHA-512:476EAE37D827C8BB322213799AB52DBE8FA43274DB3447BC5FEDFED64ECCEAF2C11DA375FDA09B37977D03CA1910E22443B22A3EEA875CE6F3BC698F8ADCC0E2
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):0.45676214072558463
                                                Encrypted:false
                                                SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
                                                MD5:EE429C7E8B222AFF73C611A8C358B661
                                                SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
                                                SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
                                                SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):0.9312184489410064
                                                Encrypted:false
                                                SSDEEP:12:Ey20yIpyjjjjjjjjjjjjjjjjjjjjjjjjXjjjjjjjjjjjjjjjjjjjjjjjjjjjjGz7:bhbpFi043WmkN2GmGufUeDDx+yxrq3
                                                MD5:43ADE2E40B8B5A0DFA0A155FC9A02F7F
                                                SHA1:3D04BDFFD0E2A8433150C87D334014099336A5C5
                                                SHA-256:81E48EE4653A5E6F25C33133F24F045EB1EB2CC6724ECE0C5336612AB711273E
                                                SHA-512:C9C5C436A0E986A39CE3FA1CAF15A92D509F4450744BAE0283204B58CDD6FE9B8EEB8D3E2CAFB4B1ACB46729317FFAEFE86B0DD2D60472CAB30B204CC2003B03
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):0.45676214072558463
                                                Encrypted:false
                                                SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
                                                MD5:EE429C7E8B222AFF73C611A8C358B661
                                                SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
                                                SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
                                                SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):0.9312184489410064
                                                Encrypted:false
                                                SSDEEP:12:Ey20yIpyjjjjjjjjjjjjjjjjjjjjjjjjXjjjjjjjjjjjjjjjjjjjjjjjjjjjjGz7:bhbpFi043WmkN2GmGufUeDDx+yxrq3
                                                MD5:43ADE2E40B8B5A0DFA0A155FC9A02F7F
                                                SHA1:3D04BDFFD0E2A8433150C87D334014099336A5C5
                                                SHA-256:81E48EE4653A5E6F25C33133F24F045EB1EB2CC6724ECE0C5336612AB711273E
                                                SHA-512:C9C5C436A0E986A39CE3FA1CAF15A92D509F4450744BAE0283204B58CDD6FE9B8EEB8D3E2CAFB4B1ACB46729317FFAEFE86B0DD2D60472CAB30B204CC2003B03
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):0.45676214072558463
                                                Encrypted:false
                                                SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
                                                MD5:EE429C7E8B222AFF73C611A8C358B661
                                                SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
                                                SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
                                                SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):40960
                                                Entropy (8bit):3.8300937455054624
                                                Encrypted:false
                                                SSDEEP:768:A4VX6Bd+dla5HmdT8qHl87BaIPay4uz8Hks2HnwNO:A4ROd+dStM83Pav2HC
                                                MD5:7A9E039B3F1B2AEC1318A84309EE521D
                                                SHA1:4407343514AC0F4EFF253EB4A0F31DA468CD7371
                                                SHA-256:BD4EC1C4D01DE0CC76846529156AB7D947DF7E8806A00F0C3FF5B308961858EE
                                                SHA-512:147EF1CB62A83939D4E79DBDC438F61F2BE3D3F18B892B018264CFBA5608FC76F5797162BE8428F8A7C80D980E7706978B2DDF0FD4409E690AEA5A073FCDC03B
                                                Malicious:false
                                                Preview:.W.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):40960
                                                Entropy (8bit):0.22208993462959856
                                                Encrypted:false
                                                SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
                                                MD5:425CB57CD9B42556C8089FE7A7A3E495
                                                SHA1:4F33F9A9897218FDED958FD8F8D7AF7CD8BC48F3
                                                SHA-256:85E01EFF2AC0C83C827E118D5CE2CD1E1A19E059688B6E0D09CB3CC131F065D3
                                                SHA-512:8C7D4DACF5C5C5C4B78775048427AF99ED8057590AA3A69FD5B3F875B6DDD249A6DB0AF3A51BB96A7F629D1017B272317583A8DFF89FB3968FFE2F246F040F33
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):0.9419610786280751
                                                Encrypted:false
                                                SSDEEP:24:bh04IR9rYz9kvNQFl46MdnqfPE9eTuF0Ce:bhXIHakVQmnqXqeT/Ce
                                                MD5:18F02B57872A97DE1E82FF5348A5AF1B
                                                SHA1:52F332343B120B1C950AC02B3C923556C70DC62A
                                                SHA-256:5C605DE68B3E05754698485F73413F4052AEA8C3AAE6012AC6416B3B6B056DF7
                                                SHA-512:E33A8412F52D26BDE55E4D72E0D9D09EB777F4B882F5BB1C4625AB392EE321D6ACD8795001BF50CCDACFAC131A1263B1398F208799F753554C43349136EB8BEC
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):0.45676214072558463
                                                Encrypted:false
                                                SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
                                                MD5:EE429C7E8B222AFF73C611A8C358B661
                                                SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
                                                SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
                                                SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):1.309811236154278
                                                Encrypted:false
                                                SSDEEP:48:bhESUeDVrWTVd5ekRv/KSmGWqR0VouC4btU8IzTC74ExJKGtII:bhEVeBqTVdAcn3Iowl4UBtx
                                                MD5:3AFDA1B0F729816929FF7A6628D776D5
                                                SHA1:5982940A5782F11AEB5BF859C055DE3FEFBDF5DB
                                                SHA-256:77809D5F38F6D96A2E8BA9BE0DFBB16C10B6B1FF7D2BA1DD5FB9437F73C47E7F
                                                SHA-512:6D4CE03475C68EDC0AE928E7F65BB8C06198721146A1266F55455AF3D5E24F44A569E007C0DC44BC7745C1573DBC7F02B8C4094F9BD97FAF6A0B5894BE0E07E5
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):0.45676214072558463
                                                Encrypted:false
                                                SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
                                                MD5:EE429C7E8B222AFF73C611A8C358B661
                                                SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
                                                SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
                                                SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):622592
                                                Entropy (8bit):0.022159377425242585
                                                Encrypted:false
                                                SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
                                                MD5:2E442DBA85DEDFDCB07090FDF9DE90D0
                                                SHA1:02658086E93854D13D82B1F0D80F4B78D26DCA51
                                                SHA-256:62406BFE7657964E490DE65A0007F7C1D59B62B2B9AD35BA55BA219673378848
                                                SHA-512:FDBBA0DEF310CF7DBF448CFB6E5C9CDCEFBF6A0CAEB26CA3AFA91A388FBA10A9E77BCC27CA9B0AEA2A7B67F964849E147FB44862C7394C2C7CDCB572C06FCB05
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):20480
                                                Entropy (8bit):3.3621193886235408
                                                Encrypted:false
                                                SSDEEP:384:Jtp0q5d98n3SaMfhtxfmbMy+HseeNwoMbHf:JDd9QSBf
                                                MD5:B228DE097081AF360D337CF8C8FF2C6F
                                                SHA1:7DD2C4640925B225F98014566F73C35F4E960940
                                                SHA-256:1056CECADA78542B173EE469C9BEAF61F81298EBBD21B54EA6EE449028E18B3F
                                                SHA-512:F61D7F9040E452C4B1B77F3657BE4252475C3BF23D78EED903A5E55FA97BA0571BA3AD90DBA7F77C334DF5B721F909B12720515034421A4AAB0450D1D43B32E4
                                                Malicious:false
                                                Preview:.W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):20480
                                                Entropy (8bit):0.3847690842836057
                                                Encrypted:false
                                                SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
                                                MD5:F0B902DEA5EF122A0B1F0F496DDC781B
                                                SHA1:90176D320A9C3601787D53CC346DC743367D53F1
                                                SHA-256:CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
                                                SHA-512:3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):20480
                                                Entropy (8bit):3.667488020062395
                                                Encrypted:false
                                                SSDEEP:192:CF4pPRfAgFn35FF1veUMjGiEGBuPhiB0PUKwA+U:5PRfAgFn35MSeAPUjN
                                                MD5:D3CD7D67F8155491493BB7235FB9AA57
                                                SHA1:5A7AE62A7AFE50EFCCED06CBD56AE2A0A284EFF3
                                                SHA-256:6958349ECA637F99AABC419B5E402CFB50BC5B8867F31BCB67F064F47A209929
                                                SHA-512:1168BF697CDE563F7D82A71EAE1CD496EA81D178B26F87EAAF2EDEED13274B1E3500CE1C981647717598495EBE1FF8F8AC54AD33547506E566C925D7002F5CFF
                                                Malicious:false
                                                Preview:.W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):20480
                                                Entropy (8bit):0.3847690842836057
                                                Encrypted:false
                                                SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
                                                MD5:F0B902DEA5EF122A0B1F0F496DDC781B
                                                SHA1:90176D320A9C3601787D53CC346DC743367D53F1
                                                SHA-256:CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
                                                SHA-512:3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):0.7847786157292606
                                                Encrypted:false
                                                SSDEEP:12:Ey20yYn0jjjjjjjjjjjjjjjjjjjjjjjjjjGjjjjjjjjjjjjjjjjjjjjjjjjjmjj7:bhXYznMk31RFe6f
                                                MD5:FBA25855E1C99D8F87E8AC13E2E2ECB1
                                                SHA1:D99351AC40D6CC4C9BE54E0E018C44A9A88983D7
                                                SHA-256:C0E18ED1CEFF427FD4D57D1B79CE1AF7320AC8453BAF8A0349C08267464C4D71
                                                SHA-512:0969DF6506E083A4995A18518BC3C4472157E7790EEC26C08221B0FC6DE9C7DA0ADB11CF92C56BC35B89BC60447F3D991F935E352552B58FB9BD1D4B2579FBB0
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):0.45676214072558463
                                                Encrypted:false
                                                SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
                                                MD5:EE429C7E8B222AFF73C611A8C358B661
                                                SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
                                                SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
                                                SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):2.554204221242331
                                                Encrypted:false
                                                SSDEEP:192:H8Y5a2oquB2aCYn3lvu3whjXVobdbs7dq1KJGbtf0Hoa:hoquYaCYn3Q8jXqbdbs7dGbKHoa
                                                MD5:27FED1CA8EB0101C459D9A617C833293
                                                SHA1:503B2A3E33FE79FF2CD58F831ED33DB358849BEA
                                                SHA-256:C3033C4F7CF0D6108611EF5A62CA893F98EE6463DDCFF7100D3BAFDEB0036D9E
                                                SHA-512:7BD630F5E0C5A91C34D2E48D0053923C9F2F5BAA07D21FDA79E60F3AFDF759E594E6639562C1F3EE68DD080D417009DC3AFB7DA534E3B8C29FF7B10438C3FD4E
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):0.45676214072558463
                                                Encrypted:false
                                                SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
                                                MD5:EE429C7E8B222AFF73C611A8C358B661
                                                SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
                                                SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
                                                SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):20480
                                                Entropy (8bit):2.880948418505059
                                                Encrypted:false
                                                SSDEEP:192:7Sf8026LXqn3ZTV6pXAmA44BRqvc3X3GVAjvAk/AvdWjWftxA:E802uXqn3/6pxARqr8kdWjW1
                                                MD5:37CEBCD3F5BF6322785FFF568EE33131
                                                SHA1:201298C827C77C60CD314BF721DC4C27EF95BD64
                                                SHA-256:012C5597C5DD8654EB14432AFCEFD9B131F2CE75AD21488991A5A688929AAEA6
                                                SHA-512:CCC8A8CCF4ACA332CAF610155DE9E7C4A12D1C45C98D20766B86098A3D2EF332189F159E3956944CD302DF652FE7A6F0D07CA39CBE7DF4A655D3211452487582
                                                Malicious:false
                                                Preview:.W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):20480
                                                Entropy (8bit):0.3847690842836057
                                                Encrypted:false
                                                SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
                                                MD5:F0B902DEA5EF122A0B1F0F496DDC781B
                                                SHA1:90176D320A9C3601787D53CC346DC743367D53F1
                                                SHA-256:CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
                                                SHA-512:3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):20480
                                                Entropy (8bit):2.4110695640960995
                                                Encrypted:false
                                                SSDEEP:192:mva8yGn35+0+eo8TAnBW4VppKP8qtRJI:Sa8Rn35+peo8T8V/fqlI
                                                MD5:782FF89B6FA5932F7019AF9CF3F82E43
                                                SHA1:2ECE8DC134E3A292E2545AA2DCD24114A5FC5749
                                                SHA-256:01E77D9235C524F2A61EA03953607C13831C391A5B9AB0D9094F9C38F0EEB02E
                                                SHA-512:2305BEC024CA5D8B43267F5487B02081A0A746B73608E11217D19C91AD857B6A5D8E935194AC4228DA3A5383086E60D593095309E64BAF38841A6E32D7EA7805
                                                Malicious:false
                                                Preview:.W..............................P......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):20480
                                                Entropy (8bit):0.3847690842836057
                                                Encrypted:false
                                                SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
                                                MD5:F0B902DEA5EF122A0B1F0F496DDC781B
                                                SHA1:90176D320A9C3601787D53CC346DC743367D53F1
                                                SHA-256:CFD64D42263C5D323AF423FC09CDB5DDB2F914114B87BAB6566EAB1020F15DE0
                                                SHA-512:3A5BC0E51D53A12E65441FB98E1201DC434C42DB389CFCA4C96FF65C2413CF9B06B29CC39A48BD3FDC61F4896396813E54B9C2CE404EF35AC33B35377E718874
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):1.7510008687365202
                                                Encrypted:false
                                                SSDEEP:48:bhX6G+IwvnUZe4Gv/KSmGROqAQAuSe0dDOfInYbmucrm3QEAvJBFIz:bhq5bnUY4Gn3P+/Z1tvJDQ
                                                MD5:A11F5E85A2A07AF84255570AE29318FB
                                                SHA1:D06BF25E5FD4A17BCF7C5BD77ACD747F0FE181E8
                                                SHA-256:8FFA8BC408B254217275A622D054853CB72B08409A11AA49C4C664C0DABFB62F
                                                SHA-512:059F3CBC93750B68942D88EDD4AD2531B2291CEC421EB903280B9105010D1C8AD70F9F3CFA1B1A50D5110DCBFDB807A6E7A3F9EBC9A48AC8C3A49DEC4B6B3899
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):0.45676214072558463
                                                Encrypted:false
                                                SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
                                                MD5:EE429C7E8B222AFF73C611A8C358B661
                                                SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
                                                SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
                                                SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):24576
                                                Entropy (8bit):3.440634655325007
                                                Encrypted:false
                                                SSDEEP:384:SpjHrhEon3PRekEF3PS6y13Vi6w5TlmmcOB:Q3hNEk23MuxrB
                                                MD5:DF5C1114538C5D8EA1EE929FFAC24E3C
                                                SHA1:B6331AF77566B63EA8204BE85F5DC99FAF51479E
                                                SHA-256:F238C75DAD82E10AB011A9BF79775B2A5F5889644A5A06835933340845A08555
                                                SHA-512:9514A424CC2A9290F749F527F515B35E45C6A829CB3930DBFB39DC9D70A684640A31686EC77258FF285FE89B6DD44BB01A478848FF9B3EBD764741A6F7856704
                                                Malicious:false
                                                Preview:.W..............................`......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):24576
                                                Entropy (8bit):0.3337394253577246
                                                Encrypted:false
                                                SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
                                                MD5:5B66CE03BFE548DEE335E0518E4E0554
                                                SHA1:65397845DC679AA972454B0FF237A513C0F490CB
                                                SHA-256:C38BB21B1D92166794DC09807C9A55B67B0A760C684FEEDD0C931F8415DD6D29
                                                SHA-512:A31C3D23F25607333250443490F0EE295BB702B46A636905FD413E8AEAA8ED23AAB42106868D2938718555C9DEEFB69FB416CAF5228A422F64D6CA8DB438FEE8
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):0.8558400366712392
                                                Encrypted:false
                                                SSDEEP:12:Ey20y8jjjjjjjjjjjjjjjjjjjjjjjjjjGjjjKuV0jjjjjjjjjjjjjjjjjjjjjjje:bhaVZjx6ot7m13SmZQs
                                                MD5:67697BEA7C23E4805A82FE9755BB3CAE
                                                SHA1:14ACAFF0BECBDB116E4C0BC329E59DEF68CF46D1
                                                SHA-256:553DA7FF76999B7CCC4450498B11E6BD98B3B1E5FF81D82A53568F84B0D270D5
                                                SHA-512:D966DD6430003E708C6EE10764DC072A1ED0A252E6E1C822CBD28271A2EDD4B1F61C7F9AA7D1D442D6175791A104A365DE25B9C2598500AE705C9250C8BA46A1
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):0.45676214072558463
                                                Encrypted:false
                                                SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
                                                MD5:EE429C7E8B222AFF73C611A8C358B661
                                                SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
                                                SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
                                                SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):1.3868484511023333
                                                Encrypted:false
                                                SSDEEP:48:bhLSUCt/WFekRv/KSmGWqApnEVyfNsu+tBNGg2PgULLE2vRy2QwfoQEDiR2e3iRj:bhLVC48cn3Vu2FtBv7AtboQIqb3qwK
                                                MD5:0DD75ECC81E4E564EA56A57FF32A24D3
                                                SHA1:859C0FE5F86A2C5A32BAD7920787BE845F34C4FB
                                                SHA-256:DB778B175D19DEFA4180D0B12D675AD0B8B22CC4BB77702D9EC8510F894EB3B1
                                                SHA-512:7B0C56A76797383527509F8036EB4911F8925E7ACC005CDC3269F0A43231479E3A0A9887BF4D2979F05CBFE18324997DEF715FDA6921EEF827B385C9D902C708
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):0.45676214072558463
                                                Encrypted:false
                                                SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
                                                MD5:EE429C7E8B222AFF73C611A8C358B661
                                                SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
                                                SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
                                                SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):2.5432558448090097
                                                Encrypted:false
                                                SSDEEP:96:bhk/+fz7b9ldxbe2Vn3iwkVJIB0D6c6aZ4+1Wrzbxpl4/tMe1:imrn9lHbe2Vn3iwKhD6cvTAbl4/tMe
                                                MD5:D97454D6B1F39F39966A809BCA3D9647
                                                SHA1:276931CED8F34B7651C1BDFC8522FF0560E2C377
                                                SHA-256:DCB8CE7F4F21595D851100F315C56B717541DB898AEB9ED9C0CCC9FF217A5801
                                                SHA-512:3E014F3EA8EEE79B87726EDA6291AC2D0BD9B22803EE848F61CA2AAD39D5FB87704410C57C648EE4AF8A1B78EFB0D766524F6DB750208C9BAC346079FD8EE69E
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):0.45676214072558463
                                                Encrypted:false
                                                SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
                                                MD5:EE429C7E8B222AFF73C611A8C358B661
                                                SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
                                                SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
                                                SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):1.7558188637474321
                                                Encrypted:false
                                                SSDEEP:96:bhWV1OIM7cn3UZiPU1wywyoEpJmz6W2Mzgg:YDOL4n3fPvywrzgMU
                                                MD5:5F905B930E7310E72BC3DF5C50F8E579
                                                SHA1:50B1AD3115F095C743CB26F87ECCE406FAC3523B
                                                SHA-256:1DB72BA77CA01F25CA9768999825D8F97F5ED4D00E17C9130D6F7CDE34130270
                                                SHA-512:A6066F4DF4097DB93673CD156BBE5F910C3F64D01E1671E481BC9FBDD720DBD6F8CEF337E20404F7C6AE97B2FA1F5E67088041ACBB6EA85D6758924D5740D06C
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):0.45676214072558463
                                                Encrypted:false
                                                SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
                                                MD5:EE429C7E8B222AFF73C611A8C358B661
                                                SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
                                                SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
                                                SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):2.6210042560348144
                                                Encrypted:false
                                                SSDEEP:48:bh5roGafX8XKu5YIoBHtF2YekDsv/KSmGWNmA/y0uJNI/oyjaOUUfEHKn9nnjoEJ:bhdoLfX8N9oBNF2XFn3UD/9FZiy0aoN
                                                MD5:39398A15564A55EB7BFE895D7668A5A3
                                                SHA1:28DA677435B87176E08AFABBF8B51F7B93E22948
                                                SHA-256:A4C0216476E357ED3A23E71333DBE7DE91E04370EF049032EE8E47BB1EDBD83B
                                                SHA-512:B4E69212338C742F8C83194552078A86E4BED59375D82563C0B4059B7E0D6A58D6317151AB1F2A6FB20D2FF6DB7C550DF6A6984B2BB873A111D58AF9AEB7D95E
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):0.45676214072558463
                                                Encrypted:false
                                                SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
                                                MD5:EE429C7E8B222AFF73C611A8C358B661
                                                SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
                                                SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
                                                SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):1.0170167917961734
                                                Encrypted:false
                                                SSDEEP:24:bhAvIZuF4ptmpzf50dhOv8WvxjMMhFmMKxevOfOots+:bhDi4p+ahOhFFKxewj
                                                MD5:1FC5F2B98E5BC25B10373353D91B86B1
                                                SHA1:D848DA35B0731328195D59C1E996B95C4952F1F9
                                                SHA-256:509FAD18B4454CD70D974755F6156D4A5FA9B960AB9FF468D1FC350F0B64F379
                                                SHA-512:95BC2E289EDE5D9A3F56C9D8AE9DD13D9379BE2ABF8927CDABBE92B9F57A8EB667E9C08E4DFD82BF9F1F57118CE6E495722ADA2668AFF4FA0540F46C0A6D5138
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/bin/mandb
                                                File Type:GNU dbm 1.x or ndbm database, little endian, 64-bit
                                                Category:dropped
                                                Size (bytes):16384
                                                Entropy (8bit):0.45676214072558463
                                                Encrypted:false
                                                SSDEEP:12:Ey20ypjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:bh
                                                MD5:EE429C7E8B222AFF73C611A8C358B661
                                                SHA1:DA353E80DCF1195F259CCBC32D39F5923710453F
                                                SHA-256:BDAAC26D90701E063943763B7CBD9204B6F0007C6F1BCA3C7B4FE3B09CDF6091
                                                SHA-512:DC651AF7AEB4A64C63986100E416A7DA4782678497B73F1CE42536DE02DB9E4115748881A56B86EC5B12E34C9FDF829BD194BEA7790FDCA7B2F5178A24930809
                                                Malicious:false
                                                Preview:.W..............................@......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                Process:/usr/sbin/logrotate
                                                File Type:ASCII text
                                                Category:dropped
                                                Size (bytes):1588
                                                Entropy (8bit):4.81222972717193
                                                Encrypted:false
                                                SSDEEP:48:UHSqJYVr0pGKUq4EpUkKcsVUqA5F5xHgq470DNU123o9NRqJN9qJ6mU9v3tU8Mb:Mlx46Pz4meTmnwwEv
                                                MD5:39B51B1831158753AAE6F5C04AA69EDE
                                                SHA1:645FB815C1450A86C90A5A2FA4B9607D407015B9
                                                SHA-256:2600174458E7A54F2F8A4A42437C1FBB1F682DE90EA46FF93A8906EDA8EE9D2A
                                                SHA-512:073ABDD0A86357B8492E3C5F8DAFF92F6613C1F544DDBF3ADD9749BEAA41D55E7C01A31E30E14E9B4B0B2B63EAACB364CE589DF7916AF0FE48EB7000C8B9EE43
                                                Malicious:false
                                                Preview:logrotate state -- version 2."/var/log/syslog" 2025-3-24-4:58:27."/var/log/dpkg.log" 2025-3-24-4:58:27."/var/log/speech-dispatcher/debug-flite" 2025-3-24-0:0:0."/var/log/unattended-upgrades/unattended-upgrades.log" 2025-3-24-4:58:27."/var/log/unattended-upgrades/unattended-upgrades-shutdown.log" 2021-9-17-9:23:29."/var/log/auth.log" 2025-3-24-4:58:27."/var/log/apt/term.log" 2025-3-24-4:58:27."/var/log/ppp-connect-errors" 2025-3-24-0:0:0."/var/log/speech-dispatcher/speech-dispatcher-protocol.log" 2025-3-24-0:0:0."/var/log/apport.log" 2021-9-17-9:23:29."/var/log/apt/history.log" 2025-3-24-4:58:27."/var/log/boot.log" 2025-3-24-0:0:0."/var/log/lightdm/*.log" 2025-3-24-0:0:0."/var/log/alternatives.log" 2021-9-17-9:23:29."/var/log/debug" 2025-3-24-0:0:0."/var/log/mail.log" 2025-3-24-0:0:0."/var/log/kern.log" 2025-3-24-4:58:27."/var/log/cups/access_log" 2025-3-24-4:58:27."/var/log/ufw.log" 2025-3-24-0:0:0."/var/log/speech-dispatcher/speech-dispatcher.log" 2025-3-24-0:0:0."/var/log/daemon.log"
                                                File type:ELF 32-bit MSB executable, SPARC, version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, stripped
                                                Entropy (8bit):5.606837569979011
                                                TrID:
                                                • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                File name:morte.spc.elf
                                                File size:45'612 bytes
                                                MD5:10a7630b1c4f6197ba7238e1aa73fc23
                                                SHA1:9ee8f039504be1f6c3be53a1fd98a13104e58fc2
                                                SHA256:eca6a4443db7bd57f56b223beb49e08dd878e57bb2b377b58bfe3c6d5356f66f
                                                SHA512:515fbb77b6af1ce3e268edd24a6cf2511eadf8ed88cf0031bc47901eefca88e5b82626dd23cf3283e11f79f4a80189d4e3119c9aef59a367332be7927f7764df
                                                SSDEEP:768:fkUoMQ769Hd/uKCXMWzMSqykPFblsnrfKh+CVNUCtXo:f1oOHd/uKCXjoSvrfo9VNNtY
                                                TLSH:212329B293B82F27D0E4AB7841775B0371983B9515A4CA8FBC560D0FEE56360A9237F4
                                                File Content Preview:.ELF...........................4...4.....4. ...(...........4...4...4................................................................................................................................................dt.Q............................/lib/ld-uCl

                                                ELF header

                                                Class:ELF32
                                                Data:2's complement, big endian
                                                Version:1 (current)
                                                Machine:Sparc
                                                Version Number:0x1
                                                Type:EXEC (Executable file)
                                                OS/ABI:UNIX - System V
                                                ABI Version:0
                                                Entry Point Address:0x111c0
                                                Flags:0x0
                                                ELF Header Size:52
                                                Program Header Offset:52
                                                Program Header Size:32
                                                Number of Program Headers:6
                                                Section Header Offset:44852
                                                Section Header Size:40
                                                Number of Section Headers:19
                                                Header String Table Index:18
                                                NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                                NULL0x00x00x00x00x0000
                                                .interpPROGBITS0x100f40xf40x140x00x2A001
                                                .hashHASH0x101080x1080x2800x40x2A304
                                                .dynsymDYNSYM0x103880x3880x5b00x100x2A414
                                                .dynstrSTRTAB0x109380x9380x3b60x00x2A001
                                                .rela.dynRELA0x10cf00xcf00x1380xc0x2A304
                                                .rela.pltRELA0x10e280xe280x2880xc0x2A3154
                                                .initPROGBITS0x110b00x10b00x1c0x00x6AX004
                                                .textPROGBITS0x110cc0x10cc0x66a00x00x6AX004
                                                .finiPROGBITS0x1776c0x776c0x140x00x6AX004
                                                .rodataPROGBITS0x177800x77800x19180x00x2A008
                                                .ctorsPROGBITS0x2a0000xa0000x80x00x3WA004
                                                .dtorsPROGBITS0x2a0080xa0080x80x00x3WA004
                                                .dynamicDYNAMIC0x2a0140xa0140xb80x80x3WA404
                                                .gotPROGBITS0x2a0cc0xa0cc0x1b80x40x3WA004
                                                .pltPROGBITS0x2a2840xa2840x2bc0xc0x7WAX004
                                                .dataPROGBITS0x2a5400xa5400x9740x00x3WA004
                                                .bssNOBITS0x2aeb40xaeb40x2140x00x3WA004
                                                .shstrtabSTRTAB0x00xaeb40x7e0x00x0001
                                                TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                PHDR0x340x100340x100340xc00xc02.17400x5R E0x4
                                                INTERP0xf40x100f40x100f40x140x143.68420x4R 0x1/lib/ld-uClibc.so.0.interp
                                                LOAD0x00x100000x100000x90980x90986.04760x5R E0x10000.interp .hash .dynsym .dynstr .rela.dyn .rela.plt .init .text .fini .rodata
                                                LOAD0xa0000x2a0000x2a0000xeb40x10c84.33060x7RWE0x10000.ctors .dtors .dynamic .got .plt .data .bss
                                                DYNAMIC0xa0140x2a0140x2a0140xb80xb82.11370x6RW 0x4.dynamic
                                                GNU_STACK0x00x00x00x00x00.00000x6RW 0x4
                                                TypeMetaValueTag
                                                DT_NEEDEDsharedliblibpthread.so.00x1
                                                DT_NEEDEDsharedliblibc.so.00x1
                                                DT_INITvalue0x110b00xc
                                                DT_FINIvalue0x1776c0xd
                                                DT_HASHvalue0x101080x4
                                                DT_STRTABvalue0x109380x5
                                                DT_SYMTABvalue0x103880x6
                                                DT_STRSZbytes9500xa
                                                DT_SYMENTbytes160xb
                                                DT_DEBUGvalue0x00x15
                                                DT_PLTGOTvalue0x2a2840x3
                                                DT_PLTRELSZbytes6480x2
                                                DT_PLTRELpltrelDT_RELA0x14
                                                DT_JMPRELvalue0x10e280x17
                                                DT_RELAvalue0x10cf00x7
                                                DT_RELASZbytes9600x8
                                                DT_RELAENTbytes120x9
                                                DT_NULLvalue0x00x0
                                                NameVersion Info NameVersion Info File NameSection NameValueSizeSymbol TypeSymbol BindSymbol VisibilityNdx
                                                .dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                                LOCAL_ADDR.dynsym0x2aef04OBJECT<unknown>DEFAULT19
                                                _Jv_RegisterClasses.dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                                __bss_start.dynsym0x2aeb40NOTYPE<unknown>DEFAULTSHN_ABS
                                                __deregister_frame_info.dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                                __errno_location.dynsym0x2a4ac8FUNC<unknown>DEFAULTSHN_UNDEF
                                                __register_frame_info.dynsym0x00NOTYPE<unknown>DEFAULTSHN_UNDEF
                                                __uClibc_main.dynsym0x2a440544FUNC<unknown>DEFAULTSHN_UNDEF
                                                _edata.dynsym0x2aeb40NOTYPE<unknown>DEFAULTSHN_ABS
                                                _end.dynsym0x2b0c80NOTYPE<unknown>DEFAULTSHN_ABS
                                                _fini.dynsym0x1776c8FUNC<unknown>DEFAULT9
                                                _init.dynsym0x110b08FUNC<unknown>DEFAULT7
                                                _start.dynsym0x111c056FUNC<unknown>DEFAULT8
                                                allowed_ports.dynsym0x2a54832OBJECT<unknown>DEFAULT18
                                                allowed_ports_size.dynsym0x2a5684OBJECT<unknown>DEFAULT18
                                                atoi.dynsym0x2a4c424FUNC<unknown>DEFAULTSHN_UNDEF
                                                attack_method_greeth.dynsym0x121741656FUNC<unknown>DEFAULT8
                                                attack_method_greip.dynsym0x127ec1472FUNC<unknown>DEFAULT8
                                                attack_method_std.dynsym0x153f8588FUNC<unknown>DEFAULT8
                                                attack_method_tcpack.dynsym0x146d81712FUNC<unknown>DEFAULT8
                                                attack_method_tcpstomp.dynsym0x13f801880FUNC<unknown>DEFAULT8
                                                attack_method_tcpsyn.dynsym0x14d881648FUNC<unknown>DEFAULT8
                                                attack_method_tcpxmas.dynsym0x138281880FUNC<unknown>DEFAULT8
                                                attack_method_udpdns.dynsym0x131981680FUNC<unknown>DEFAULT8
                                                attack_method_udpgeneric.dynsym0x11c381340FUNC<unknown>DEFAULT8
                                                attack_method_udpplain.dynsym0x119ec588FUNC<unknown>DEFAULT8
                                                attack_method_udpvse.dynsym0x12dac1004FUNC<unknown>DEFAULT8
                                                bind.dynsym0x2a3bc36FUNC<unknown>DEFAULTSHN_UNDEF
                                                calloc.dynsym0x2a398112FUNC<unknown>DEFAULTSHN_UNDEF
                                                clock.dynsym0x2a4dc56FUNC<unknown>DEFAULTSHN_UNDEF
                                                close.dynsym0x2a50c48FUNC<unknown>DEFAULTSHN_UNDEF
                                                closedir.dynsym0x2a4f4148FUNC<unknown>DEFAULTSHN_UNDEF
                                                connect.dynsym0x2a2d856FUNC<unknown>DEFAULTSHN_UNDEF
                                                exit.dynsym0x2a4b8164FUNC<unknown>DEFAULTSHN_UNDEF
                                                fclose.dynsym0x2a458368FUNC<unknown>DEFAULTSHN_UNDEF
                                                fcntl.dynsym0x2a50080FUNC<unknown>DEFAULTSHN_UNDEF
                                                fd_ctrl.dynsym0x2aea04OBJECT<unknown>DEFAULT18
                                                fd_serv.dynsym0x2aea44OBJECT<unknown>DEFAULT18
                                                fgets.dynsym0x2a314116FUNC<unknown>DEFAULTSHN_UNDEF
                                                fopen.dynsym0x2a44c24FUNC<unknown>DEFAULTSHN_UNDEF
                                                fork.dynsym0x2a428376FUNC<unknown>DEFAULTSHN_UNDEF
                                                free.dynsym0x2a518280FUNC<unknown>DEFAULTSHN_UNDEF
                                                getpid.dynsym0x2a30864FUNC<unknown>DEFAULTSHN_UNDEF
                                                getppid.dynsym0x2a46464FUNC<unknown>DEFAULTSHN_UNDEF
                                                getsockname.dynsym0x2a53076FUNC<unknown>DEFAULTSHN_UNDEF
                                                getsockopt.dynsym0x2a4a084FUNC<unknown>DEFAULTSHN_UNDEF
                                                inet_addr.dynsym0x2a3c840FUNC<unknown>DEFAULTSHN_UNDEF
                                                ioctl.dynsym0x2a2c0100FUNC<unknown>DEFAULTSHN_UNDEF
                                                kill.dynsym0x2a3b072FUNC<unknown>DEFAULTSHN_UNDEF
                                                listen.dynsym0x2a41c28FUNC<unknown>DEFAULTSHN_UNDEF
                                                malloc.dynsym0x2a32c376FUNC<unknown>DEFAULTSHN_UNDEF
                                                memcpy.dynsym0x04212FUNC<unknown>DEFAULTSHN_UNDEF
                                                methods.dynsym0x2aed44OBJECT<unknown>DEFAULT19
                                                methods_len.dynsym0x2aed01OBJECT<unknown>DEFAULT19
                                                open.dynsym0x2a4d080FUNC<unknown>DEFAULTSHN_UNDEF
                                                opendir.dynsym0x2a47c260FUNC<unknown>DEFAULTSHN_UNDEF
                                                pending_connection.dynsym0x2aedc1OBJECT<unknown>DEFAULT19
                                                read.dynsym0x2a3f856FUNC<unknown>DEFAULTSHN_UNDEF
                                                readdir.dynsym0x2a368184FUNC<unknown>DEFAULTSHN_UNDEF
                                                readlink.dynsym0x2a32076FUNC<unknown>DEFAULTSHN_UNDEF
                                                realloc.dynsym0x2a410316FUNC<unknown>DEFAULTSHN_UNDEF
                                                recv.dynsym0x2a2cc60FUNC<unknown>DEFAULTSHN_UNDEF
                                                recvfrom.dynsym0x2a34468FUNC<unknown>DEFAULTSHN_UNDEF
                                                resolve_func.dynsym0x2aea84OBJECT<unknown>DEFAULT18
                                                restricted_substrings.dynsym0x2a6342156OBJECT<unknown>DEFAULT18
                                                select.dynsym0x2a35c84FUNC<unknown>DEFAULTSHN_UNDEF
                                                send.dynsym0x2a38060FUNC<unknown>DEFAULTSHN_UNDEF
                                                sendto.dynsym0x2a40468FUNC<unknown>DEFAULTSHN_UNDEF
                                                setsid.dynsym0x2a4e864FUNC<unknown>DEFAULTSHN_UNDEF
                                                setsockopt.dynsym0x2a3d444FUNC<unknown>DEFAULTSHN_UNDEF
                                                sigaddset.dynsym0x2a37456FUNC<unknown>DEFAULTSHN_UNDEF
                                                sigemptyset.dynsym0x2a2e432FUNC<unknown>DEFAULTSHN_UNDEF
                                                signal.dynsym0x2a3ec204FUNC<unknown>DEFAULTSHN_UNDEF
                                                sigprocmask.dynsym0x2a524140FUNC<unknown>DEFAULTSHN_UNDEF
                                                sleep.dynsym0x2a338428FUNC<unknown>DEFAULTSHN_UNDEF
                                                snprintf.dynsym0x2a2f048FUNC<unknown>DEFAULTSHN_UNDEF
                                                socket.dynsym0x2a35076FUNC<unknown>DEFAULTSHN_UNDEF
                                                sprintf.dynsym0x2a49452FUNC<unknown>DEFAULTSHN_UNDEF
                                                srv_addr.dynsym0x2aef416OBJECT<unknown>DEFAULT19
                                                sscanf.dynsym0x2a43448FUNC<unknown>DEFAULTSHN_UNDEF
                                                strcmp.dynsym0x2a488648FUNC<unknown>DEFAULTSHN_UNDEF
                                                strcpy.dynsym0x2a2b4804FUNC<unknown>DEFAULTSHN_UNDEF
                                                strstr.dynsym0x2a3e0288FUNC<unknown>DEFAULTSHN_UNDEF
                                                strtol.dynsym0x2a38c20FUNC<unknown>DEFAULTSHN_UNDEF
                                                table.dynsym0x2af04448OBJECT<unknown>DEFAULT19
                                                table_key.dynsym0x2aeb04OBJECT<unknown>DEFAULT18
                                                time.dynsym0x2a47072FUNC<unknown>DEFAULTSHN_UNDEF
                                                usleep.dynsym0x2a2fc72FUNC<unknown>DEFAULTSHN_UNDEF
                                                watchdog_pid.dynsym0x2aed84OBJECT<unknown>DEFAULT19
                                                whitelistpaths.dynsym0x2a56c200OBJECT<unknown>DEFAULT18
                                                write.dynsym0x2a3a456FUNC<unknown>DEFAULTSHN_UNDEF

                                                Download Network PCAP: filteredfull

                                                • Total Packets: 8
                                                • 443 (HTTPS)
                                                • 80 (HTTP)
                                                TimestampSource PortDest PortSource IPDest IP
                                                Mar 24, 2025 05:59:07.918673992 CET43928443192.168.2.2391.189.91.42
                                                Mar 24, 2025 05:59:13.549938917 CET42836443192.168.2.2391.189.91.43
                                                Mar 24, 2025 05:59:15.085769892 CET4251680192.168.2.23109.202.202.202
                                                Mar 24, 2025 05:59:29.163712025 CET43928443192.168.2.2391.189.91.42
                                                Mar 24, 2025 05:59:39.402162075 CET42836443192.168.2.2391.189.91.43
                                                Mar 24, 2025 05:59:45.545351982 CET4251680192.168.2.23109.202.202.202
                                                Mar 24, 2025 06:00:10.117958069 CET43928443192.168.2.2391.189.91.42
                                                Mar 24, 2025 06:00:30.595094919 CET42836443192.168.2.2391.189.91.43

                                                System Behavior

                                                Start time (UTC):04:59:05
                                                Start date (UTC):24/03/2025
                                                Path:/tmp/morte.spc.elf
                                                Arguments:/tmp/morte.spc.elf
                                                File size:4379400 bytes
                                                MD5 hash:7dc1c0e23cd5e102bb12e5c29403410e

                                                Start time (UTC):05:00:03
                                                Start date (UTC):24/03/2025
                                                Path:/usr/lib/systemd/systemd
                                                Arguments:-
                                                File size:1620224 bytes
                                                MD5 hash:9b2bec7092a40488108543f9334aab75

                                                Start time (UTC):05:00:03
                                                Start date (UTC):24/03/2025
                                                Path:/sbin/fstrim
                                                Arguments:/sbin/fstrim --fstab --verbose --quiet
                                                File size:71912 bytes
                                                MD5 hash:72cd771da16ce70f2601ba29d880bd00

                                                Start time (UTC):05:00:03
                                                Start date (UTC):24/03/2025
                                                Path:/usr/lib/systemd/systemd
                                                Arguments:-
                                                File size:1620224 bytes
                                                MD5 hash:9b2bec7092a40488108543f9334aab75

                                                Start time (UTC):05:00:03
                                                Start date (UTC):24/03/2025
                                                Path:/usr/sbin/logrotate
                                                Arguments:/usr/sbin/logrotate /etc/logrotate.conf
                                                File size:84056 bytes
                                                MD5 hash:ff9f6831debb63e53a31ff8057143af6

                                                Start time (UTC):05:00:03
                                                Start date (UTC):24/03/2025
                                                Path:/usr/lib/systemd/systemd
                                                Arguments:-
                                                File size:1620224 bytes
                                                MD5 hash:9b2bec7092a40488108543f9334aab75

                                                Start time (UTC):05:00:03
                                                Start date (UTC):24/03/2025
                                                Path:/usr/bin/install
                                                Arguments:/usr/bin/install -d -o man -g man -m 0755 /var/cache/man
                                                File size:158112 bytes
                                                MD5 hash:55e2520049dc6a62e8c94732e36cdd54

                                                Start time (UTC):05:00:03
                                                Start date (UTC):24/03/2025
                                                Path:/usr/lib/systemd/systemd
                                                Arguments:-
                                                File size:1620224 bytes
                                                MD5 hash:9b2bec7092a40488108543f9334aab75

                                                Start time (UTC):05:00:03
                                                Start date (UTC):24/03/2025
                                                Path:/usr/bin/find
                                                Arguments:/usr/bin/find /var/cache/man -type f -name *.gz -atime +6 -delete
                                                File size:320160 bytes
                                                MD5 hash:b68ef002f84cc54dd472238ba7df80ab

                                                Start time (UTC):05:00:03
                                                Start date (UTC):24/03/2025
                                                Path:/usr/lib/systemd/systemd
                                                Arguments:-
                                                File size:1620224 bytes
                                                MD5 hash:9b2bec7092a40488108543f9334aab75

                                                Start time (UTC):05:00:03
                                                Start date (UTC):24/03/2025
                                                Path:/usr/bin/mandb
                                                Arguments:/usr/bin/mandb --quiet
                                                File size:142432 bytes
                                                MD5 hash:1dda5ea0027ecf1c2db0f5a3de7e6941