Create Interactive Tour

Linux Analysis Report
hanoi.sh4.elf

Overview

General Information

Sample name:	hanoi.sh4.elf
Analysis ID:	1649662
MD5:	a6d7691e700f2907e5f2ec5df85404d9
SHA1:	d0464b01799bb8b81912dfb6d02f31f9d69a1432
SHA256:	77901d6bd4cfa884b42ab837e3c2e60fb0a73a2f38de4dbc27a4534a196aabc1
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai, Okiru, Xmrig

Score:	100
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Yara detected Okiru

Yara detected Xmrig cryptocurrency miner

Found strings related to Crypto-Mining

Reads system files that contain records of logged in users

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

Reads CPU information from /sys indicative of miner or evasive malware

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1649662
Start date and time:	2025-03-27 00:58:48 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	hanoi.sh4.elf
Detection:	MAL
Classification:	mal100.spre.troj.mine.linELF@0/7@2/0

Warnings

Report size exceeded maximum capacity and may have missing behavior information.

Runtime Messages

Command:	/tmp/hanoi.sh4.elf
PID:	5595
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

hanoi.sh4.elf (PID: 5595, Parent: 5514, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/hanoi.sh4.elf

hanoi.sh4.elf New Fork (PID: 5597, Parent: 5595)

hanoi.sh4.elf New Fork (PID: 5598, Parent: 5595)

hanoi.sh4.elf New Fork (PID: 5599, Parent: 5595)

hanoi.sh4.elf New Fork (PID: 5601, Parent: 5595)

gnome-session-binary New Fork (PID: 5627, Parent: 1588)

sh (PID: 5627, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-wacom

gsd-wacom (PID: 5627, Parent: 1588, MD5: 13778dd1a23a4e94ddc17ac9caa4fcc1) Arguments: /usr/libexec/gsd-wacom

gnome-session-binary New Fork (PID: 5630, Parent: 1588)

sh (PID: 5630, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-color

gsd-color (PID: 5630, Parent: 1588, MD5: ac2861ad93ce047283e8e87cefef9a19) Arguments: /usr/libexec/gsd-color

gnome-session-binary New Fork (PID: 5631, Parent: 1588)

sh (PID: 5631, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-keyboard

gsd-keyboard (PID: 5631, Parent: 1588, MD5: 8e288fd17c80bb0a1148b964b2ac2279) Arguments: /usr/libexec/gsd-keyboard

gnome-session-binary New Fork (PID: 5632, Parent: 1588)

sh (PID: 5632, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 5632, Parent: 1588, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

gsd-print-notifications New Fork (PID: 5829, Parent: 5632)

gsd-print-notifications New Fork (PID: 5830, Parent: 5829)

gsd-printer (PID: 5830, Parent: 1, MD5: 7995828cf98c315fd55f2ffb3b22384d) Arguments: /usr/libexec/gsd-printer

gnome-session-binary New Fork (PID: 5633, Parent: 1588)

sh (PID: 5633, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 5633, Parent: 1588, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

gnome-session-binary New Fork (PID: 5634, Parent: 1588)

sh (PID: 5634, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-smartcard

gsd-smartcard (PID: 5634, Parent: 1588, MD5: ea1fbd7f62e4cd0331eae2ef754ee605) Arguments: /usr/libexec/gsd-smartcard

gnome-session-binary New Fork (PID: 5635, Parent: 1588)

sh (PID: 5635, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-datetime

gsd-datetime (PID: 5635, Parent: 1588, MD5: d80d39745740de37d6634d36e344d4bc) Arguments: /usr/libexec/gsd-datetime

gnome-session-binary New Fork (PID: 5636, Parent: 1588)

sh (PID: 5636, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-media-keys

gsd-media-keys (PID: 5636, Parent: 1588, MD5: a425448c135afb4b8bfd79cc0b6b74da) Arguments: /usr/libexec/gsd-media-keys

gnome-session-binary New Fork (PID: 5637, Parent: 1588)

sh (PID: 5637, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-screensaver-proxy

gsd-screensaver-proxy (PID: 5637, Parent: 1588, MD5: 77e309450c87dceee43f1a9e50cc0d02) Arguments: /usr/libexec/gsd-screensaver-proxy

gnome-session-binary New Fork (PID: 5640, Parent: 1588)

sh (PID: 5640, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-sound

gsd-sound (PID: 5640, Parent: 1588, MD5: 4c7d3fb993463337b4a0eb5c80c760ee) Arguments: /usr/libexec/gsd-sound

gnome-session-binary New Fork (PID: 5641, Parent: 1588)

sh (PID: 5641, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-a11y-settings

gsd-a11y-settings (PID: 5641, Parent: 1588, MD5: 18e243d2cf30ecee7ea89d1462725c5c) Arguments: /usr/libexec/gsd-a11y-settings

gnome-session-binary New Fork (PID: 5644, Parent: 1588)

sh (PID: 5644, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

gsd-housekeeping (PID: 5644, Parent: 1588, MD5: b55f3394a84976ddb92a2915e5d76914) Arguments: /usr/libexec/gsd-housekeeping

gnome-session-binary New Fork (PID: 5645, Parent: 1588)

sh (PID: 5645, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-power

gsd-power (PID: 5645, Parent: 1588, MD5: 28b8e1b43c3e7f1db6741ea1ecd978b7) Arguments: /usr/libexec/gsd-power

gvfsd-fuse New Fork (PID: 5648, Parent: 3122)

fusermount (PID: 5648, Parent: 3122, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

xfce4-session New Fork (PID: 5651, Parent: 2984)

xfwm4 (PID: 5651, Parent: 2984, MD5: 59defa3c00cc30d85ed77b738d55e9da) Arguments: xfwm4 --display :1.0 --sm-client-id 27575c7dd-2dac-48f0-9f3a-eff67ec043e5

xfce4-session New Fork (PID: 5675, Parent: 2984)

xfce4-panel (PID: 5675, Parent: 2984, MD5: a15b657c7d54ac1385f1f15004ea6784) Arguments: xfce4-panel --display :1.0 --sm-client-id 2d6b1caf2-8023-452b-bd0d-d23295482740

xfce4-session New Fork (PID: 5681, Parent: 2984)

rm (PID: 5681, Parent: 2984, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /home/saturnino/.cache/sessions/Thunar-2ec7c2e14-9c4d-40f3-9704-8617ab831fb4

xfce4-session New Fork (PID: 5686, Parent: 2984)

xfdesktop (PID: 5686, Parent: 2984, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 260d40b3c-9c6a-4cb1-bbe4-3557725aa528

systemd New Fork (PID: 5688, Parent: 1)

systemd-hostnamed (PID: 5688, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

xfce4-session New Fork (PID: 5841, Parent: 2984)

xfwm4 (PID: 5841, Parent: 2984, MD5: 59defa3c00cc30d85ed77b738d55e9da) Arguments: xfwm4 --display :1.0 --sm-client-id 27575c7dd-2dac-48f0-9f3a-eff67ec043e5

dbus-daemon New Fork (PID: 5843, Parent: 5842)

xfconfd (PID: 5843, Parent: 5842, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

gdm3 New Fork (PID: 5844, Parent: 1400)

Default (PID: 5844, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

xfce4-session New Fork (PID: 5845, Parent: 2984)

xfce4-panel (PID: 5845, Parent: 2984, MD5: a15b657c7d54ac1385f1f15004ea6784) Arguments: xfce4-panel --display :1.0 --sm-client-id 2d6b1caf2-8023-452b-bd0d-d23295482740

xfce4-panel New Fork (PID: 5949, Parent: 5845)

wrapper-2.0 (PID: 5949, Parent: 5845, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 6291464 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 5950, Parent: 5845)

wrapper-2.0 (PID: 5950, Parent: 5845, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 6291465 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 5967, Parent: 5845)

wrapper-2.0 (PID: 5967, Parent: 5845, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 6291466 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 5968, Parent: 5845)

wrapper-2.0 (PID: 5968, Parent: 5845, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 6291467 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

xfce4-panel New Fork (PID: 5970, Parent: 5845)

wrapper-2.0 (PID: 5970, Parent: 5845, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 6291468 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 5998, Parent: 5845)

wrapper-2.0 (PID: 5998, Parent: 5845, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 6291469 actions "Action Buttons" "Log out, lock or other system actions"

xfce4-panel New Fork (PID: 6047, Parent: 5845)

wrapper-2.0 (PID: 6047, Parent: 5845, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 6291464 systray "Notification Area" "Area where notification icons appear"

xfce4-panel New Fork (PID: 6049, Parent: 5845)

wrapper-2.0 (PID: 6049, Parent: 5845, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libstatusnotifier.so 7 6291465 statusnotifier "Status Notifier Plugin" "Provides a panel area for status notifier items (application indicators)"

xfce4-panel New Fork (PID: 6051, Parent: 5845)

wrapper-2.0 (PID: 6051, Parent: 5845, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 6291466 pulseaudio "PulseAudio Plugin" "Adjust the audio volume of the PulseAudio sound system"

xfce4-panel New Fork (PID: 6052, Parent: 5845)

wrapper-2.0 (PID: 6052, Parent: 5845, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 6291467 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"

xfce4-panel New Fork (PID: 6053, Parent: 5845)

wrapper-2.0 (PID: 6053, Parent: 5845, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libnotification-plugin.so 10 6291468 notification-plugin "Notification Plugin" "Notification plugin for the Xfce panel"

xfce4-panel New Fork (PID: 6054, Parent: 5845)

wrapper-2.0 (PID: 6054, Parent: 5845, MD5: ac0b8a906f359a8ae102244738682e76) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 6291469 actions "Action Buttons" "Log out, lock or other system actions"

gdm3 New Fork (PID: 5846, Parent: 1400)

Default (PID: 5846, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

xfce4-session New Fork (PID: 5847, Parent: 2984)

xfdesktop (PID: 5847, Parent: 2984, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 260d40b3c-9c6a-4cb1-bbe4-3557725aa528

systemd New Fork (PID: 5851, Parent: 2935)

xfce4-notifyd (PID: 5851, Parent: 2935, MD5: eee956f1b227c1d5031f9c61223255d1) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd

systemd New Fork (PID: 5861, Parent: 2935)

gvfsd (PID: 5861, Parent: 2935, MD5: 1fa32dace8ba066189a8eadd21bb172a) Arguments: /usr/libexec/gvfsd

gvfsd New Fork (PID: 5868, Parent: 5861)

gvfsd New Fork (PID: 5869, Parent: 5868)

gvfsd-fuse (PID: 5869, Parent: 2935, MD5: d18fbf1cbf8eb57b17fac48b7b4be933) Arguments: /usr/libexec/gvfsd-fuse /run/user/1000/gvfs -f -o big_writes

gvfsd-fuse New Fork (PID: 5870, Parent: 5869)

fusermount (PID: 5870, Parent: 5869, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -o rw,nosuid,nodev,subtype=gvfsd-fuse -- /run/user/1000/gvfs

gvfsd New Fork (PID: 6032, Parent: 5861)

gvfsd-trash (PID: 6032, Parent: 5861, MD5: 7bd262bd2ff379d0da45f8595163824d) Arguments: /usr/libexec/gvfsd-trash --spawner :1.64 /org/gtk/gvfs/exec_spaw/0

xfce4-session New Fork (PID: 5883, Parent: 2984)

xfwm4 (PID: 5883, Parent: 2984, MD5: 59defa3c00cc30d85ed77b738d55e9da) Arguments: xfwm4 --display :1.0 --sm-client-id 27575c7dd-2dac-48f0-9f3a-eff67ec043e5

xfce4-session New Fork (PID: 5899, Parent: 2984)

xfdesktop (PID: 5899, Parent: 2984, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 260d40b3c-9c6a-4cb1-bbe4-3557725aa528

dbus-daemon New Fork (PID: 5901, Parent: 5900)

xfconfd (PID: 5901, Parent: 5900, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

systemd New Fork (PID: 5906, Parent: 1)

systemd-user-runtime-dir (PID: 5906, Parent: 1, MD5: d55f4b0847f88131dbcfb07435178e54) Arguments: /lib/systemd/systemd-user-runtime-dir stop 127

xfce4-session New Fork (PID: 5922, Parent: 2984)

xfwm4 (PID: 5922, Parent: 2984, MD5: 59defa3c00cc30d85ed77b738d55e9da) Arguments: xfwm4 --display :1.0 --sm-client-id 27575c7dd-2dac-48f0-9f3a-eff67ec043e5

dbus-daemon New Fork (PID: 5924, Parent: 5923)

tumblerd (PID: 5924, Parent: 5923, MD5: 2ef099898845e9c5ec6f1a6fd3ad61af) Arguments: /usr/lib/x86_64-linux-gnu/tumbler-1/tumblerd

systemd New Fork (PID: 5926, Parent: 2935)

Thunar (PID: 5926, Parent: 2935, MD5: ca35dca6175038f11f012b29178a4f46) Arguments: /usr/bin/Thunar --daemon

systemd New Fork (PID: 5927, Parent: 2935)

gvfs-udisks2-volume-monitor (PID: 5927, Parent: 2935, MD5: 4912ae23684d55062ac889dd671a8ab9) Arguments: /usr/libexec/gvfs-udisks2-volume-monitor

dbus-daemon New Fork (PID: 5936, Parent: 5935)

xfconfd (PID: 5936, Parent: 5935, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

xfce4-session New Fork (PID: 5966, Parent: 2984)

xfwm4 (PID: 5966, Parent: 2984, MD5: 59defa3c00cc30d85ed77b738d55e9da) Arguments: xfwm4 --display :1.0 --sm-client-id 27575c7dd-2dac-48f0-9f3a-eff67ec043e5

systemd New Fork (PID: 5971, Parent: 2935)

gvfs-mtp-volume-monitor (PID: 5971, Parent: 2935, MD5: 4ef31436eba465a14362dfe7e1d42ec3) Arguments: /usr/libexec/gvfs-mtp-volume-monitor

systemd New Fork (PID: 5994, Parent: 2935)

gvfs-goa-volume-monitor (PID: 5994, Parent: 2935, MD5: 1c9b8b8b466cc3b27212ee9c1052a7b2) Arguments: /usr/libexec/gvfs-goa-volume-monitor

dbus-daemon New Fork (PID: 6001, Parent: 6000)

goa-daemon (PID: 6001, Parent: 6000, MD5: f442acdfc6465acfae3f9f0e05cf6fd3) Arguments: /usr/libexec/goa-daemon

dbus-daemon New Fork (PID: 6016, Parent: 6015)

goa-identity-service (PID: 6016, Parent: 6015, MD5: 4e1e45c260caf0e8460ff7494a0e8553) Arguments: /usr/libexec/goa-identity-service

systemd New Fork (PID: 6021, Parent: 2935)

gvfs-afc-volume-monitor (PID: 6021, Parent: 2935, MD5: 724607394f380f47f39e25dd9e1d4825) Arguments: /usr/libexec/gvfs-afc-volume-monitor

systemd New Fork (PID: 6028, Parent: 2935)

gvfs-gphoto2-volume-monitor (PID: 6028, Parent: 2935, MD5: 8773afb2a78946b2c81024ed4c928353) Arguments: /usr/libexec/gvfs-gphoto2-volume-monitor

systemd New Fork (PID: 6044, Parent: 2935)

gvfsd-metadata (PID: 6044, Parent: 2935, MD5: 25b3740bd427cf3225e35be4bb2205aa) Arguments: /usr/libexec/gvfsd-metadata

dbus-daemon New Fork (PID: 6060, Parent: 6059)

xfconfd (PID: 6060, Parent: 6059, MD5: 4c7a0d6d258bb970905b19b84abcd8e9) Arguments: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd

systemd New Fork (PID: 6066, Parent: 1)

accounts-daemon (PID: 6066, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6080, Parent: 6066)

language-validate (PID: 6080, Parent: 6066, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6081, Parent: 6080)

language-options (PID: 6081, Parent: 6080, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6082, Parent: 6081)

sh (PID: 6082, Parent: 6081, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6083, Parent: 6082)

locale (PID: 6083, Parent: 6082, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6084, Parent: 6082)

grep (PID: 6084, Parent: 6082, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
XMRIG		No Attribution	https://www.aquasec.com/blog/container-security-tnt-container-attack/ https://www.aquasec.com/blog/pg_mem-a-malware-hidden-in-the-postgres-processes/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.xmrig

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
hanoi.sh4.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
hanoi.sh4.elf	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
hanoi.sh4.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
hanoi.sh4.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x12eec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1302c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1307c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
hanoi.sh4.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x13444:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64

Memory Dumps

Source	Rule	Description	Author	Strings
5599.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5599.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
5599.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5599.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x12eec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1302c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1307c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5599.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x13444:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5595.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5595.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
5595.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5595.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x12eec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1302c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1307c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5595.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x13444:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5597.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5597.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
5597.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5597.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x12eec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1302c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1307c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5597.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x13444:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
5601.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5601.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
5601.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5601.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x12eec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12fdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12ff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1302c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1307c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5601.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x13444:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: hanoi.sh4.elf PID: 5595	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: hanoi.sh4.elf PID: 5595	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: hanoi.sh4.elf PID: 5595	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: hanoi.sh4.elf PID: 5595	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x85f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8607:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x861b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x862f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8643:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8657:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x866b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x867f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8693:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x86a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x86bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x86cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x86e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x86f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x870b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x871f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8733:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8747:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x875b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x876f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8783:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: hanoi.sh4.elf PID: 5595	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x8ab1:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: hanoi.sh4.elf PID: 5597	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: hanoi.sh4.elf PID: 5597	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: hanoi.sh4.elf PID: 5597	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: hanoi.sh4.elf PID: 5597	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xeb5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeb98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebe8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xebfc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec10:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec24:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec38:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec4c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec60:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec74:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec88:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xec9c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecb0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecc4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xecec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: hanoi.sh4.elf PID: 5597	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xf01a:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: hanoi.sh4.elf PID: 5599	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: hanoi.sh4.elf PID: 5599	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: hanoi.sh4.elf PID: 5599	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: hanoi.sh4.elf PID: 5599	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x8caa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8cbe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8cd2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8ce6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8cfa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8d0e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8d22:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8d36:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8d4a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8d5e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8d72:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8d86:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8d9a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8dae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8dc2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8dd6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8dea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8dfe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8e12:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8e26:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8e3a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: hanoi.sh4.elf PID: 5599	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x9168:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Process Memory Space: hanoi.sh4.elf PID: 5601	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: hanoi.sh4.elf PID: 5601	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: hanoi.sh4.elf PID: 5601	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: hanoi.sh4.elf PID: 5601	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x8989:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x899d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x89b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x89c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x89d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x89ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8a01:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8a15:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8a29:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8a3d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8a51:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8a65:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8a79:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8a8d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8aa1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8ab5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8ac9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8add:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8af1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8b05:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8b19:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: hanoi.sh4.elf PID: 5601	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x8e47:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 35 entries

Joe Sandbox Signatures

• AV Detection
• Bitcoin Miner
• Spreading
• Networking
• System Summary
• Persistence and Installation Behavior
• Malware Analysis System Evasion
• Language, Device and Operating System Detection
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: hanoi.sh4.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: hanoi.sh4.elf	Virustotal: Detection: 62%			Perma Link
Source: hanoi.sh4.elf	ReversingLabs: Detection: 65%

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: hanoi.sh4.elf, type: SAMPLE
Source: Yara match	File source: 5599.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5595.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5597.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5601.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hanoi.sh4.elf PID: 5595, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hanoi.sh4.elf PID: 5597, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hanoi.sh4.elf PID: 5599, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hanoi.sh4.elf PID: 5601, type: MEMORYSTR

Found strings related to Crypto-Mining

Source: hanoi.sh4.elf, 5595.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp

String found in binary or memory: cryptonight

Source: /usr/bin/xfwm4 (PID: 5841)

Reads CPU info from /sys: /sys/devices/system/cpu/online

Jump to behavior

Source: hanoi.sh4.elf

String: systemddbuspolkitNetworkManagergettyavahidhclientwpa_supplicant/usr/lib/systemd//sbin/init/usr/sbin//usr/lib/hanoi/proc/%d/net/tcpr %*d: %*x:%x/proc//proc/%s/exe/proc/self/exe/proc/%s/cmdline/proc/proc/%d/exe/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxhtopvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/systemd-logindsystemd-journaldsystemd-udevddbus-daemonsystemd-resolvedsystemd-timesyncdlogincronrsyslogavahi-daemonsoraboatnetx86_64dbgmipsmpslbot/var/run/malware/var/tmp/./(deleted)mipselarm4arm5arm6arm7sh4m68kx586i586i686ppcspcmiraimuhstikgafgyttsunamikaitenqbotzollardbackdoorrootkitxmrigcryptonightminerdcpuminerbitminerwormpolkitdshcrondfirewalldkthreaddksoftirqd,

Source: global traffic

TCP traffic: 192.168.2.13:49638 -> 103.230.121.85:3778

Source: /usr/libexec/gvfsd-trash (PID: 6032)

Socket: unknown address family

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 103.230.121.85
Source: unknown	TCP traffic detected without corresponding DNS query: 103.230.121.85
Source: unknown	TCP traffic detected without corresponding DNS query: 103.230.121.85
Source: unknown	TCP traffic detected without corresponding DNS query: 103.230.121.85
Source: unknown	TCP traffic detected without corresponding DNS query: 103.230.121.85
Source: unknown	TCP traffic detected without corresponding DNS query: 103.230.121.85
Source: unknown	TCP traffic detected without corresponding DNS query: 103.230.121.85
Source: unknown	TCP traffic detected without corresponding DNS query: 103.230.121.85

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

System Summary

Malicious sample detected (through community Yara rule)

Source: hanoi.sh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: hanoi.sh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5599.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5599.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5595.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5595.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5597.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5597.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5601.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5601.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: hanoi.sh4.elf PID: 5595, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: hanoi.sh4.elf PID: 5595, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: hanoi.sh4.elf PID: 5597, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: hanoi.sh4.elf PID: 5597, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: hanoi.sh4.elf PID: 5599, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: hanoi.sh4.elf PID: 5599, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: hanoi.sh4.elf PID: 5601, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: hanoi.sh4.elf PID: 5601, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 792, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 884, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1444, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1588, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1604, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1745, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1748, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1751, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1755, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1765, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1805, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1847, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1875, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1879, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1881, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1884, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1891, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1906, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1921, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1922, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1925, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1930, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1940, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1944, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1946, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1969, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1982, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 2961, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 2964, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 2984, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3095, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3114, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3117, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3122, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3134, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3146, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3147, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3153, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3158, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3181, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3183, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3185, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3203, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3208, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3209, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3220, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3225, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3300, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3310, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3327, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3336, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3375, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3413, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3420, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3424, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3429, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3434, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3448, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3640, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 5573, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 5627, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 5630, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 5631, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 5632, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 5633, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 5651, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 5675, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 5686, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 3212, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 5597, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 5601, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 5843, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 5851, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 5901, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 5924, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 5936, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 5949, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 5950, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 5967, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 5968, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 5970, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 5998, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 6047, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 6049, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 6051, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 6052, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 6053, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 6054, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 6060, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: systemddbuspolkitNetworkManagergettyavahidhclientwpa_supplicant/usr/lib/systemd//sbin/init/usr/sbin//usr/lib/hanoi/proc/%d/net/tcpr %d: %x:%x/proc//proc/%s/exe/proc/self/exe/proc/%s/cmdline/proc/proc/%d/exe/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxhtopvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/systemd-logindsystemd-journaldsystemd-udevddbus-daemonsystemd-resolvedsystemd-timesyncdlogincronrsyslogavahi-daemonsoraboatnetx86_64dbgmipsmpslbot/var/run/malware/var/tmp/./(deleted)mipselarm4arm5arm6arm7sh4m68kx586i586i686ppcspcmiraimuhstikgafgyttsunamikaitenqbotzollardbackdoorrootkitxmrigcryptoni

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 792, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 884, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1444, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1588, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1604, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1745, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1748, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1751, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1755, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1765, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1805, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1847, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1875, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1879, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1881, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1884, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1891, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1906, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1921, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1922, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1925, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1930, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1940, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1944, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1946, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1969, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 1982, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 2961, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 2964, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 2984, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3095, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3114, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3117, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3122, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3134, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3146, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3147, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3153, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3158, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3181, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3183, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3185, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3203, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3208, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3209, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3220, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3225, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3300, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3310, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3327, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3336, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3375, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3413, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3420, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3424, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3429, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3434, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3448, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 3640, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 5573, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 5627, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 5630, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 5631, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 5632, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 5633, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 5651, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 5675, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	SIGKILL sent: pid: 5686, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 3212, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 5597, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 5601, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 5843, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 5851, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 5901, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 5924, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 5936, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 5949, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 5950, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 5967, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 5968, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 5970, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 5998, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 6047, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 6049, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 6051, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 6052, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 6053, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 6054, result: successful	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5598)	SIGKILL sent: pid: 6060, result: successful	Jump to behavior

Source: hanoi.sh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: hanoi.sh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5599.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5599.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5595.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5595.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5597.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5597.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5601.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5601.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: hanoi.sh4.elf PID: 5595, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: hanoi.sh4.elf PID: 5595, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: hanoi.sh4.elf PID: 5597, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: hanoi.sh4.elf PID: 5597, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: hanoi.sh4.elf PID: 5599, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: hanoi.sh4.elf PID: 5599, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: hanoi.sh4.elf PID: 5601, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: hanoi.sh4.elf PID: 5601, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.mine.linELF@0/7@2/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /bin/fusermount (PID: 5648)	File: /proc/5648/mounts			Jump to behavior
Source: /bin/fusermount (PID: 5870)	File: /proc/5870/mounts			Jump to behavior

Source: /usr/libexec/gsd-wacom (PID: 5627)	Directory: /var/lib/gdm3/.Xdefaults	Jump to behavior
Source: /usr/libexec/gsd-wacom (PID: 5627)	Directory: /var/lib/gdm3/.Xdefaults-galassia	Jump to behavior
Source: /usr/libexec/gsd-color (PID: 5630)	Directory: /var/lib/gdm3/.Xdefaults	Jump to behavior
Source: /usr/libexec/gsd-color (PID: 5630)	Directory: /var/lib/gdm3/.Xdefaults-galassia	Jump to behavior
Source: /usr/libexec/gsd-keyboard (PID: 5631)	Directory: /var/lib/gdm3/.Xdefaults	Jump to behavior
Source: /usr/libexec/gsd-keyboard (PID: 5631)	Directory: /var/lib/gdm3/.Xdefaults-galassia	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 5633)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 5633)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 5636)	Directory: /var/lib/gdm3/.Xdefaults	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 5636)	Directory: /var/lib/gdm3/.Xdefaults-galassia	Jump to behavior
Source: /usr/libexec/gsd-power (PID: 5645)	Directory: /var/lib/gdm3/.Xdefaults	Jump to behavior
Source: /usr/libexec/gsd-power (PID: 5645)	Directory: /var/lib/gdm3/.Xdefaults-galassia	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 5688)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /home/saturnino/.drirc	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5843)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5843)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5843)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5843)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5949)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5950)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5967)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5968)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5970)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /home/saturnino/.hidden	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /.hidden	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /home/.hidden	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5851)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5851)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5851)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5851)	Directory: /home/saturnino/.config	Jump to behavior
Source: /bin/fusermount (PID: 5870)	Directory: /gvfs/.	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5899)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5901)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5901)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5901)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5901)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/ttf-khmeros-core/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/truetype/ubuntu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/type1/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /usr/share/fonts/X11/encodings/large/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/bin/Thunar (PID: 5926)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/Thunar (PID: 5926)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/bin/Thunar (PID: 5926)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/bin/Thunar (PID: 5926)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5936)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5936)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5936)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5936)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/droid/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/fonts-beng-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/fonts-deva-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/fonts-gujr-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/fonts-guru-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/fonts-kalapi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/fonts-orya-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/fonts-telu-extra/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/fonts-yrsa-rasa/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/freefont/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/kacst/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/kacst-one/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/lao/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/lato/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/liberation/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/liberation2/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/lohit-assamese/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/lohit-bengali/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/lohit-devanagari/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/lohit-gujarati/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/lohit-kannada/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/lohit-malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/lohit-oriya/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/lohit-punjabi/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/lohit-tamil/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/lohit-tamil-classical/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/lohit-telugu/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/malayalam/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/noto/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/openoffice/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/padauk/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/pagul/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/samyak/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/samyak-fonts/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/sinhala/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/tibetan-machine/.uuid	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Directory: /usr/share/fonts/truetype/tlwg/.uuid	Jump to behavior

Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3640/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3640/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3122/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3122/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3117/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3117/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3114/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3114/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/5431/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/5675/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/5675/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3134/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3134/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3375/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3375/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3132/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3132/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3095/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1866/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1745/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1745/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1588/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/884/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/884/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1982/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1982/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/765/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3246/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/767/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1906/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1906/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1748/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1748/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/5686/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/5686/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3420/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1482/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1480/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1755/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1755/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1875/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1875/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/2964/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/2964/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3413/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3413/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1751/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1751/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1872/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1872/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/2961/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/2961/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/778/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/816/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1879/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1879/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/5572/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/5573/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/5573/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1891/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1891/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3310/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3153/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3153/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/780/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/660/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1921/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1921/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/5607/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/5608/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/783/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1765/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1765/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/5609/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/2974/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1400/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1884/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1884/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3424/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3424/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/2972/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3147/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3147/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/2970/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1881/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/1881/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3146/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3146/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3300/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/3300/net/tcp	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/5688/cmdline	Jump to behavior
Source: /tmp/hanoi.sh4.elf (PID: 5597)	File opened: /proc/5601/cmdline	Jump to behavior

Source: /usr/share/language-tools/language-options (PID: 6082)

Shell command executed: sh -c "locale -a | grep -F .utf8 "

Source: /bin/sh (PID: 6084)

Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/bin/xfce4-session (PID: 5681)

Rm executable: /usr/bin/rm -> rm -f /home/saturnino/.cache/sessions/Thunar-2ec7c2e14-9c4d-40f3-9704-8617ab831fb4

Jump to behavior

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6066)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6066)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/bin/xfwm4 (PID: 5841)

Reads CPU info from /sys: /sys/devices/system/cpu/online

Jump to behavior

Source: /tmp/hanoi.sh4.elf (PID: 5595)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gsd-wacom (PID: 5627)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gsd-color (PID: 5630)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gsd-keyboard (PID: 5631)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gsd-smartcard (PID: 5634)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gsd-media-keys (PID: 5636)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/libexec/gsd-power (PID: 5645)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5651)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 5688)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5841)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfce4-panel (PID: 5845)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5949)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5950)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5967)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5968)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5970)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5847)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5851)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5883)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5899)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5922)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/Thunar (PID: 5926)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfwm4 (PID: 5966)	Queries kernel information via 'uname':	Jump to behavior

Source: hanoi.sh4.elf, 5595.1.00007ffe5b007000.00007ffe5b028000.rw-.sdmp, hanoi.sh4.elf, 5597.1.00007ffe5b007000.00007ffe5b028000.rw-.sdmp, hanoi.sh4.elf, 5599.1.00007ffe5b007000.00007ffe5b028000.rw-.sdmp, hanoi.sh4.elf, 5601.1.00007ffe5b007000.00007ffe5b028000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: hanoi.sh4.elf, 5595.1.00007ffe5b007000.00007ffe5b028000.rw-.sdmp, hanoi.sh4.elf, 5597.1.00007ffe5b007000.00007ffe5b028000.rw-.sdmp, hanoi.sh4.elf, 5599.1.00007ffe5b007000.00007ffe5b028000.rw-.sdmp, hanoi.sh4.elf, 5601.1.00007ffe5b007000.00007ffe5b028000.rw-.sdmp	Binary or memory string: 8x86_64/usr/bin/qemu-sh4/tmp/hanoi.sh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/hanoi.sh4.elf
Source: hanoi.sh4.elf, 5595.1.00005616561fd000.0000561656260000.rw-.sdmp, hanoi.sh4.elf, 5597.1.00005616561fd000.0000561656260000.rw-.sdmp, hanoi.sh4.elf, 5599.1.00005616561fd000.0000561656260000.rw-.sdmp, hanoi.sh4.elf, 5601.1.00005616561fd000.0000561656260000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4
Source: hanoi.sh4.elf, 5595.1.00005616561fd000.0000561656260000.rw-.sdmp, hanoi.sh4.elf, 5597.1.00005616561fd000.0000561656260000.rw-.sdmp, hanoi.sh4.elf, 5599.1.00005616561fd000.0000561656260000.rw-.sdmp, hanoi.sh4.elf, 5601.1.00005616561fd000.0000561656260000.rw-.sdmp	Binary or memory string: V5!/etc/qemu-binfmt/sh4

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6066)

Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: hanoi.sh4.elf, type: SAMPLE
Source: Yara match	File source: 5599.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5595.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5597.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5601.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hanoi.sh4.elf PID: 5595, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hanoi.sh4.elf PID: 5597, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hanoi.sh4.elf PID: 5599, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hanoi.sh4.elf PID: 5601, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: hanoi.sh4.elf, type: SAMPLE
Source: Yara match	File source: 5599.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5595.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5597.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5601.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hanoi.sh4.elf PID: 5595, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hanoi.sh4.elf PID: 5597, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hanoi.sh4.elf PID: 5599, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hanoi.sh4.elf PID: 5601, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: hanoi.sh4.elf, type: SAMPLE
Source: Yara match	File source: 5599.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5595.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5597.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5601.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hanoi.sh4.elf PID: 5595, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hanoi.sh4.elf PID: 5597, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hanoi.sh4.elf PID: 5599, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hanoi.sh4.elf PID: 5601, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: hanoi.sh4.elf, type: SAMPLE
Source: Yara match	File source: 5599.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5595.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5597.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5601.1.00007f5ec4400000.00007f5ec4415000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hanoi.sh4.elf PID: 5595, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hanoi.sh4.elf PID: 5597, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hanoi.sh4.elf PID: 5599, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hanoi.sh4.elf PID: 5601, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Hidden Files and Directories	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
hanoi.sh4.elf	62%	Virustotal		Browse
hanoi.sh4.elf	66%	ReversingLabs	Linux.Trojan.Mirai
hanoi.sh4.elf	100%	Avira	EXP/ELF.Gafgyt.D

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
103.230.121.85	unknown	Hong Kong		62468	VPSQUANUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
103.230.121.85	hanoi.m68k.elf	Get hash	malicious	Mirai, Okiru, Xmrig	Browse
103.230.121.85	hanoi.x86_64.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	resgod.arm5.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	resgod.x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	resgod.arm.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	resgod.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	sora.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	sora.m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	sora.x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	ub8ehJSePAfc9FYqZIT6.spc.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	jfeeps.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VPSQUANUS	hanoi.m68k.elf	Get hash	malicious	Mirai, Okiru, Xmrig	Browse	103.230.121.85
	hanoi.x86_64.elf	Get hash	malicious	Unknown	Browse	103.230.121.85
	nabppc.elf	Get hash	malicious	Unknown	Browse	23.251.46.113
	morte.x86.elf	Get hash	malicious	Unknown	Browse	103.239.72.22
	YrRZnrf2lC.exe	Get hash	malicious	Unknown	Browse	154.222.224.99
	YrRZnrf2lC.exe	Get hash	malicious	Unknown	Browse	154.222.224.99
	nklmips.elf	Get hash	malicious	Unknown	Browse	103.252.19.50
	http://midasbuypubg.myiphost.com/	Get hash	malicious	Unknown	Browse	107.151.250.70
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	107.151.229.189
	O8QAjYEai7.exe	Get hash	malicious	Unknown	Browse	156.224.26.29

Process:	/usr/libexec/goa-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.

/run/user/127/dconf/user

Download File

Process:	/usr/libexec/gsd-housekeeping
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	.

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.752500677742352
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	hanoi.sh4.elf
File size:	87'260 bytes
MD5:	a6d7691e700f2907e5f2ec5df85404d9
SHA1:	d0464b01799bb8b81912dfb6d02f31f9d69a1432
SHA256:	77901d6bd4cfa884b42ab837e3c2e60fb0a73a2f38de4dbc27a4534a196aabc1
SHA512:	70214eb466a7479b932f9a8233730bfff5c29992779af7caa578099208fcb19f76cae557ce531ca5cc4d09d61750d5e60c50b24a11e4307e3f464bdc85d33af9
SSDEEP:	1536:fzm8jNG4ipRw3i9I1ZHZn+BrhVDiw7edr:fzm8jNG48RvSN4Ht7eh
TLSH:	14839F36F0142CE1C46314B8F4BCCE780B12ACE452E52C726FDEC9A558E76AAB54DF58
File Content Preview:	.ELF.....................@.4...LS......4. ...(...............@...@..N...N...............P...PB..PB.0...............Q.td..............................././"O.n......#.@........#.*@.-..&O.n.l..................................././.../.a"O.!...n...a.b("...q.

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0xc
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	86860
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x2e	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0x12de0	0x0	0x6	AX	32
.fini	PROGBITS	0x412ec0	0x12ec0	0x22	0x0	0x6	AX	4
.rodata	PROGBITS	0x412ee4	0x12ee4	0x1ff0	0x0	0x2	A	4
.ctors	PROGBITS	0x4250dc	0x150dc	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x4250e4	0x150e4	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x4250f0	0x150f0	0x21c	0x0	0x3	WA	4
.bss	NOBITS	0x42530c	0x1530c	0x770	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x1530c	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x14ed4	0x14ed4	6.7896	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x150dc	0x4250dc	0x4250dc	0x230	0x9a0	4.1408	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 27, 2025 01:00:02.681849957 CET	49638	3778	192.168.2.13	103.230.121.85
Mar 27, 2025 01:00:03.018085957 CET	3778	49638	103.230.121.85	192.168.2.13
Mar 27, 2025 01:00:03.018203974 CET	49638	3778	192.168.2.13	103.230.121.85
Mar 27, 2025 01:00:03.020402908 CET	49638	3778	192.168.2.13	103.230.121.85
Mar 27, 2025 01:00:03.356034994 CET	3778	49638	103.230.121.85	192.168.2.13
Mar 27, 2025 01:00:03.356108904 CET	49638	3778	192.168.2.13	103.230.121.85
Mar 27, 2025 01:00:03.692363024 CET	3778	49638	103.230.121.85	192.168.2.13
Mar 27, 2025 01:00:13.031886101 CET	49638	3778	192.168.2.13	103.230.121.85
Mar 27, 2025 01:00:13.365628958 CET	3778	49638	103.230.121.85	192.168.2.13
Mar 27, 2025 01:00:13.365660906 CET	3778	49638	103.230.121.85	192.168.2.13
Mar 27, 2025 01:00:13.365894079 CET	49638	3778	192.168.2.13	103.230.121.85
Mar 27, 2025 01:00:14.492965937 CET	49638	3778	192.168.2.13	103.230.121.85
Mar 27, 2025 01:00:14.829246998 CET	3778	49638	103.230.121.85	192.168.2.13
Mar 27, 2025 01:00:14.829368114 CET	49638	3778	192.168.2.13	103.230.121.85
Mar 27, 2025 01:02:47.207587004 CET	34822	53	192.168.2.13	8.8.8.8
Mar 27, 2025 01:02:47.290549994 CET	53	34822	8.8.8.8	192.168.2.13
Mar 27, 2025 01:02:47.290618896 CET	34822	53	192.168.2.13	8.8.8.8
Mar 27, 2025 01:02:47.290669918 CET	34822	53	192.168.2.13	8.8.8.8
Mar 27, 2025 01:02:47.290669918 CET	34822	53	192.168.2.13	8.8.8.8
Mar 27, 2025 01:02:47.374344110 CET	53	34822	8.8.8.8	192.168.2.13
Mar 27, 2025 01:02:47.374373913 CET	53	34822	8.8.8.8	192.168.2.13
Mar 27, 2025 01:02:47.374434948 CET	53	34822	8.8.8.8	192.168.2.13
Mar 27, 2025 01:02:47.374453068 CET	53	34822	8.8.8.8	192.168.2.13
Mar 27, 2025 01:02:47.374496937 CET	34822	53	192.168.2.13	8.8.8.8
Mar 27, 2025 01:02:47.374497890 CET	34822	53	192.168.2.13	8.8.8.8
Mar 27, 2025 01:02:49.375998974 CET	53	34822	8.8.8.8	192.168.2.13
Mar 27, 2025 01:02:49.377887964 CET	34822	53	192.168.2.13	8.8.8.8
Mar 27, 2025 01:02:49.460757971 CET	53	34822	8.8.8.8	192.168.2.13

Start time (UTC):	00:00:01
Start date (UTC):	27/03/2025
Path:	/tmp/hanoi.sh4.elf
Arguments:	/tmp/hanoi.sh4.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	00:00:02
Start date (UTC):	27/03/2025
Path:	/usr/libexec/gsd-color
Arguments:	/usr/libexec/gsd-color
File size:	92832 bytes
MD5 hash:	ac2861ad93ce047283e8e87cefef9a19

Start time (UTC):	00:00:09
Start date (UTC):	27/03/2025
Path:	/usr/libexec/gsd-print-notifications
Arguments:	-
File size:	51840 bytes
MD5 hash:	71539698aa691718cee775d6b9450ae2

Start time (UTC):	00:00:10
Start date (UTC):	27/03/2025
Path:	/usr/libexec/gsd-printer
Arguments:	/usr/libexec/gsd-printer
File size:	31120 bytes
MD5 hash:	7995828cf98c315fd55f2ffb3b22384d

Start time (UTC):	00:00:03
Start date (UTC):	27/03/2025
Path:	/usr/libexec/gsd-screensaver-proxy
Arguments:	/usr/libexec/gsd-screensaver-proxy
File size:	27232 bytes
MD5 hash:	77e309450c87dceee43f1a9e50cc0d02

Start time (UTC):	00:00:04
Start date (UTC):	27/03/2025
Path:	/usr/libexec/gsd-power
Arguments:	/usr/libexec/gsd-power
File size:	88672 bytes
MD5 hash:	28b8e1b43c3e7f1db6741ea1ecd978b7

Start time (UTC):	00:00:06
Start date (UTC):	27/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	xfce4-panel --display :1.0 --sm-client-id 2d6b1caf2-8023-452b-bd0d-d23295482740
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	00:00:08
Start date (UTC):	27/03/2025
Path:	/usr/bin/xfdesktop
Arguments:	xfdesktop --display :1.0 --sm-client-id 260d40b3c-9c6a-4cb1-bbe4-3557725aa528
File size:	473520 bytes
MD5 hash:	dfb13e1581f80065dcea16f2476f16f2

Start time (UTC):	00:00:07
Start date (UTC):	27/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	00:00:12
Start date (UTC):	27/03/2025
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time (UTC):	00:00:13
Start date (UTC):	27/03/2025
Path:	/usr/bin/xfwm4
Arguments:	xfwm4 --display :1.0 --sm-client-id 27575c7dd-2dac-48f0-9f3a-eff67ec043e5
File size:	420424 bytes
MD5 hash:	59defa3c00cc30d85ed77b738d55e9da

Start time (UTC):	00:00:35
Start date (UTC):	27/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	00:00:38
Start date (UTC):	27/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	00:00:39
Start date (UTC):	27/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	00:00:42
Start date (UTC):	27/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report hanoi.sh4.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/run/user/1000/dconf/user

/run/user/127/dconf/user

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: hanoi.sh4.elf PID: 5595, Parent PID: 5514

General

File Activities

File Opened

File Read

Process Activities

Process Forked

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Linux Analysis Report
hanoi.sh4.elf

Start time (UTC):	00:01:00
Start date (UTC):	27/03/2025
Path:	/usr/bin/xfce4-panel
Arguments:	-
File size:	375768 bytes
MD5 hash:	a15b657c7d54ac1385f1f15004ea6784

Start time (UTC):	00:01:01
Start date (UTC):	27/03/2025
Path:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0
Arguments:	/usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libxfce4powermanager.so 9 6291467 power-manager-plugin "Power Manager Plugin" "Display the battery levels of your devices and control the brightness of your display"
File size:	35136 bytes
MD5 hash:	ac0b8a906f359a8ae102244738682e76

Start time (UTC):	00:00:17
Start date (UTC):	27/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	00:00:19
Start date (UTC):	27/03/2025
Path:	/usr/libexec/gvfsd
Arguments:	-
File size:	39224 bytes
MD5 hash:	1fa32dace8ba066189a8eadd21bb172a

Start time (UTC):	00:00:56
Start date (UTC):	27/03/2025
Path:	/usr/libexec/gvfsd
Arguments:	-
File size:	39224 bytes
MD5 hash:	1fa32dace8ba066189a8eadd21bb172a

Start time (UTC):	00:00:21
Start date (UTC):	27/03/2025
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time (UTC):	00:00:23
Start date (UTC):	27/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	00:00:29
Start date (UTC):	27/03/2025
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time (UTC):	00:00:31
Start date (UTC):	27/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	00:00:32
Start date (UTC):	27/03/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75