Joe Sandbox Cloud Basic Analysis Report
Create Interactive Tour

Linux Analysis Report
xd.x86.elf

Overview

General Information

Sample name:xd.x86.elf
Analysis ID:1655033
MD5:5e4a544bfb8cfb31f89e915eb339ded5
SHA1:690a965ee7207bcf2b5454e1241e7a0c056da634
SHA256:f947f7b2f43f39a5ba5b7053c12d4e3b8f9315ef17d26af7c9b0f449391fc4e8
Tags:elfuser-abuse_ch
Infos:

Detection

Mirai
Score:88
Range:0 - 100

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Mirai
Sample deletes itself
Sample is packed with UPX
Sample reads /proc/mounts (often used for finding a writable filesystem)
Sample tries to kill multiple processes (SIGKILL)
Deletes log files
Detected TCP or UDP traffic on non-standard ports
ELF contains segments with high entropy indicating compressed/encrypted content
Enumerates processes within the "proc" file system
Executes commands using a shell command-line interpreter
Executes the "grep" command used to find patterns in files or piped streams
Executes the "kill" or "pkill" command typically used to terminate processes
Reads CPU information from /sys indicative of miner or evasive malware
Sample contains only a LOAD segment without any section mappings
Sample tries to kill a process (SIGKILL)
Sample tries to set the executable flag
Uses the "uname" system call to query kernel version information (possible evasion)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1655033
Start date and time:2025-04-02 21:57:30 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 28s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:xd.x86.elf
Detection:MAL
Classification:mal88.spre.troj.evad.linELF@0/16@0/0
  • Connection to analysis system has been lost, crash info: Unknown

Process Tree

  • system is lnxubuntu20
  • xd.x86.elf (PID: 5428, Parent: 5355, MD5: 5e4a544bfb8cfb31f89e915eb339ded5) Arguments: /tmp/xd.x86.elf
  • systemd New Fork (PID: 5448, Parent: 1)
  • journalctl (PID: 5448, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var
  • systemd New Fork (PID: 5463, Parent: 1)
  • systemd New Fork (PID: 5465, Parent: 1)
  • systemd New Fork (PID: 5466, Parent: 1)
  • systemd New Fork (PID: 5467, Parent: 1)
  • systemd New Fork (PID: 5468, Parent: 1)
  • systemd New Fork (PID: 5505, Parent: 1)
  • systemd New Fork (PID: 5523, Parent: 1)
  • systemd New Fork (PID: 5524, Parent: 1)
  • systemd New Fork (PID: 5525, Parent: 1)
  • systemd New Fork (PID: 5526, Parent: 1)
  • systemd New Fork (PID: 5527, Parent: 1)
  • systemd New Fork (PID: 5528, Parent: 1)
  • systemd New Fork (PID: 5529, Parent: 2935)
  • pulseaudio (PID: 5529, Parent: 2935, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal
  • systemd New Fork (PID: 5530, Parent: 1)
  • gdm3 New Fork (PID: 5531, Parent: 1400)
  • Default (PID: 5531, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default
  • gdm3 New Fork (PID: 5532, Parent: 1400)
  • Default (PID: 5532, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default
  • gdm3 New Fork (PID: 5533, Parent: 1400)
  • Default (PID: 5533, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default
  • systemd New Fork (PID: 5534, Parent: 1)
  • systemd New Fork (PID: 5536, Parent: 1)
  • systemd New Fork (PID: 5538, Parent: 1)
  • gpu-manager (PID: 5538, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log
    • sh (PID: 5539, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"
      • sh New Fork (PID: 5540, Parent: 5539)
      • grep (PID: 5540, Parent: 5539, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
    • sh (PID: 5541, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"
      • sh New Fork (PID: 5542, Parent: 5541)
      • grep (PID: 5542, Parent: 5541, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
    • sh (PID: 5543, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"
      • sh New Fork (PID: 5544, Parent: 5543)
      • grep (PID: 5544, Parent: 5543, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
    • sh (PID: 5545, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"
      • sh New Fork (PID: 5546, Parent: 5545)
      • grep (PID: 5546, Parent: 5545, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
    • sh (PID: 5547, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"
      • sh New Fork (PID: 5548, Parent: 5547)
      • grep (PID: 5548, Parent: 5547, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
    • sh (PID: 5549, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"
      • sh New Fork (PID: 5550, Parent: 5549)
      • grep (PID: 5550, Parent: 5549, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
    • sh (PID: 5551, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"
      • sh New Fork (PID: 5552, Parent: 5551)
      • grep (PID: 5552, Parent: 5551, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
    • sh (PID: 5553, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"
      • sh New Fork (PID: 5554, Parent: 5553)
      • grep (PID: 5554, Parent: 5553, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
  • generate-config (PID: 5555, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config
    • pkill (PID: 5556, Parent: 5555, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service
  • gdm-wait-for-drm (PID: 5557, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm
  • fusermount (PID: 5558, Parent: 3122, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs
  • gdm3 (PID: 5562, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3
  • gpu-manager (PID: 5589, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log
  • gpu-manager (PID: 5599, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log
  • gpu-manager (PID: 5609, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log
  • gpu-manager (PID: 5619, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log
  • gpu-manager (PID: 5629, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log
  • plymouth (PID: 5639, Parent: 1, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: /bin/plymouth quit
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
5432.1.0000000008048000.0000000008058000.r-x.sdmpJoeSecurity_Mirai_9Yara detected MiraiJoe Security
    5432.1.0000000008048000.0000000008058000.r-x.sdmpJoeSecurity_Mirai_8Yara detected MiraiJoe Security
      5432.1.0000000008048000.0000000008058000.r-x.sdmpLinux_Trojan_Gafgyt_28a2fe0cunknownunknown
      • 0xdee4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xdef8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xdf0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xdf20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xdf34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xdf48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xdf5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xdf70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xdf84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xdf98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xdfac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xdfc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xdfd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xdfe8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xdffc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xe010:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xe024:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xe038:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xe04c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xe060:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      • 0xe074:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
      5432.1.0000000008048000.0000000008058000.r-x.sdmpLinux_Trojan_Gafgyt_ea92cca8unknownunknown
      • 0xde94:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
      5432.1.0000000008048000.0000000008058000.r-x.sdmpLinux_Trojan_Mirai_fa3ad9d0unknownunknown
      • 0x46a:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
      Click to see the 115 entries

      Suricata Signatures

      ⊘No Suricata rule has matched

      Joe Sandbox Signatures

      • • AV Detection
      • • Bitcoin Miner
      • • Networking
      • • System Summary
      • • Data Obfuscation
      • • Persistence and Installation Behavior
      • • Hooking and other Techniques for Hiding and Protection
      • • Malware Analysis System Evasion
      • • Stealing of Sensitive Information
      • • Remote Access Functionality

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Source: xd.x86.elfReversingLabs: Detection: 50%
      Source: /usr/bin/pulseaudio (PID: 5529)Reads CPU info from /sys: /sys/devices/system/cpu/onlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)Reads CPU info from /sys: /sys/devices/system/cpu/onlineJump to behavior
      Source: global trafficTCP traffic: 192.168.2.13:52640 -> 213.209.129.92:7887
      Source: unknownTCP traffic detected without corresponding DNS query: 213.209.129.92
      Source: unknownTCP traffic detected without corresponding DNS query: 85.13.167.129
      Source: unknownTCP traffic detected without corresponding DNS query: 89.70.172.129
      Source: unknownTCP traffic detected without corresponding DNS query: 186.104.136.97
      Source: unknownTCP traffic detected without corresponding DNS query: 183.86.70.147
      Source: unknownTCP traffic detected without corresponding DNS query: 195.239.104.238
      Source: unknownTCP traffic detected without corresponding DNS query: 171.81.85.175
      Source: unknownTCP traffic detected without corresponding DNS query: 78.252.172.4
      Source: unknownTCP traffic detected without corresponding DNS query: 42.150.109.49
      Source: unknownTCP traffic detected without corresponding DNS query: 153.139.76.158
      Source: unknownTCP traffic detected without corresponding DNS query: 39.98.190.239
      Source: unknownTCP traffic detected without corresponding DNS query: 81.114.130.249
      Source: unknownTCP traffic detected without corresponding DNS query: 179.235.130.92
      Source: unknownTCP traffic detected without corresponding DNS query: 81.63.252.112
      Source: unknownTCP traffic detected without corresponding DNS query: 115.215.194.210
      Source: unknownTCP traffic detected without corresponding DNS query: 84.124.80.210
      Source: unknownTCP traffic detected without corresponding DNS query: 108.183.236.177
      Source: unknownTCP traffic detected without corresponding DNS query: 14.206.54.147
      Source: unknownTCP traffic detected without corresponding DNS query: 41.40.78.56
      Source: unknownTCP traffic detected without corresponding DNS query: 111.113.79.50
      Source: unknownTCP traffic detected without corresponding DNS query: 144.18.120.20
      Source: unknownTCP traffic detected without corresponding DNS query: 67.30.93.151
      Source: unknownTCP traffic detected without corresponding DNS query: 12.208.73.139
      Source: unknownTCP traffic detected without corresponding DNS query: 241.21.253.186
      Source: unknownTCP traffic detected without corresponding DNS query: 122.117.222.135
      Source: unknownTCP traffic detected without corresponding DNS query: 91.90.73.28
      Source: unknownTCP traffic detected without corresponding DNS query: 86.104.115.172
      Source: unknownTCP traffic detected without corresponding DNS query: 160.195.215.223
      Source: unknownTCP traffic detected without corresponding DNS query: 86.123.155.72
      Source: unknownTCP traffic detected without corresponding DNS query: 216.40.200.22
      Source: unknownTCP traffic detected without corresponding DNS query: 46.9.184.211
      Source: unknownTCP traffic detected without corresponding DNS query: 182.116.16.62
      Source: unknownTCP traffic detected without corresponding DNS query: 27.22.152.239
      Source: unknownTCP traffic detected without corresponding DNS query: 221.108.187.132
      Source: unknownTCP traffic detected without corresponding DNS query: 251.205.142.226
      Source: unknownTCP traffic detected without corresponding DNS query: 148.213.231.57
      Source: unknownTCP traffic detected without corresponding DNS query: 223.167.19.106
      Source: unknownTCP traffic detected without corresponding DNS query: 111.251.20.81
      Source: unknownTCP traffic detected without corresponding DNS query: 83.9.84.237
      Source: unknownTCP traffic detected without corresponding DNS query: 107.128.57.24
      Source: unknownTCP traffic detected without corresponding DNS query: 222.150.36.28
      Source: unknownTCP traffic detected without corresponding DNS query: 92.16.80.111
      Source: unknownTCP traffic detected without corresponding DNS query: 102.72.134.183
      Source: unknownTCP traffic detected without corresponding DNS query: 119.179.159.86
      Source: unknownTCP traffic detected without corresponding DNS query: 191.213.218.212
      Source: unknownTCP traffic detected without corresponding DNS query: 124.195.104.178
      Source: unknownTCP traffic detected without corresponding DNS query: 86.225.14.152
      Source: unknownTCP traffic detected without corresponding DNS query: 136.129.242.17
      Source: unknownTCP traffic detected without corresponding DNS query: 69.253.3.225
      Source: unknownTCP traffic detected without corresponding DNS query: 202.103.60.182
      Source: xd.x86.elfString found in binary or memory: http://upx.sf.net

      System Summary

      barindex
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f Author: unknown
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f Author: unknown
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f Author: unknown
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f Author: unknown
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f Author: unknown
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f Author: unknown
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Detects Mirai Botnet Malware Author: Florian Roth
      Source: Process Memory Space: xd.x86.elf PID: 5428, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: Process Memory Space: xd.x86.elf PID: 5428, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: Process Memory Space: xd.x86.elf PID: 5430, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: Process Memory Space: xd.x86.elf PID: 5430, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: Process Memory Space: xd.x86.elf PID: 5431, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: Process Memory Space: xd.x86.elf PID: 5431, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: Process Memory Space: xd.x86.elf PID: 5432, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: Process Memory Space: xd.x86.elf PID: 5432, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: Process Memory Space: xd.x86.elf PID: 5433, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: Process Memory Space: xd.x86.elf PID: 5433, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: Process Memory Space: xd.x86.elf PID: 5434, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
      Source: Process Memory Space: xd.x86.elf PID: 5434, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 936, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 490, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 660, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 726, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 727, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 765, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 767, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 778, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 780, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 783, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 790, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 792, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 793, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 795, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 800, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 1410, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 1411, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 1432, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 2935, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 2936, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 2970, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 3069, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 3132, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 5272, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 5413, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 5414, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 5529, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 5562, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5431)SIGKILL sent: pid: -5431, result: unknownJump to behavior
      Source: LOAD without section mappingsProgram segment: 0xc01000
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 936, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 490, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 660, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 726, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 727, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 765, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 767, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 778, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 780, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 783, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 790, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 792, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 793, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 795, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 800, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 1410, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 1411, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 1432, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 2935, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 2936, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 2970, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 3069, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 3132, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 5272, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 5413, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 5414, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 5529, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)SIGKILL sent: pid: 5562, result: successfulJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5431)SIGKILL sent: pid: -5431, result: unknownJump to behavior
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
      Source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
      Source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
      Source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
      Source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
      Source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
      Source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORYMatched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
      Source: Process Memory Space: xd.x86.elf PID: 5428, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: Process Memory Space: xd.x86.elf PID: 5428, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: Process Memory Space: xd.x86.elf PID: 5430, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: Process Memory Space: xd.x86.elf PID: 5430, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: Process Memory Space: xd.x86.elf PID: 5431, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: Process Memory Space: xd.x86.elf PID: 5431, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: Process Memory Space: xd.x86.elf PID: 5432, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: Process Memory Space: xd.x86.elf PID: 5432, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: Process Memory Space: xd.x86.elf PID: 5433, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: Process Memory Space: xd.x86.elf PID: 5433, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: Process Memory Space: xd.x86.elf PID: 5434, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
      Source: Process Memory Space: xd.x86.elf PID: 5434, type: MEMORYSTRMatched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
      Source: classification engineClassification label: mal88.spre.troj.evad.linELF@0/16@0/0

      Data Obfuscation

      barindex
      Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
      Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
      Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

      Persistence and Installation Behavior

      barindex
      Source: /bin/fusermount (PID: 5558)File: /proc/5558/mountsJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/230/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/230/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/110/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/110/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/231/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/231/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/111/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/111/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/232/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/232/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/112/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/112/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/233/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/233/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/113/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/113/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/234/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/234/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/114/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/114/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/235/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/235/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/115/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/115/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/236/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/236/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/116/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/116/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/237/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/237/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/117/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/117/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/238/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/238/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/118/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/118/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/239/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/239/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/119/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/119/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/10/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/10/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/11/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/11/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/5272/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/5272/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/12/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/12/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/13/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/13/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/14/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/14/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/15/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/15/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/16/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/16/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/17/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/17/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/18/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/18/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/19/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/19/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/240/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/240/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/3095/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/3095/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/120/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/120/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/241/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/241/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/121/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/121/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/242/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/242/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/1/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/1/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/122/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/122/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/243/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/243/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/2/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/2/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/123/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/123/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/244/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/244/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/3/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/3/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/124/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/124/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/245/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/245/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/125/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/125/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/4/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/4/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/246/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/246/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/126/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/126/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/5/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/5/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/247/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/247/cmdlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/127/statusJump to behavior
      Source: /usr/bin/pkill (PID: 5556)File opened: /proc/127/cmdlineJump to behavior
      Source: /usr/bin/gpu-manager (PID: 5539)Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"Jump to behavior
      Source: /usr/bin/gpu-manager (PID: 5541)Shell command executed: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"Jump to behavior
      Source: /usr/bin/gpu-manager (PID: 5543)Shell command executed: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"Jump to behavior
      Source: /usr/bin/gpu-manager (PID: 5545)Shell command executed: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"Jump to behavior
      Source: /usr/bin/gpu-manager (PID: 5547)Shell command executed: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"Jump to behavior
      Source: /usr/bin/gpu-manager (PID: 5549)Shell command executed: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"Jump to behavior
      Source: /usr/bin/gpu-manager (PID: 5551)Shell command executed: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"Jump to behavior
      Source: /usr/bin/gpu-manager (PID: 5553)Shell command executed: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"Jump to behavior
      Source: /bin/sh (PID: 5540)Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.confJump to behavior
      Source: /bin/sh (PID: 5542)Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.confJump to behavior
      Source: /bin/sh (PID: 5544)Grep executable: /usr/bin/grep -> grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.confJump to behavior
      Source: /bin/sh (PID: 5546)Grep executable: /usr/bin/grep -> grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.confJump to behavior
      Source: /bin/sh (PID: 5548)Grep executable: /usr/bin/grep -> grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.confJump to behavior
      Source: /bin/sh (PID: 5550)Grep executable: /usr/bin/grep -> grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.confJump to behavior
      Source: /bin/sh (PID: 5552)Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.confJump to behavior
      Source: /bin/sh (PID: 5554)Grep executable: /usr/bin/grep -> grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.confJump to behavior
      Source: /usr/share/gdm/generate-config (PID: 5556)Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-serviceJump to behavior
      Source: /usr/sbin/gdm3 (PID: 5562)File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)Jump to behavior
      Source: /usr/sbin/gdm3 (PID: 5562)File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)Jump to behavior
      Source: /usr/bin/gpu-manager (PID: 5538)Log file created: /var/log/gpu-manager.log
      Source: /usr/bin/gpu-manager (PID: 5589)Log file created: /var/log/gpu-manager.log
      Source: /usr/bin/gpu-manager (PID: 5599)Log file created: /var/log/gpu-manager.log
      Source: /usr/bin/gpu-manager (PID: 5609)Log file created: /var/log/gpu-manager.log
      Source: /usr/bin/gpu-manager (PID: 5619)Log file created: /var/log/gpu-manager.log
      Source: /usr/bin/gpu-manager (PID: 5629)Log file created: /var/log/gpu-manager.logJump to dropped file

      Hooking and other Techniques for Hiding and Protection

      barindex
      Source: /tmp/xd.x86.elf (PID: 5429)File: /usr/lib/systemd/systemdJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)File: /usr/lib/systemd/systemd (deleted)Jump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)File: /usr/bin/pulseaudioJump to behavior
      Source: /tmp/xd.x86.elf (PID: 5429)File: /usr/sbin/gdm3Jump to behavior
      Source: xd.x86.elfSubmission file: segment LOAD with 7.8804 entropy (max. 8.0)
      Source: /usr/bin/gpu-manager (PID: 5538)Truncated file: /var/log/gpu-manager.logJump to behavior
      Source: /usr/bin/gpu-manager (PID: 5589)Truncated file: /var/log/gpu-manager.logJump to behavior
      Source: /usr/bin/gpu-manager (PID: 5599)Truncated file: /var/log/gpu-manager.logJump to behavior
      Source: /usr/bin/gpu-manager (PID: 5609)Truncated file: /var/log/gpu-manager.logJump to behavior
      Source: /usr/bin/gpu-manager (PID: 5619)Truncated file: /var/log/gpu-manager.logJump to behavior
      Source: /usr/bin/gpu-manager (PID: 5629)Truncated file: /var/log/gpu-manager.logJump to behavior
      Source: /usr/bin/pulseaudio (PID: 5529)Reads CPU info from /sys: /sys/devices/system/cpu/onlineJump to behavior
      Source: /usr/bin/pkill (PID: 5556)Reads CPU info from /sys: /sys/devices/system/cpu/onlineJump to behavior
      Source: /usr/bin/pulseaudio (PID: 5529)Queries kernel information via 'uname': Jump to behavior
      Source: /usr/bin/gpu-manager (PID: 5538)Queries kernel information via 'uname': Jump to behavior
      Source: /usr/bin/gpu-manager (PID: 5589)Queries kernel information via 'uname': Jump to behavior
      Source: /usr/bin/gpu-manager (PID: 5599)Queries kernel information via 'uname': Jump to behavior
      Source: /usr/bin/gpu-manager (PID: 5609)Queries kernel information via 'uname': Jump to behavior
      Source: /usr/bin/gpu-manager (PID: 5619)Queries kernel information via 'uname': Jump to behavior
      Source: /usr/bin/gpu-manager (PID: 5629)Queries kernel information via 'uname': Jump to behavior

      Stealing of Sensitive Information

      barindex
      Source: Yara matchFile source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: xd.x86.elf PID: 5428, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: xd.x86.elf PID: 5430, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: xd.x86.elf PID: 5431, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: xd.x86.elf PID: 5432, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: xd.x86.elf PID: 5433, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: xd.x86.elf PID: 5434, type: MEMORYSTR

      Remote Access Functionality

      barindex
      Source: Yara matchFile source: 5432.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 5434.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 5431.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 5430.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 5433.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: 5428.1.0000000008048000.0000000008058000.r-x.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: xd.x86.elf PID: 5428, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: xd.x86.elf PID: 5430, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: xd.x86.elf PID: 5431, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: xd.x86.elf PID: 5432, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: xd.x86.elf PID: 5433, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: xd.x86.elf PID: 5434, type: MEMORYSTR

      Mitre Att&ck Matrix

      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity Information1
      Scripting      		Valid AccountsWindows Management Instrumentation1
      Scripting      		Path Interception1
      File and Directory Permissions Modification      		1
      OS Credential Dumping      		1
      Security Software Discovery      		Remote ServicesData from Local System1
      Non-Standard Port      		Exfiltration Over Other Network Medium1
      Service Stop
      CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
      Disable or Modify Tools      		LSASS Memory1
      File and Directory Discovery      		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
      Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
      Indicator Removal      		Security Account Manager1
      System Information Discovery      		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
      Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
      Obfuscated Files or Information      		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
      Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
      File Deletion      		LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact

      Malware Configuration

      ⊘No configs have been found

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Number of created Files
      • Is malicious
      • Internet
      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1655033 Sample: xd.x86.elf Startdate: 02/04/2025 Architecture: LINUX Score: 88 54 216.219.7.209, 23 WINDSTREAMUS United States 2->54 56 196.143.25.76, 23 Vodafone-EG Egypt 2->56 58 98 other IPs or domains 2->58 64 Malicious sample detected (through community Yara rule) 2->64 66 Multi AV Scanner detection for submitted file 2->66 68 Yara detected Mirai 2->68 70 Sample is packed with UPX 2->70 8 xd.x86.elf 2->8         started        10 systemd gpu-manager 2->10         started        12 gvfsd-fuse fusermount 2->12         started        15 40 other processes 2->15 signatures3 process4 signatures5 17 xd.x86.elf 8->17         started        20 xd.x86.elf 8->20         started        22 xd.x86.elf 8->22         started        24 gpu-manager sh 10->24         started        26 gpu-manager sh 10->26         started        28 gpu-manager sh 10->28         started        32 5 other processes 10->32 72 Sample reads /proc/mounts (often used for finding a writable filesystem) 12->72 30 generate-config pkill 15->30         started        34 40 other processes 15->34 process6 signatures7 60 Sample tries to kill multiple processes (SIGKILL) 17->60 62 Sample deletes itself 17->62 36 xd.x86.elf 20->36         started        50 2 other processes 20->50 38 sh grep 24->38         started        40 sh grep 26->40         started        42 sh grep 28->42         started        44 sh grep 32->44         started        46 sh grep 32->46         started        48 sh grep 32->48         started        52 2 other processes 32->52 process8

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      xd.x86.elf50%ReversingLabsLinux.Backdoor.Mirai

      Dropped Files

      ⊘No Antivirus matches

      Domains

      ⊘No Antivirus matches

      URLs

      ⊘No Antivirus matches

      Domains and IPs

      Download Network PCAP: filtered – full

      Contacted Domains

      ⊘No contacted domains info
      NameSourceMaliciousAntivirus DetectionReputation
      http://upx.sf.netxd.x86.elffalse
        		high

        World Map of Contacted IPs

        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs

        Public IPs

        IPDomainCountryFlagASNASN NameMalicious
        202.194.183.234
        		unknownChina
        		4538ERX-CERNET-BKBChinaEducationandResearchNetworkCenterfalse
        180.107.85.14
        		unknownChina
        		137702CHINATELECOM-JIANGSU-NANJING-IDCNanjingJiangsuProvincefalse
        194.144.35.124
        		unknownIceland
        		12969VODAFONE_ICELANDISfalse
        121.207.177.20
        		unknownChina
        		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
        104.51.44.186
        		unknownUnited States
        		7018ATT-INTERNET4USfalse
        167.172.161.217
        		unknownUnited States
        		14061DIGITALOCEAN-ASNUSfalse
        221.108.187.132
        		unknownJapan17676GIGAINFRASoftbankBBCorpJPfalse
        136.40.50.174
        		unknownUnited States
        		16591GOOGLE-FIBERUSfalse
        188.79.77.158
        		unknownSpain
        		12479UNI2-ASESfalse
        73.36.31.149
        		unknownUnited States
        		7922COMCAST-7922USfalse
        190.227.110.243
        		unknownArgentina
        		7303TelecomArgentinaSAARfalse
        86.123.155.72
        		unknownRomania
        		8708RCS-RDS73-75DrStaicoviciROfalse
        211.121.50.37
        		unknownJapan4725ODNSoftBankMobileCorpJPfalse
        27.22.152.239
        		unknownChina
        		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
        244.166.4.179
        		unknownReserved
        		unknownunknownfalse
        153.139.76.158
        		unknownJapan4713OCNNTTCommunicationsCorporationJPfalse
        5.93.73.80
        		unknownItaly
        		30722VODAFONE-IT-ASNITfalse
        103.128.111.11
        		unknownunknown
        		7575AARNET-AS-APAustralianAcademicandResearchNetworkAARNefalse
        44.51.140.17
        		unknownUnited States
        		7377UCSDUSfalse
        179.183.28.132
        		unknownBrazil
        		18881TELEFONICABRASILSABRfalse
        111.251.20.81
        		unknownTaiwan; Republic of China (ROC)
        		3462HINETDataCommunicationBusinessGroupTWfalse
        86.104.115.172
        		unknownSpain
        		12479UNI2-ASESfalse
        91.90.73.28
        		unknownPoland
        		31242TKPSA-ASPLfalse
        105.55.37.154
        		unknownKenya
        		33771SAFARICOM-LIMITEDKEfalse
        57.95.196.170
        		unknownBelgium
        		51964ORANGE-BUSINESS-SERVICES-IPSN-ASNFRfalse
        108.183.236.177
        		unknownUnited States
        		11351TWC-11351-NORTHEASTUSfalse
        116.223.15.238
        		unknownJapan9824JTCL-JP-ASJupiterTelecommunicationCoLtdJPfalse
        123.0.15.105
        		unknownKorea Republic of
        		38293MFA-AS-TH-APMinistryofForeignAffairsTHfalse
        176.26.220.1
        		unknownUnited Kingdom
        		5607BSKYB-BROADBAND-ASGBfalse
        89.70.172.129
        		unknownPoland
        		6830LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHoldingfalse
        75.160.84.222
        		unknownUnited States
        		209CENTURYLINK-US-LEGACY-QWESTUSfalse
        43.225.174.162
        		unknownChina
        		131324M9TCL-AS-AP92CloudTechnologyCoLimitedHKfalse
        86.225.14.152
        		unknownFrance
        		3215FranceTelecom-OrangeFRfalse
        178.153.138.169
        		unknownQatar
        		42298GCC-MPLS-PEERINGGCCMPLSpeeringQAfalse
        210.190.2.42
        		unknownJapan4713OCNNTTCommunicationsCorporationJPfalse
        72.115.230.249
        		unknownUnited States
        		22394CELLCOUSfalse
        247.72.118.64
        		unknownReserved
        		unknownunknownfalse
        144.18.120.20
        		unknownUnited States
        		58541CHINATELECOM-SHANDONG-QINGDAO-IDCQingdao266000CNfalse
        121.86.160.59
        		unknownJapan17511OPTAGEOPTAGEIncJPfalse
        194.174.31.68
        		unknownGermany
        		702UUNETUSfalse
        91.219.220.177
        		unknownUkraine
        		15461SOLVERNET-ASUAfalse
        195.239.104.238
        		unknownRussian Federation
        		34838ALFAINS-ASRUfalse
        212.190.178.165
        		unknownBelgium
        		702UUNETUSfalse
        81.63.252.112
        		unknownSwitzerland
        		3303SWISSCOMSwisscomSwitzerlandLtdCHfalse
        186.104.136.97
        		unknownChile
        		7418TELEFONICACHILESACLfalse
        60.2.25.108
        		unknownChina
        		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
        216.219.7.209
        		unknownUnited States
        		7029WINDSTREAMUSfalse
        221.152.125.162
        		unknownKorea Republic of
        		4766KIXS-AS-KRKoreaTelecomKRfalse
        211.10.147.248
        		unknownJapan2516KDDIKDDICORPORATIONJPfalse
        223.107.131.111
        		unknownChina
        		56046CMNET-JIANGSU-APChinaMobilecommunicationscorporationCNfalse
        176.19.215.170
        		unknownSaudi Arabia
        		35819MOBILY-ASEtihadEtisalatCompanyMobilySAfalse
        191.213.218.212
        		unknownBrazil
        		7738TelemarNorteLesteSABRfalse
        183.86.70.147
        		unknownJapan10010TOKAITOKAICommunicationsCorporationJPfalse
        117.247.118.62
        		unknownIndia
        		9829BSNL-NIBNationalInternetBackboneINfalse
        111.113.79.50
        		unknownChina
        		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
        67.30.93.151
        		unknownUnited States
        		202818LEVEL3COMMUNICATIONSFRfalse
        119.82.186.231
        		unknownJapan17698CCNET-NETCOMMUNITYNETWORKCENTERINCORPORATEDJPfalse
        105.70.49.48
        		unknownMorocco
        		36884MAROCCONNECTMAfalse
        251.205.142.226
        		unknownReserved
        		unknownunknownfalse
        148.213.231.57
        		unknownMexico
        		15236UniversidaddeColimaMXfalse
        115.215.194.210
        		unknownChina
        		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
        201.3.138.35
        		unknownBrazil
        		8167BrasilTelecomSA-FilialDistritoFederalBRfalse
        110.12.224.31
        		unknownKorea Republic of
        		9318SKB-ASSKBroadbandCoLtdKRfalse
        48.127.0.71
        		unknownUnited States
        		2686ATGS-MMD-ASUSfalse
        177.171.179.220
        		unknownBrazil
        		26599TELEFONICABRASILSABRfalse
        102.72.134.183
        		unknownMorocco
        		6713IAM-ASMAfalse
        89.0.153.87
        		unknownGermany
        		8422NETCOLOGNEDEfalse
        202.59.122.165
        		unknownJapan23624CHUKAIChukaiTelevisionCoLtdJPfalse
        14.10.211.6
        		unknownJapan2516KDDIKDDICORPORATIONJPfalse
        91.45.199.45
        		unknownGermany
        		3320DTAGInternetserviceprovideroperationsDEfalse
        169.249.41.253
        		unknownUnited States
        		47024THE-METROHEALTH-SYSTEMUSfalse
        39.98.190.239
        		unknownChina
        		37963CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtdfalse
        119.179.159.86
        		unknownChina
        		4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
        213.209.129.92
        		unknownGermany
        		42821RAPIDNET-DEHaunstetterStr19DEfalse
        179.235.130.92
        		unknownBrazil
        		28573CLAROSABRfalse
        192.79.227.255
        		unknownUnited States
        		46446CALTELCOMUSfalse
        41.40.78.56
        		unknownEgypt
        		8452TE-ASTE-ASEGfalse
        186.30.171.190
        		unknownColombia
        		19429ETB-ColombiaCOfalse
        204.93.35.73
        		unknownUnited States
        		3257GTT-BACKBONEGTTDEfalse
        96.119.102.215
        		unknownUnited States
        		7922COMCAST-7922USfalse
        84.124.80.210
        		unknownSpain
        		6739ONO-ASCableuropa-ONOESfalse
        12.208.73.139
        		unknownUnited States
        		7018ATT-INTERNET4USfalse
        107.128.57.24
        		unknownUnited States
        		7018ATT-INTERNET4USfalse
        154.51.115.244
        		unknownUnited States
        		174COGENT-174USfalse
        196.143.25.76
        		unknownEgypt
        		36935Vodafone-EGfalse
        116.69.199.224
        		unknownChina
        		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
        79.72.252.216
        		unknownUnited Kingdom
        		9105TISCALI-UKTalkTalkCommunicationsLimitedGBfalse
        153.144.231.29
        		unknownJapan4713OCNNTTCommunicationsCorporationJPfalse
        42.150.109.49
        		unknownJapan9824JTCL-JP-ASJupiterTelecommunicationCoLtdJPfalse
        222.150.36.28
        		unknownJapan4713OCNNTTCommunicationsCorporationJPfalse
        185.151.30.42
        		unknownUnited Kingdom
        		48254TWENTYIGBfalse
        98.81.87.240
        		unknownUnited States
        		11351TWC-11351-NORTHEASTUSfalse
        171.81.85.175
        		unknownChina
        		4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
        136.129.242.17
        		unknownUnited States
        		60311ONEFMCHfalse
        160.195.215.223
        		unknownJapan2907SINET-ASResearchOrganizationofInformationandSystemsNfalse
        95.22.242.11
        		unknownSpain
        		12479UNI2-ASESfalse
        149.5.33.181
        		unknownUnited States
        		60110MODELTELECOMIEfalse
        35.201.156.2
        		unknownUnited States
        		15169GOOGLEUSfalse
        223.167.19.106
        		unknownChina
        		17621CNCGROUP-SHChinaUnicomShanghainetworkCNfalse
        83.230.100.246
        		unknownPoland
        		8508SILWEB-AS-EDUSILWEBAutonomousSystem-AcademicPLfalse

        Joe Sandbox View / Context

        IPs

        ⊘No context

        Domains

        ⊘No context

        ASNs

        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        ERX-CERNET-BKBChinaEducationandResearchNetworkCenterxd.sh4.elfGet hashmaliciousMiraiBrowse
        • 211.68.251.108
        xd.mips.elfGet hashmaliciousMiraiBrowse
        • 211.84.222.218
        xd.arm7.elfGet hashmaliciousMiraiBrowse
        • 111.115.14.201
        i486.elfGet hashmaliciousUnknownBrowse
        • 59.65.22.154
        x86_64.elfGet hashmaliciousUnknownBrowse
        • 202.204.85.24
        rep.ppc.elfGet hashmaliciousMiraiBrowse
        • 59.72.61.169
        arm5.elfGet hashmaliciousUnknownBrowse
        • 101.76.89.61
        arm7.elfGet hashmaliciousMiraiBrowse
        • 222.17.160.168
        mpsl.elfGet hashmaliciousUnknownBrowse
        • 222.24.201.156
        x86.elfGet hashmaliciousUnknownBrowse
        • 58.204.38.34
        VODAFONE_ICELANDISmpsl.elfGet hashmaliciousGafgyt, OkiruBrowse
        • 5.23.67.195
        ppc.elfGet hashmaliciousMirai, MoobotBrowse
        • 194.144.176.87
        resgod.sh4.elfGet hashmaliciousMiraiBrowse
        • 194.144.71.97
        resgod.arm.elfGet hashmaliciousMiraiBrowse
        • 46.239.208.9
        root.elfGet hashmaliciousUnknownBrowse
        • 217.9.140.3
        sora.mpsl.elfGet hashmaliciousMiraiBrowse
        • 88.149.62.158
        cbr.arm7.elfGet hashmaliciousMiraiBrowse
        • 88.149.62.170
        cbr.arm7.elfGet hashmaliciousMiraiBrowse
        • 88.149.62.127
        cbr.ppc.elfGet hashmaliciousMiraiBrowse
        • 46.239.208.7
        splarm7.elfGet hashmaliciousUnknownBrowse
        • 89.160.229.47
        CHINANET-BACKBONENo31Jin-rongStreetCNxd.powerpc-440fp.elfGet hashmaliciousMiraiBrowse
        • 36.22.80.62
        xd.sh4.elfGet hashmaliciousMiraiBrowse
        • 171.47.160.33
        xd.x86_64.elfGet hashmaliciousMiraiBrowse
        • 116.22.120.195
        http://daugavpils.pilseta24.lv/linkredirect/?link=https%3A%2F%2Fmujicconstruction.com%2Fjustdoitforyou%2F123%2FbGF1cmEuYmVyZ21hbkBwb3N0bm9yZC5jb20=&referer=daugavpils.pilseta24.lv%2Fzina%3Fslug%3Deccal-briketes-un-apkures-granulas-ar-lielisku-kvalitati-pievilcigu-cenu-videi-draudzigs-un-izd-8c175fc171&additional_params=%7B%22company_orig_id%22%3A%22267661%22%2C%22object_country_id%22%3A%22lv%22%2C%22referer_layout_type%22%3A%22SR%22%2C%22bannerinfo%22%3A%22%7B%5C%22key%5C%22%3A%5C%22%5C%5C%5C%22Apbed%5C%5Cu012b%5C%5Cu0161anas+nams-krematorija%5C%5C%5C%22%2C+SIA%7C2020-09-11%7C2021-08-23%7Cdaugavpils+p24+lielais+baneris%7Chttps%3A%5C%5C%5C%2F%5C%5C%5C%2Fwww.krematorijariga.lv%5C%5C%5C%2F%7C%7Cupload%5C%5C%5C%2F267661%5C%5C%5C%2Fbaners%5C%5C%5C%2F1184_krematorija_980x90.gif%7Clva%7C267661%7C980%7C90%7C%7C0%7C0%7C%7C0%7C0%7C%5C%22%2C%5C%22doc_count%5C%22%3A1%2C%5C%22key0%5C%22%3A%5C%22%5C%5C%5C%22Apbed%5C%5Cu012b%5C%5Cu0161anas+nams-krematorija%5C%5C%5C%22%2C+SIA%5C%22%2C%5C%22key1%5C%22%3A%5C%222020-09-11%5C%22%2C%5C%22key2%5C%22%3A%5C%222021-08-23%5C%22%2C%5C%22key3%5C%22%3A%5C%22daugavpils+p24+lielais+baneris%5C%22%2C%5C%22key4%5C%22%3A%5C%22https%3A%5C%5C%5C%2F%5C%5C%5C%2Fwww.krematorijariga.lv%5C%5C%5C%2F%5C%22%2C%5C%22key5%5C%22%3A%5C%22%5C%22%2C%5C%22key6%5C%22%3A%5C%22upload%5C%5C%5C%2F267661%5C%5C%5C%2Fbaners%5C%5C%5C%2F1184_krematorija_980x90.gif%5C%22%2C%5C%22key7%5C%22%3A%5C%22lva%5C%22%2C%5C%22key8%5C%22%3A%5C%22267661%5C%22%2C%5C%22key9%5C%22%3A%5C%22980%5C%22%2C%5C%22key10%5C%22%3A%5C%2290%5C%22%2C%5C%22key11%5C%22%3A%5C%22%5C%22%2C%5C%22key12%5C%22%3A%5C%220%5C%22%2C%5C%22key13%5C%22%3A%5C%220%5C%22%2C%5C%22key14%5C%22%3A%5C%22%5C%22%2C%5C%22key15%5C%22%3A%5C%220%5C%22%2C%5C%22key16%5C%22%3A%5C%220%5C%22%2C%5C%22key17%5C%22%3A%5C%22%5C%22%7D%22%7D&control=494d2e7146aade77cb8a9ef0fd1fd133Get hashmaliciousHTMLPhisherBrowse
        • 63.140.39.9
        utorrent_installer.exeGet hashmaliciousUnknownBrowse
        • 221.225.226.18
        utorrent_installer.exeGet hashmaliciousUnknownBrowse
        • 106.63.26.28
        https://www.notion.so/1c85839ca3918049b295de37b1c532aaGet hashmaliciousHTMLPhisherBrowse
        • 63.140.39.93
        xd.mips.elfGet hashmaliciousMiraiBrowse
        • 121.8.97.224
        xd.powerpc-440fp.elfGet hashmaliciousMiraiBrowse
        • 175.12.84.189
        xd.arm.elfGet hashmaliciousMiraiBrowse
        • 60.168.8.188
        CHINATELECOM-JIANGSU-NANJING-IDCNanjingJiangsuProvincexd.x86.elfGet hashmaliciousMiraiBrowse
        • 180.120.16.11
        .i.elfGet hashmaliciousMiraiBrowse
        • 180.97.50.214
        k03ldc.mips.elfGet hashmaliciousUnknownBrowse
        • 180.117.156.31
        bejv86.elfGet hashmaliciousMiraiBrowse
        • 180.107.174.200
        efjepc.elfGet hashmaliciousGafgyt, MiraiBrowse
        • 180.120.186.159
        eehah4.elfGet hashmaliciousGafgyt, MiraiBrowse
        • 180.106.77.100
        resgod.m68k.elfGet hashmaliciousMiraiBrowse
        • 180.126.125.130
        weje64.elfGet hashmaliciousGafgyt, MiraiBrowse
        • 180.120.28.46
        rrrdsl.elfGet hashmaliciousGafgyt, MiraiBrowse
        • 180.117.156.31
        m68k.elfGet hashmaliciousGafgyt, OkiruBrowse
        • 180.119.244.10

        JA3 Fingerprints

        ⊘No context

        Dropped Files

        ⊘No context

        Created / dropped Files

        Process:/usr/bin/pulseaudio
        File Type:ASCII text
        Category:dropped
        Size (bytes):10
        Entropy (8bit):2.9219280948873623
        Encrypted:false
        SSDEEP:3:5bkPn:pkP
        MD5:FF001A15CE15CF062A3704CEA2991B5F
        SHA1:B06F6855F376C3245B82212AC73ADED55DFE5DEF
        SHA-256:C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
        SHA-512:65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
        Malicious:false
        Reputation:moderate, very likely benign file
        Preview:auto_null.
        Process:/usr/bin/pulseaudio
        File Type:ASCII text
        Category:dropped
        Size (bytes):18
        Entropy (8bit):3.4613201402110088
        Encrypted:false
        SSDEEP:3:5bkrIZsXvn:pkckv
        MD5:28FE6435F34B3367707BB1C5D5F6B430
        SHA1:EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
        SHA-256:721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
        SHA-512:6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
        Malicious:false
        Reputation:moderate, very likely benign file
        Preview:auto_null.monitor.
        Process:/usr/sbin/gdm3
        File Type:ASCII text
        Category:dropped
        Size (bytes):5
        Entropy (8bit):1.9219280948873623
        Encrypted:false
        SSDEEP:3:FT/:p/
        MD5:EEFD9FA8D870763F1CADD1D0A6A32960
        SHA1:7EA75B1C9743687984F47C4D3E26DDCD8340D268
        SHA-256:82C8B3DB1E50C101ACAB6B6A2AD60E0E675266368B0F358375042A32EA625612
        SHA-512:4C50F290FAB2B0DEC068F9A9D684293E0D359F7A97D129709F7EEC1E0538755339D0C71B9847BDB6CD9695A5D53A13A5E5E2C4E3416EABBC46721A321F77298C
        Malicious:false
        Reputation:low
        Preview:5562.
        Process:/usr/bin/pulseaudio
        File Type:ASCII text
        Category:dropped
        Size (bytes):5
        Entropy (8bit):1.9219280948873623
        Encrypted:false
        SSDEEP:3:FXen:te
        MD5:C3B062C4CE43315FB56C09EB0C36B417
        SHA1:23F3B33C68CA83D84807855B5E495B795991D17F
        SHA-256:92E1BE522E4EFA4080467DB6CEEC86607C505D27B768BABCBE6642464ABDE92B
        SHA-512:7224A0E99D3F0EF7A199E4D3516CCB441921E4B2E9EA346E49173797CBA96CBA5DF7399C5E144F605C84CF5BD9829E6D3C0B610F26F804AD98248BE29EA72B50
        Malicious:false
        Reputation:low
        Preview:5529.
        Process:/usr/bin/gpu-manager
        File Type:ASCII text
        Category:dropped
        Size (bytes):25
        Entropy (8bit):2.7550849518197795
        Encrypted:false
        SSDEEP:3:JoT/V9fDVbn:M/V3n
        MD5:078760523943E160756979906B85FB5E
        SHA1:0962643266F4C5537F7D125046F28F21D6DD0C89
        SHA-256:048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
        SHA-512:DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
        Malicious:false
        Reputation:moderate, very likely benign file
        Preview:15ad:0405;0000:00:0f:0;1.
        Process:/usr/bin/gpu-manager
        File Type:ASCII text
        Category:dropped
        Size (bytes):1371
        Entropy (8bit):4.8296848499188485
        Encrypted:false
        SSDEEP:24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
        MD5:3AF77E630DA00B3BE24F4E8AA5D78B13
        SHA1:BCF2D99E002F6DE2413A183227B011CFBEF5673D
        SHA-256:EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
        SHA-512:8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
        Malicious:false
        Reputation:moderate, very likely benign file
        Preview:log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

        Static File Info

        General

        File type:ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, no section header
        Entropy (8bit):7.877922223931819
        TrID:
        • ELF Executable and Linkable format (Linux) (4029/14) 50.16%
        • ELF Executable and Linkable format (generic) (4004/1) 49.84%
        File name:xd.x86.elf
        File size:29'424 bytes
        MD5:5e4a544bfb8cfb31f89e915eb339ded5
        SHA1:690a965ee7207bcf2b5454e1241e7a0c056da634
        SHA256:f947f7b2f43f39a5ba5b7053c12d4e3b8f9315ef17d26af7c9b0f449391fc4e8
        SHA512:3300cb3e76a476ccb719f046b59be748cba0b593f8b6e15ff405d33986705679a432611a79fb38370bbf0f961e35390ad9eff357ea494b1863a26cf6946d609b
        SSDEEP:768:hy3rBuMzojLeqmVr3MZ7IZHkWL97Wo7WmARajY:hcXELd3Zcdke9ymb8
        TLSH:4CD2E13575CE0C4A9E011332B4569FEB79A1D470CE9AD4901EA5CC05C96E33A2C3AEAD
        File Content Preview:.ELF.....................y..4...........4. ...(......................q...q.............. ... ... ...................Q.td..............................-!UPX!0...................Y.......w....ELF.......d....g..4!.34. (.....[..;;.F.`....'.....f......\ ..>..b.

        Static ELF Info

        ELF header

        Class:ELF32
        Data:2's complement, little endian
        Version:1 (current)
        Machine:Intel 80386
        Version Number:0x1
        Type:EXEC (Executable file)
        OS/ABI:UNIX - Linux
        ABI Version:0
        Entry Point Address:0xc079d8
        Flags:0x0
        ELF Header Size:52
        Program Header Offset:52
        Program Header Size:32
        Number of Program Headers:3
        Section Header Offset:0
        Section Header Size:40
        Number of Section Headers:0
        Header String Table Index:0

        Program Segments

        TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
        LOAD0x00xc010000xc010000x71fc0x71fc7.88040x5R E0x1000
        LOAD0xf200x8058f200x8058f200x00x00.00000x6RW 0x1000
        GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

        Network Behavior

        Download Network PCAP: filtered – full

        Network Port Distribution

        • Total Packets: 153
        • • 7887 undefined
        • • 23 (Telnet)
        TimestampSource PortDest PortSource IPDest IP
        Apr 2, 2025 21:58:22.580220938 CEST526407887192.168.2.13213.209.129.92
        Apr 2, 2025 21:58:22.580375910 CEST4458123192.168.2.1385.13.167.129
        Apr 2, 2025 21:58:22.580375910 CEST4458123192.168.2.1389.70.172.129
        Apr 2, 2025 21:58:22.580383062 CEST4458123192.168.2.13186.104.136.97
        Apr 2, 2025 21:58:22.580410957 CEST4458123192.168.2.13183.86.70.147
        Apr 2, 2025 21:58:22.580410957 CEST4458123192.168.2.13195.239.104.238
        Apr 2, 2025 21:58:22.580414057 CEST4458123192.168.2.13171.81.85.175
        Apr 2, 2025 21:58:22.580445051 CEST4458123192.168.2.1378.252.172.4
        Apr 2, 2025 21:58:22.580446959 CEST4458123192.168.2.1342.150.109.49
        Apr 2, 2025 21:58:22.580446959 CEST4458123192.168.2.13153.139.76.158
        Apr 2, 2025 21:58:22.580450058 CEST4458123192.168.2.1339.98.190.239
        Apr 2, 2025 21:58:22.580468893 CEST4458123192.168.2.1381.114.130.249
        Apr 2, 2025 21:58:22.580477953 CEST4458123192.168.2.13179.235.130.92
        Apr 2, 2025 21:58:22.580480099 CEST4458123192.168.2.1381.63.252.112
        Apr 2, 2025 21:58:22.580481052 CEST4458123192.168.2.13115.215.194.210
        Apr 2, 2025 21:58:22.580487967 CEST4458123192.168.2.1384.124.80.210
        Apr 2, 2025 21:58:22.580492973 CEST4458123192.168.2.13108.183.236.177
        Apr 2, 2025 21:58:22.580492973 CEST4458123192.168.2.1314.206.54.147
        Apr 2, 2025 21:58:22.580493927 CEST4458123192.168.2.1341.40.78.56
        Apr 2, 2025 21:58:22.580513954 CEST4458123192.168.2.13111.113.79.50
        Apr 2, 2025 21:58:22.580518007 CEST4458123192.168.2.13144.18.120.20
        Apr 2, 2025 21:58:22.580523968 CEST4458123192.168.2.1367.30.93.151
        Apr 2, 2025 21:58:22.580533028 CEST4458123192.168.2.1312.208.73.139
        Apr 2, 2025 21:58:22.580549955 CEST4458123192.168.2.13241.21.253.186
        Apr 2, 2025 21:58:22.580565929 CEST4458123192.168.2.13122.117.222.135
        Apr 2, 2025 21:58:22.580566883 CEST4458123192.168.2.1391.90.73.28
        Apr 2, 2025 21:58:22.580564022 CEST4458123192.168.2.1386.104.115.172
        Apr 2, 2025 21:58:22.580564022 CEST4458123192.168.2.13160.195.215.223
        Apr 2, 2025 21:58:22.580564022 CEST4458123192.168.2.1386.123.155.72
        Apr 2, 2025 21:58:22.580564022 CEST4458123192.168.2.13216.40.200.22
        Apr 2, 2025 21:58:22.580574989 CEST4458123192.168.2.1346.9.184.211
        Apr 2, 2025 21:58:22.580599070 CEST4458123192.168.2.13182.116.16.62
        Apr 2, 2025 21:58:22.580614090 CEST4458123192.168.2.1327.22.152.239
        Apr 2, 2025 21:58:22.580615997 CEST4458123192.168.2.13221.108.187.132
        Apr 2, 2025 21:58:22.580619097 CEST4458123192.168.2.13251.205.142.226
        Apr 2, 2025 21:58:22.580631971 CEST4458123192.168.2.13148.213.231.57
        Apr 2, 2025 21:58:22.580631971 CEST4458123192.168.2.13223.167.19.106
        Apr 2, 2025 21:58:22.580631971 CEST4458123192.168.2.13111.251.20.81
        Apr 2, 2025 21:58:22.580636024 CEST4458123192.168.2.1383.9.84.237
        Apr 2, 2025 21:58:22.580648899 CEST4458123192.168.2.13107.128.57.24
        Apr 2, 2025 21:58:22.580651045 CEST4458123192.168.2.13222.150.36.28
        Apr 2, 2025 21:58:22.580651045 CEST4458123192.168.2.1392.16.80.111
        Apr 2, 2025 21:58:22.580653906 CEST4458123192.168.2.13102.72.134.183
        Apr 2, 2025 21:58:22.580672026 CEST4458123192.168.2.13110.12.224.31
        Apr 2, 2025 21:58:22.580691099 CEST4458123192.168.2.13119.179.159.86
        Apr 2, 2025 21:58:22.580692053 CEST4458123192.168.2.13191.213.218.212
        Apr 2, 2025 21:58:22.580692053 CEST4458123192.168.2.13124.195.104.178
        Apr 2, 2025 21:58:22.580697060 CEST4458123192.168.2.1386.225.14.152
        Apr 2, 2025 21:58:22.580724001 CEST4458123192.168.2.13136.129.242.17
        Apr 2, 2025 21:58:22.580734968 CEST4458123192.168.2.1369.253.3.225
        Apr 2, 2025 21:58:22.580740929 CEST4458123192.168.2.13202.103.60.182
        Apr 2, 2025 21:58:22.580741882 CEST4458123192.168.2.13186.30.171.190
        Apr 2, 2025 21:58:22.580741882 CEST4458123192.168.2.1354.20.183.32
        Apr 2, 2025 21:58:22.580748081 CEST4458123192.168.2.13216.219.7.209
        Apr 2, 2025 21:58:22.580748081 CEST4458123192.168.2.1332.2.254.31
        Apr 2, 2025 21:58:22.580755949 CEST4458123192.168.2.13253.105.217.222
        Apr 2, 2025 21:58:22.580765009 CEST4458123192.168.2.1343.121.0.33
        Apr 2, 2025 21:58:22.580765963 CEST4458123192.168.2.13216.230.195.187
        Apr 2, 2025 21:58:22.580782890 CEST4458123192.168.2.1360.2.25.108
        Apr 2, 2025 21:58:22.580785990 CEST4458123192.168.2.1319.35.130.97
        Apr 2, 2025 21:58:22.580786943 CEST4458123192.168.2.13136.40.50.174
        Apr 2, 2025 21:58:22.580786943 CEST4458123192.168.2.13218.193.156.102
        Apr 2, 2025 21:58:22.580790997 CEST4458123192.168.2.1344.51.140.17
        Apr 2, 2025 21:58:22.580786943 CEST4458123192.168.2.13149.5.33.181
        Apr 2, 2025 21:58:22.580790997 CEST4458123192.168.2.13121.86.160.59
        Apr 2, 2025 21:58:22.580786943 CEST4458123192.168.2.13133.255.251.150
        Apr 2, 2025 21:58:22.580786943 CEST4458123192.168.2.13190.227.110.243
        Apr 2, 2025 21:58:22.580800056 CEST4458123192.168.2.13200.215.7.26
        Apr 2, 2025 21:58:22.580813885 CEST4458123192.168.2.13167.172.161.217
        Apr 2, 2025 21:58:22.580815077 CEST4458123192.168.2.13152.76.199.131
        Apr 2, 2025 21:58:22.580815077 CEST4458123192.168.2.13116.223.15.238
        Apr 2, 2025 21:58:22.580826044 CEST4458123192.168.2.13201.3.138.35
        Apr 2, 2025 21:58:22.580840111 CEST4458123192.168.2.13189.103.119.117
        Apr 2, 2025 21:58:22.580842972 CEST4458123192.168.2.13153.144.231.29
        Apr 2, 2025 21:58:22.580847979 CEST4458123192.168.2.13178.153.138.169
        Apr 2, 2025 21:58:22.580867052 CEST4458123192.168.2.13189.35.178.228
        Apr 2, 2025 21:58:22.580868006 CEST4458123192.168.2.13204.93.35.73
        Apr 2, 2025 21:58:22.580878019 CEST4458123192.168.2.13105.55.37.154
        Apr 2, 2025 21:58:22.580888033 CEST4458123192.168.2.13247.72.118.64
        Apr 2, 2025 21:58:22.580903053 CEST4458123192.168.2.13221.152.125.162
        Apr 2, 2025 21:58:22.580910921 CEST4458123192.168.2.1343.225.174.162
        Apr 2, 2025 21:58:22.580912113 CEST4458123192.168.2.1314.10.211.6
        Apr 2, 2025 21:58:22.580918074 CEST4458123192.168.2.1377.52.7.233
        Apr 2, 2025 21:58:22.580921888 CEST4458123192.168.2.13177.171.179.220
        Apr 2, 2025 21:58:22.580943108 CEST4458123192.168.2.13179.72.24.214
        Apr 2, 2025 21:58:22.580952883 CEST4458123192.168.2.13202.194.183.234
        Apr 2, 2025 21:58:22.580970049 CEST4458123192.168.2.13103.128.111.11
        Apr 2, 2025 21:58:22.580979109 CEST4458123192.168.2.13181.220.142.205
        Apr 2, 2025 21:58:22.580981970 CEST4458123192.168.2.13245.115.10.149
        Apr 2, 2025 21:58:22.580981970 CEST4458123192.168.2.13176.19.215.170
        Apr 2, 2025 21:58:22.580988884 CEST4458123192.168.2.1383.230.100.246
        Apr 2, 2025 21:58:22.580996037 CEST4458123192.168.2.13185.151.30.42
        Apr 2, 2025 21:58:22.581006050 CEST4458123192.168.2.13220.79.81.63
        Apr 2, 2025 21:58:22.581007004 CEST4458123192.168.2.13180.107.85.14
        Apr 2, 2025 21:58:22.581023932 CEST4458123192.168.2.13223.113.221.177
        Apr 2, 2025 21:58:22.581031084 CEST4458123192.168.2.13210.190.2.42
        Apr 2, 2025 21:58:22.581032991 CEST4458123192.168.2.13133.21.90.225
        Apr 2, 2025 21:58:22.581037998 CEST4458123192.168.2.1388.215.166.128
        Apr 2, 2025 21:58:22.581039906 CEST4458123192.168.2.13117.247.118.62
        Apr 2, 2025 21:58:22.581048965 CEST4458123192.168.2.1396.119.102.215
        Apr 2, 2025 21:58:22.581048965 CEST4458123192.168.2.1379.72.252.216
        Apr 2, 2025 21:58:22.581073046 CEST4458123192.168.2.13192.79.227.255
        Apr 2, 2025 21:58:22.581074953 CEST4458123192.168.2.1389.0.153.87
        Apr 2, 2025 21:58:22.581084967 CEST4458123192.168.2.13116.69.199.224
        Apr 2, 2025 21:58:22.581098080 CEST4458123192.168.2.1391.45.199.45
        Apr 2, 2025 21:58:22.581099033 CEST4458123192.168.2.13244.166.4.179
        Apr 2, 2025 21:58:22.581131935 CEST4458123192.168.2.1357.242.52.6
        Apr 2, 2025 21:58:22.581134081 CEST4458123192.168.2.13211.10.147.248
        Apr 2, 2025 21:58:22.581134081 CEST4458123192.168.2.135.254.224.24
        Apr 2, 2025 21:58:22.581152916 CEST4458123192.168.2.1372.115.230.249
        Apr 2, 2025 21:58:22.581159115 CEST4458123192.168.2.13196.143.25.76
        Apr 2, 2025 21:58:22.581159115 CEST4458123192.168.2.1348.127.0.71
        Apr 2, 2025 21:58:22.581191063 CEST4458123192.168.2.135.93.73.80
        Apr 2, 2025 21:58:22.581191063 CEST4458123192.168.2.13191.178.47.40
        Apr 2, 2025 21:58:22.581202030 CEST4458123192.168.2.13105.70.49.48
        Apr 2, 2025 21:58:22.581204891 CEST4458123192.168.2.13154.51.115.244
        Apr 2, 2025 21:58:22.581207991 CEST4458123192.168.2.13179.183.28.132
        Apr 2, 2025 21:58:22.581219912 CEST4458123192.168.2.1375.160.84.222
        Apr 2, 2025 21:58:22.581223011 CEST4458123192.168.2.13194.144.35.124
        Apr 2, 2025 21:58:22.581223011 CEST4458123192.168.2.13181.76.16.187
        Apr 2, 2025 21:58:22.581223965 CEST4458123192.168.2.13162.35.213.193
        Apr 2, 2025 21:58:22.581228971 CEST4458123192.168.2.13199.82.159.188
        Apr 2, 2025 21:58:22.581245899 CEST4458123192.168.2.13123.0.15.105
        Apr 2, 2025 21:58:22.581264973 CEST4458123192.168.2.1395.22.242.11
        Apr 2, 2025 21:58:22.581269979 CEST4458123192.168.2.13184.156.190.224
        Apr 2, 2025 21:58:22.581279039 CEST4458123192.168.2.13202.59.122.165
        Apr 2, 2025 21:58:22.581279039 CEST4458123192.168.2.1335.201.156.2
        Apr 2, 2025 21:58:22.581281900 CEST4458123192.168.2.1398.81.87.240
        Apr 2, 2025 21:58:22.581293106 CEST4458123192.168.2.1327.89.154.214
        Apr 2, 2025 21:58:22.581295013 CEST4458123192.168.2.1314.44.21.40
        Apr 2, 2025 21:58:22.581295967 CEST4458123192.168.2.13194.174.31.68
        Apr 2, 2025 21:58:22.581309080 CEST4458123192.168.2.13104.51.44.186
        Apr 2, 2025 21:58:22.581331015 CEST4458123192.168.2.13212.190.178.165
        Apr 2, 2025 21:58:22.581331015 CEST4458123192.168.2.13141.183.75.23
        Apr 2, 2025 21:58:22.581340075 CEST4458123192.168.2.1357.95.196.170
        Apr 2, 2025 21:58:22.581345081 CEST4458123192.168.2.13223.107.131.111
        Apr 2, 2025 21:58:22.581345081 CEST4458123192.168.2.13169.249.41.253
        Apr 2, 2025 21:58:22.581358910 CEST4458123192.168.2.1334.189.80.94
        Apr 2, 2025 21:58:22.581368923 CEST4458123192.168.2.13188.79.77.158
        Apr 2, 2025 21:58:22.581377029 CEST4458123192.168.2.13204.17.52.61
        Apr 2, 2025 21:58:22.581401110 CEST4458123192.168.2.1391.219.220.177
        Apr 2, 2025 21:58:22.581404924 CEST4458123192.168.2.13121.207.177.20
        Apr 2, 2025 21:58:22.581409931 CEST4458123192.168.2.13110.231.172.19
        Apr 2, 2025 21:58:22.581409931 CEST4458123192.168.2.1386.76.65.80
        Apr 2, 2025 21:58:22.581414938 CEST4458123192.168.2.13211.121.50.37
        Apr 2, 2025 21:58:22.581440926 CEST4458123192.168.2.1373.36.31.149
        Apr 2, 2025 21:58:22.581438065 CEST4458123192.168.2.13203.255.135.137
        Apr 2, 2025 21:58:22.581455946 CEST4458123192.168.2.13119.82.186.231
        Apr 2, 2025 21:58:22.581461906 CEST4458123192.168.2.13217.173.76.201
        Apr 2, 2025 21:58:22.581464052 CEST4458123192.168.2.13176.26.220.1
        Apr 2, 2025 21:58:22.581464052 CEST4458123192.168.2.13116.100.249.47
        Apr 2, 2025 21:58:22.803731918 CEST788752640213.209.129.92192.168.2.13
        Apr 2, 2025 21:58:22.803807020 CEST526407887192.168.2.13213.209.129.92
        Apr 2, 2025 21:58:22.817377090 CEST526407887192.168.2.13213.209.129.92
        Apr 2, 2025 21:58:23.043484926 CEST788752640213.209.129.92192.168.2.13
        Apr 2, 2025 21:58:23.043551922 CEST526407887192.168.2.13213.209.129.92
        TimestampSource IPDest IPChecksumCodeType
        Apr 2, 2025 21:58:49.838704109 CEST192.168.2.13192.168.2.18279(Port unreachable)Destination Unreachable
        Apr 2, 2025 22:00:09.855436087 CEST192.168.2.13192.168.2.18279(Port unreachable)Destination Unreachable

        System Behavior

        General

        Start time (UTC):19:58:21
        Start date (UTC):02/04/2025
        Path:/tmp/xd.x86.elf
        Arguments:/tmp/xd.x86.elf
        File size:29424 bytes
        MD5 hash:5e4a544bfb8cfb31f89e915eb339ded5

        Process Activities


        General

        Start time (UTC):19:58:21
        Start date (UTC):02/04/2025
        Path:/tmp/xd.x86.elf
        Arguments:-
        File size:29424 bytes
        MD5 hash:5e4a544bfb8cfb31f89e915eb339ded5

        File Activities

        Process Activities


        General

        Start time (UTC):19:58:21
        Start date (UTC):02/04/2025
        Path:/tmp/xd.x86.elf
        Arguments:-
        File size:29424 bytes
        MD5 hash:5e4a544bfb8cfb31f89e915eb339ded5

        File Activities


        General

        Start time (UTC):19:58:21
        Start date (UTC):02/04/2025
        Path:/tmp/xd.x86.elf
        Arguments:-
        File size:29424 bytes
        MD5 hash:5e4a544bfb8cfb31f89e915eb339ded5

        Process Activities


        General

        Start time (UTC):19:58:21
        Start date (UTC):02/04/2025
        Path:/tmp/xd.x86.elf
        Arguments:-
        File size:29424 bytes
        MD5 hash:5e4a544bfb8cfb31f89e915eb339ded5

        File Activities


        General

        Start time (UTC):19:58:21
        Start date (UTC):02/04/2025
        Path:/tmp/xd.x86.elf
        Arguments:-
        File size:29424 bytes
        MD5 hash:5e4a544bfb8cfb31f89e915eb339ded5

        File Activities


        General

        Start time (UTC):19:58:21
        Start date (UTC):02/04/2025
        Path:/tmp/xd.x86.elf
        Arguments:-
        File size:29424 bytes
        MD5 hash:5e4a544bfb8cfb31f89e915eb339ded5

        General

        Start time (UTC):19:58:32
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Process Activities


        General

        Start time (UTC):19:58:32
        Start date (UTC):02/04/2025
        Path:/usr/bin/journalctl
        Arguments:/usr/bin/journalctl --smart-relinquish-var
        File size:80120 bytes
        MD5 hash:bf3a987344f3bacafc44efd882abda8b

        File Activities

        Process Activities


        General

        Start time (UTC):19:58:32
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        File Activities

        Process Activities

        Network Activities


        General

        Start time (UTC):19:58:32
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        File Activities

        Process Activities

        Network Activities


        General

        Start time (UTC):19:58:32
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        File Activities

        Process Activities

        Network Activities


        General

        Start time (UTC):19:58:33
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        File Activities

        Process Activities

        Network Activities


        General

        Start time (UTC):19:58:33
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        File Activities

        Process Activities

        Network Activities


        General

        Start time (UTC):19:58:45
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        File Activities

        Process Activities

        Network Activities


        General

        Start time (UTC):19:58:45
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        File Activities

        Process Activities

        Network Activities


        General

        Start time (UTC):19:58:46
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        File Activities

        Process Activities

        Network Activities


        General

        Start time (UTC):19:58:46
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        File Activities

        Process Activities

        Network Activities


        General

        Start time (UTC):19:58:46
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        File Activities

        Process Activities

        Network Activities


        General

        Start time (UTC):19:58:46
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        File Activities

        Process Activities

        Network Activities


        General

        Start time (UTC):19:58:46
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        File Activities

        Process Activities

        Network Activities


        General

        Start time (UTC):19:58:46
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Process Activities


        General

        Start time (UTC):19:58:46
        Start date (UTC):02/04/2025
        Path:/usr/bin/pulseaudio
        Arguments:/usr/bin/pulseaudio --daemonize=no --log-target=journal
        File size:100832 bytes
        MD5 hash:0c3b4c789d8ffb12b25507f27e14c186

        File Activities

        Process Activities

        System Activities

        Network Activities


        General

        Start time (UTC):19:58:46
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        File Activities

        Process Activities

        Network Activities


        General

        Start time (UTC):19:58:46
        Start date (UTC):02/04/2025
        Path:/usr/sbin/gdm3
        Arguments:-
        File size:453296 bytes
        MD5 hash:2492e2d8d34f9377e3e530a61a15674f

        Process Activities


        General

        Start time (UTC):19:58:46
        Start date (UTC):02/04/2025
        Path:/etc/gdm3/PrimeOff/Default
        Arguments:/etc/gdm3/PrimeOff/Default
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        File Activities


        General

        Start time (UTC):19:58:46
        Start date (UTC):02/04/2025
        Path:/usr/sbin/gdm3
        Arguments:-
        File size:453296 bytes
        MD5 hash:2492e2d8d34f9377e3e530a61a15674f

        Process Activities


        General

        Start time (UTC):19:58:46
        Start date (UTC):02/04/2025
        Path:/etc/gdm3/PrimeOff/Default
        Arguments:/etc/gdm3/PrimeOff/Default
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        File Activities


        General

        Start time (UTC):19:58:46
        Start date (UTC):02/04/2025
        Path:/usr/sbin/gdm3
        Arguments:-
        File size:453296 bytes
        MD5 hash:2492e2d8d34f9377e3e530a61a15674f

        Process Activities


        General

        Start time (UTC):19:58:46
        Start date (UTC):02/04/2025
        Path:/etc/gdm3/PrimeOff/Default
        Arguments:/etc/gdm3/PrimeOff/Default
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        File Activities


        General

        Start time (UTC):19:58:46
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        File Activities

        Process Activities

        Network Activities


        General

        Start time (UTC):19:58:46
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        File Activities

        Process Activities

        Network Activities


        General

        Start time (UTC):19:58:47
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Process Activities


        General

        Start time (UTC):19:58:47
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:/usr/bin/gpu-manager --log /var/log/gpu-manager.log
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        File Activities

        Process Activities

        System Activities


        General

        Start time (UTC):19:58:47
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:58:47
        Start date (UTC):02/04/2025
        Path:/bin/sh
        Arguments:sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        File Activities

        Process Activities


        General

        Start time (UTC):19:58:47
        Start date (UTC):02/04/2025
        Path:/bin/sh
        Arguments:-
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Process Activities


        General

        Start time (UTC):19:58:47
        Start date (UTC):02/04/2025
        Path:/usr/bin/grep
        Arguments:grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
        File size:199136 bytes
        MD5 hash:1e6ebb9dd094f774478f72727bdba0f5

        File Activities


        General

        Start time (UTC):19:58:47
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:58:47
        Start date (UTC):02/04/2025
        Path:/bin/sh
        Arguments:sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        File Activities

        Process Activities


        General

        Start time (UTC):19:58:47
        Start date (UTC):02/04/2025
        Path:/bin/sh
        Arguments:-
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Process Activities


        General

        Start time (UTC):19:58:47
        Start date (UTC):02/04/2025
        Path:/usr/bin/grep
        Arguments:grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
        File size:199136 bytes
        MD5 hash:1e6ebb9dd094f774478f72727bdba0f5

        File Activities


        General

        Start time (UTC):19:58:48
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:58:48
        Start date (UTC):02/04/2025
        Path:/bin/sh
        Arguments:sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        File Activities

        Process Activities


        General

        Start time (UTC):19:58:48
        Start date (UTC):02/04/2025
        Path:/bin/sh
        Arguments:-
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Process Activities


        General

        Start time (UTC):19:58:48
        Start date (UTC):02/04/2025
        Path:/usr/bin/grep
        Arguments:grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
        File size:199136 bytes
        MD5 hash:1e6ebb9dd094f774478f72727bdba0f5

        File Activities


        General

        Start time (UTC):19:58:48
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:58:48
        Start date (UTC):02/04/2025
        Path:/bin/sh
        Arguments:sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        File Activities

        Process Activities


        General

        Start time (UTC):19:58:48
        Start date (UTC):02/04/2025
        Path:/bin/sh
        Arguments:-
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Process Activities


        General

        Start time (UTC):19:58:48
        Start date (UTC):02/04/2025
        Path:/usr/bin/grep
        Arguments:grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
        File size:199136 bytes
        MD5 hash:1e6ebb9dd094f774478f72727bdba0f5

        File Activities


        General

        Start time (UTC):19:58:48
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:58:48
        Start date (UTC):02/04/2025
        Path:/bin/sh
        Arguments:sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        File Activities

        Process Activities


        General

        Start time (UTC):19:58:48
        Start date (UTC):02/04/2025
        Path:/bin/sh
        Arguments:-
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Process Activities


        General

        Start time (UTC):19:58:48
        Start date (UTC):02/04/2025
        Path:/usr/bin/grep
        Arguments:grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
        File size:199136 bytes
        MD5 hash:1e6ebb9dd094f774478f72727bdba0f5

        File Activities


        General

        Start time (UTC):19:58:48
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:58:48
        Start date (UTC):02/04/2025
        Path:/bin/sh
        Arguments:sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        File Activities

        Process Activities


        General

        Start time (UTC):19:58:48
        Start date (UTC):02/04/2025
        Path:/bin/sh
        Arguments:-
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Process Activities


        General

        Start time (UTC):19:58:48
        Start date (UTC):02/04/2025
        Path:/usr/bin/grep
        Arguments:grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
        File size:199136 bytes
        MD5 hash:1e6ebb9dd094f774478f72727bdba0f5

        File Activities


        General

        Start time (UTC):19:58:48
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:58:48
        Start date (UTC):02/04/2025
        Path:/bin/sh
        Arguments:sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        File Activities

        Process Activities


        General

        Start time (UTC):19:58:48
        Start date (UTC):02/04/2025
        Path:/bin/sh
        Arguments:-
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Process Activities


        General

        Start time (UTC):19:58:48
        Start date (UTC):02/04/2025
        Path:/usr/bin/grep
        Arguments:grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
        File size:199136 bytes
        MD5 hash:1e6ebb9dd094f774478f72727bdba0f5

        File Activities


        General

        Start time (UTC):19:58:48
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:58:48
        Start date (UTC):02/04/2025
        Path:/bin/sh
        Arguments:sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        File Activities

        Process Activities


        General

        Start time (UTC):19:58:48
        Start date (UTC):02/04/2025
        Path:/bin/sh
        Arguments:-
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Process Activities


        General

        Start time (UTC):19:58:48
        Start date (UTC):02/04/2025
        Path:/usr/bin/grep
        Arguments:grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
        File size:199136 bytes
        MD5 hash:1e6ebb9dd094f774478f72727bdba0f5

        File Activities


        General

        Start time (UTC):19:58:48
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd (deleted)
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Process Activities


        General

        Start time (UTC):19:58:48
        Start date (UTC):02/04/2025
        Path:/usr/share/gdm/generate-config
        Arguments:/usr/share/gdm/generate-config
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        File Activities

        Process Activities


        General

        Start time (UTC):19:58:49
        Start date (UTC):02/04/2025
        Path:/usr/share/gdm/generate-config
        Arguments:-
        File size:129816 bytes
        MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

        Process Activities


        General

        Start time (UTC):19:58:49
        Start date (UTC):02/04/2025
        Path:/usr/bin/pkill
        Arguments:pkill --signal HUP --uid gdm dconf-service
        File size:30968 bytes
        MD5 hash:fa96a75a08109d8842e4865b2907d51f

        File Activities

        Network Activities


        General

        Start time (UTC):19:58:50
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd (deleted)
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Process Activities


        General

        Start time (UTC):19:58:50
        Start date (UTC):02/04/2025
        Path:/usr/lib/gdm3/gdm-wait-for-drm
        Arguments:/usr/lib/gdm3/gdm-wait-for-drm
        File size:14640 bytes
        MD5 hash:82043ba752c6930b4e6aaea2f7747545

        File Activities


        General

        Start time (UTC):19:58:50
        Start date (UTC):02/04/2025
        Path:/usr/libexec/gvfsd-fuse
        Arguments:-
        File size:47632 bytes
        MD5 hash:d18fbf1cbf8eb57b17fac48b7b4be933

        Process Activities


        General

        Start time (UTC):19:58:50
        Start date (UTC):02/04/2025
        Path:/bin/fusermount
        Arguments:fusermount -u -q -z -- /run/user/1000/gvfs
        File size:39144 bytes
        MD5 hash:576a1b135c82bdcbc97a91acea900566

        File Activities

        Network Activities


        General

        Start time (UTC):19:59:00
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd (deleted)
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Process Activities


        General

        Start time (UTC):19:59:00
        Start date (UTC):02/04/2025
        Path:/usr/sbin/gdm3
        Arguments:/usr/sbin/gdm3
        File size:453296 bytes
        MD5 hash:2492e2d8d34f9377e3e530a61a15674f

        File Activities

        Process Activities

        Network Activities


        General

        Start time (UTC):19:59:00
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd (deleted)
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        File Activities

        Process Activities

        Network Activities


        General

        Start time (UTC):19:59:00
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd (deleted)
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        File Activities

        Process Activities

        Network Activities


        General

        Start time (UTC):19:59:00
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd (deleted)
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        File Activities

        Process Activities

        Network Activities


        General

        Start time (UTC):19:59:00
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd (deleted)
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        File Activities

        Process Activities

        Network Activities


        General

        Start time (UTC):19:59:00
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd (deleted)
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        File Activities

        Process Activities

        Network Activities


        General

        Start time (UTC):19:59:18
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd (deleted)
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Process Activities


        General

        Start time (UTC):19:59:18
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:/usr/bin/gpu-manager --log /var/log/gpu-manager.log
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        File Activities

        Process Activities

        System Activities


        General

        Start time (UTC):19:59:18
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:18
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:18
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:18
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:18
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:18
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:18
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:18
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:18
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd (deleted)
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        File Activities

        Process Activities

        Network Activities


        General

        Start time (UTC):19:59:19
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd (deleted)
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Process Activities


        General

        Start time (UTC):19:59:19
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:/usr/bin/gpu-manager --log /var/log/gpu-manager.log
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        File Activities

        Process Activities

        System Activities


        General

        Start time (UTC):19:59:19
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:19
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:20
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:20
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:20
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:20
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:20
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:20
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:20
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd (deleted)
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        File Activities

        Process Activities

        Network Activities


        General

        Start time (UTC):19:59:21
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd (deleted)
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Process Activities


        General

        Start time (UTC):19:59:21
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:/usr/bin/gpu-manager --log /var/log/gpu-manager.log
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        File Activities

        Process Activities

        System Activities


        General

        Start time (UTC):19:59:21
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:21
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:21
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:21
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:21
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:21
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:21
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:21
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:22
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd (deleted)
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        File Activities

        Process Activities

        Network Activities


        General

        Start time (UTC):19:59:23
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd (deleted)
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Process Activities


        General

        Start time (UTC):19:59:23
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:/usr/bin/gpu-manager --log /var/log/gpu-manager.log
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        File Activities

        Process Activities

        System Activities


        General

        Start time (UTC):19:59:23
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:23
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:23
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:23
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:23
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:23
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:23
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:23
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:23
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd (deleted)
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        File Activities

        Process Activities

        Network Activities


        General

        Start time (UTC):19:59:24
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd (deleted)
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Process Activities


        General

        Start time (UTC):19:59:24
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:/usr/bin/gpu-manager --log /var/log/gpu-manager.log
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        File Activities

        Process Activities

        System Activities


        General

        Start time (UTC):19:59:25
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:25
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:25
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:25
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:25
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:25
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:25
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:25
        Start date (UTC):02/04/2025
        Path:/usr/bin/gpu-manager
        Arguments:-
        File size:76616 bytes
        MD5 hash:8fae9dd5dd67e1f33d873089c2fd8761

        Process Activities


        General

        Start time (UTC):19:59:25
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd (deleted)
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        File Activities

        Process Activities

        Network Activities


        General

        Start time (UTC):19:59:26
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd (deleted)
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        Process Activities


        General

        Start time (UTC):19:59:26
        Start date (UTC):02/04/2025
        Path:/bin/plymouth
        Arguments:/bin/plymouth quit
        File size:51352 bytes
        MD5 hash:87003efd8dad470042f5e75360a8f49f

        File Activities

        Network Activities


        General

        Start time (UTC):20:00:21
        Start date (UTC):02/04/2025
        Path:/usr/lib/systemd/systemd (deleted)
        Arguments:-
        File size:1620224 bytes
        MD5 hash:9b2bec7092a40488108543f9334aab75

        File Activities

        Process Activities

        Network Activities