Edit tour

Linux Analysis Report
xd.x86_64.elf

Overview

General Information

Sample name:	xd.x86_64.elf
Analysis ID:	1655049
MD5:	da30210d545e603e163bac22726ed65d
SHA1:	9a2ce28ed93ee41f6f74808400c1e984a681c22b
SHA256:	4f728779fcd8935e6538a0496a5d9a925d704ef674c1492a448190757e1a640e
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	88
Range:	0 - 100

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Sample deletes itself

Sample is packed with UPX

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Sample contains only a LOAD segment without any section mappings

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1655049
Start date and time:	2025-04-02 22:22:15 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	xd.x86_64.elf
Detection:	MAL
Classification:	mal88.spre.troj.evad.linELF@0/3@3/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Process Tree

system is lnxubuntu20

xd.x86_64.elf (PID: 6253, Parent: 6175, MD5: da30210d545e603e163bac22726ed65d) Arguments: /tmp/xd.x86_64.elf

xd.x86_64.elf New Fork (PID: 6254, Parent: 6253)

xd.x86_64.elf New Fork (PID: 6255, Parent: 6253)

xd.x86_64.elf New Fork (PID: 6256, Parent: 6253)

xd.x86_64.elf New Fork (PID: 6257, Parent: 6256)

xd.x86_64.elf New Fork (PID: 6258, Parent: 6256)

xd.x86_64.elf New Fork (PID: 6259, Parent: 6256)

systemd New Fork (PID: 6265, Parent: 1)

journalctl (PID: 6265, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6283, Parent: 1)

systemd New Fork (PID: 6285, Parent: 1)

systemd New Fork (PID: 6286, Parent: 1)

systemd New Fork (PID: 6287, Parent: 1)

systemd New Fork (PID: 6288, Parent: 1)

systemd New Fork (PID: 6314, Parent: 1)

systemd New Fork (PID: 6317, Parent: 1)

gdm3 New Fork (PID: 6322, Parent: 1320)

Default (PID: 6322, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6328, Parent: 1)

systemd New Fork (PID: 6331, Parent: 1)

systemd New Fork (PID: 6332, Parent: 1)

systemd New Fork (PID: 6333, Parent: 1)

gdm3 New Fork (PID: 6334, Parent: 1320)

Default (PID: 6334, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6335, Parent: 1320)

Default (PID: 6335, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6336, Parent: 1860)

pulseaudio (PID: 6336, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6339, Parent: 1)

systemd New Fork (PID: 6342, Parent: 1)

systemd New Fork (PID: 6345, Parent: 1)

systemd New Fork (PID: 6346, Parent: 1)

systemd New Fork (PID: 6347, Parent: 1)

gvfsd-fuse New Fork (PID: 6348, Parent: 2038)

fusermount (PID: 6348, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

dash New Fork (PID: 6353, Parent: 4331)

rm (PID: 6353, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.ETONCyvNdi /tmp/tmp.ubUHepXbGx /tmp/tmp.VYqvwG4YcB

dash New Fork (PID: 6354, Parent: 4331)

rm (PID: 6354, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.ETONCyvNdi /tmp/tmp.ubUHepXbGx /tmp/tmp.VYqvwG4YcB

systemd (deleted) New Fork (PID: 6375, Parent: 1)

systemd (deleted) New Fork (PID: 6376, Parent: 1)

systemd (deleted) New Fork (PID: 6377, Parent: 1)

systemd (deleted) New Fork (PID: 6378, Parent: 1)

systemd (deleted) New Fork (PID: 6379, Parent: 1)

systemd (deleted) New Fork (PID: 6381, Parent: 1860)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
6255.1.0000000000400000.0000000000411000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6255.1.0000000000400000.0000000000411000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6255.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xed28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeda0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeddc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeea4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeeb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6255.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xc268:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6255.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xca57:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
6255.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xecd8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6255.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xb702:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xb810:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6255.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xc617:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6255.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0xbed2:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
6255.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xc8e2:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6255.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0xc0cb:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
6255.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x739f:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
6255.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x50f2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
6255.1.0000000000400000.0000000000411000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xe980:$x1: POST /cdn-cgi/ 0xf713:$s1: LCOGQGPTGP
6256.1.0000000000400000.0000000000411000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6256.1.0000000000400000.0000000000411000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6256.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xed28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeda0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeddc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeea4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeeb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6256.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xc268:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6256.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xca57:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
6256.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xecd8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6256.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xb702:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xb810:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6256.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xc617:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6256.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0xbed2:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
6256.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xc8e2:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6256.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0xc0cb:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
6256.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x739f:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
6256.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x50f2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
6256.1.0000000000400000.0000000000411000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xe980:$x1: POST /cdn-cgi/ 0xf713:$s1: LCOGQGPTGP
6253.1.0000000000400000.0000000000411000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6253.1.0000000000400000.0000000000411000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6253.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xed28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeda0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeddc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeea4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeeb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6253.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xc268:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6253.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xca57:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
6253.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xecd8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6253.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xb702:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xb810:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6253.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xc617:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6253.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0xbed2:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
6253.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xc8e2:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6253.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0xc0cb:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
6253.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x739f:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
6253.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x50f2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
6253.1.0000000000400000.0000000000411000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xe980:$x1: POST /cdn-cgi/ 0xf713:$s1: LCOGQGPTGP
6257.1.0000000000400000.0000000000411000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6257.1.0000000000400000.0000000000411000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6257.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xed28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeda0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeddc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeea4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeeb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6257.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xc268:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6257.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xca57:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
6257.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xecd8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6257.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xb702:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xb810:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6257.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xc617:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6257.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0xbed2:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
6257.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xc8e2:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6257.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0xc0cb:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
6257.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x739f:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
6257.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x50f2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
6257.1.0000000000400000.0000000000411000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xe980:$x1: POST /cdn-cgi/ 0xf713:$s1: LCOGQGPTGP
6258.1.0000000000400000.0000000000411000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6258.1.0000000000400000.0000000000411000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6258.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xed28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeda0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeddc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeea4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeeb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6258.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xc268:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6258.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xca57:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
6258.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xecd8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6258.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xb702:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xb810:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6258.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xc617:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6258.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0xbed2:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
6258.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xc8e2:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6258.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0xc0cb:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
6258.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x739f:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
6258.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x50f2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
6258.1.0000000000400000.0000000000411000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xe980:$x1: POST /cdn-cgi/ 0xf713:$s1: LCOGQGPTGP
6259.1.0000000000400000.0000000000411000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6259.1.0000000000400000.0000000000411000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6259.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xed28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xed8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeda0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeddc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xedf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xee90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeea4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xeeb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6259.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xc268:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6259.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xca57:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
6259.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0xecd8:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6259.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xb702:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xb810:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6259.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xc617:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6259.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0xbed2:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
6259.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xc8e2:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6259.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0xc0cb:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
6259.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_6a77af0f	unknown	unknown	0x739f:$a: 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41
6259.1.0000000000400000.0000000000411000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x50f2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
6259.1.0000000000400000.0000000000411000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xe980:$x1: POST /cdn-cgi/ 0xf713:$s1: LCOGQGPTGP
Process Memory Space: xd.x86_64.elf PID: 6259	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: xd.x86_64.elf PID: 6259	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: xd.x86_64.elf PID: 6259	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1480:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1494:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x150c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1520:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1534:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1548:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1570:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1584:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1598:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1610:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: xd.x86_64.elf PID: 6259	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1433:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 83 entries

Joe Sandbox Signatures

• AV Detection
• Bitcoin Miner
• Networking
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: xd.x86_64.elf	ReversingLabs: Detection: 44%
Source: xd.x86_64.elf	Virustotal: Detection: 40%			Perma Link

Source: /usr/bin/pulseaudio (PID: 6336)

Reads CPU info from /sys: /sys/devices/system/cpu/online

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.23:60540 -> 213.209.129.92:7887

Source: global traffic

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /tmp/xd.x86_64.elf (PID: 6254)	Socket: 0.0.0.0:23	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	Socket: 0.0.0.0:0	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	Socket: 0.0.0.0:80	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	Socket: 0.0.0.0:81	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	Socket: 0.0.0.0:8443	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	Socket: 0.0.0.0:9009	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 213.209.129.92
Source: unknown	TCP traffic detected without corresponding DNS query: 47.74.245.4
Source: unknown	TCP traffic detected without corresponding DNS query: 169.65.254.4
Source: unknown	TCP traffic detected without corresponding DNS query: 98.156.56.4
Source: unknown	TCP traffic detected without corresponding DNS query: 159.83.115.254
Source: unknown	TCP traffic detected without corresponding DNS query: 222.153.227.124
Source: unknown	TCP traffic detected without corresponding DNS query: 113.126.186.102
Source: unknown	TCP traffic detected without corresponding DNS query: 211.217.205.48
Source: unknown	TCP traffic detected without corresponding DNS query: 197.211.47.179
Source: unknown	TCP traffic detected without corresponding DNS query: 66.79.107.46
Source: unknown	TCP traffic detected without corresponding DNS query: 20.109.185.224
Source: unknown	TCP traffic detected without corresponding DNS query: 152.174.136.39
Source: unknown	TCP traffic detected without corresponding DNS query: 31.72.54.88
Source: unknown	TCP traffic detected without corresponding DNS query: 223.211.252.187
Source: unknown	TCP traffic detected without corresponding DNS query: 36.184.241.75
Source: unknown	TCP traffic detected without corresponding DNS query: 177.24.242.225
Source: unknown	TCP traffic detected without corresponding DNS query: 19.122.3.137
Source: unknown	TCP traffic detected without corresponding DNS query: 147.61.104.40
Source: unknown	TCP traffic detected without corresponding DNS query: 221.150.20.20
Source: unknown	TCP traffic detected without corresponding DNS query: 185.221.153.116
Source: unknown	TCP traffic detected without corresponding DNS query: 183.226.82.233
Source: unknown	TCP traffic detected without corresponding DNS query: 59.113.204.131
Source: unknown	TCP traffic detected without corresponding DNS query: 1.247.200.215
Source: unknown	TCP traffic detected without corresponding DNS query: 98.166.19.192
Source: unknown	TCP traffic detected without corresponding DNS query: 4.206.55.32
Source: unknown	TCP traffic detected without corresponding DNS query: 243.111.219.72
Source: unknown	TCP traffic detected without corresponding DNS query: 197.168.5.245
Source: unknown	TCP traffic detected without corresponding DNS query: 98.80.139.237
Source: unknown	TCP traffic detected without corresponding DNS query: 219.9.109.71
Source: unknown	TCP traffic detected without corresponding DNS query: 12.101.87.13
Source: unknown	TCP traffic detected without corresponding DNS query: 14.228.33.68
Source: unknown	TCP traffic detected without corresponding DNS query: 183.206.90.166
Source: unknown	TCP traffic detected without corresponding DNS query: 114.96.115.98
Source: unknown	TCP traffic detected without corresponding DNS query: 101.75.48.100
Source: unknown	TCP traffic detected without corresponding DNS query: 187.60.85.75
Source: unknown	TCP traffic detected without corresponding DNS query: 243.150.52.182
Source: unknown	TCP traffic detected without corresponding DNS query: 174.28.2.239
Source: unknown	TCP traffic detected without corresponding DNS query: 117.66.139.247
Source: unknown	TCP traffic detected without corresponding DNS query: 17.182.12.243
Source: unknown	TCP traffic detected without corresponding DNS query: 189.214.238.199
Source: unknown	TCP traffic detected without corresponding DNS query: 179.117.62.115
Source: unknown	TCP traffic detected without corresponding DNS query: 71.182.67.197
Source: unknown	TCP traffic detected without corresponding DNS query: 117.82.198.166
Source: unknown	TCP traffic detected without corresponding DNS query: 125.69.202.61
Source: unknown	TCP traffic detected without corresponding DNS query: 186.4.103.114
Source: unknown	TCP traffic detected without corresponding DNS query: 205.151.7.109
Source: unknown	TCP traffic detected without corresponding DNS query: 4.91.14.104
Source: unknown	TCP traffic detected without corresponding DNS query: 220.168.243.163
Source: unknown	TCP traffic detected without corresponding DNS query: 197.168.197.123
Source: unknown	TCP traffic detected without corresponding DNS query: 13.145.171.235

Source: global traffic

DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: xd.x86_64.elf

String found in binary or memory: http://upx.sf.net

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53082
Source: unknown	Network traffic detected: HTTP traffic on port 39256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53082 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 6255.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6255.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6255.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6255.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6255.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6255.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6255.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 6255.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6255.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 6255.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 6255.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6255.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6256.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6256.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6256.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6256.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6256.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6256.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6256.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 6256.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6256.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 6256.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 6256.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6256.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6253.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6253.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6253.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6253.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6253.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6253.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6253.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 6253.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6253.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 6253.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 6253.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6253.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6257.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6257.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6257.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6257.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6257.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6257.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6257.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 6257.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6257.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 6257.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 6257.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6257.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6258.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6258.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6258.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6258.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6258.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6258.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6258.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 6258.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6258.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 6258.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 6258.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6258.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6259.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6259.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6259.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6259.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6259.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6259.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6259.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 6259.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6259.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 6259.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f Author: unknown
Source: 6259.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6259.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: Process Memory Space: xd.x86_64.elf PID: 6259, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: xd.x86_64.elf PID: 6259, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 788, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 789, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 2009, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 6085, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 6234, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 6235, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 6330, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 6336, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6256)	SIGKILL sent: pid: -6256, result: unknown	Jump to behavior

Source: LOAD without section mappings

Program segment: 0x100000

Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 788, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 789, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 2009, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 6085, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 6234, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 6235, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 6330, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	SIGKILL sent: pid: 6336, result: successful	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6256)	SIGKILL sent: pid: -6256, result: unknown	Jump to behavior

Source: 6255.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6255.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6255.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6255.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6255.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6255.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6255.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 6255.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6255.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 6255.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 6255.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6255.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6256.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6256.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6256.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6256.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6256.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6256.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6256.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 6256.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6256.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 6256.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 6256.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6256.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6253.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6253.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6253.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6253.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6253.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6253.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6253.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 6253.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6253.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 6253.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 6253.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6253.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6257.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6257.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6257.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6257.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6257.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6257.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6257.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 6257.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6257.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 6257.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 6257.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6257.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6258.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6258.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6258.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6258.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6258.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6258.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6258.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 6258.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6258.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 6258.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 6258.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6258.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6259.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6259.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6259.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6259.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6259.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6259.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6259.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 6259.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6259.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 6259.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_6a77af0f os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016, id = 6a77af0f-31fa-4793-82aa-10b065ba1ec0, last_modified = 2021-09-16
Source: 6259.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6259.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: Process Memory Space: xd.x86_64.elf PID: 6259, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: xd.x86_64.elf PID: 6259, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal88.spre.troj.evad.linELF@0/3@3/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /bin/fusermount (PID: 6348)

File: /proc/6348/mounts

Jump to behavior

Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/6197/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/4331/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/1582/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/2033/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/3088/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/670/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/2746/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/4727/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/793/fd	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/1579/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/1612/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/674/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/796/fd	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/796/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/675/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/1532/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/1576/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/2302/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/676/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/797/fd	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/677/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/799/fd	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/799/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/910/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/4444/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/4521/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/4445/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/912/fd	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/912/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/4446/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/759/fd	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/517/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/2749/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/2307/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/918/fd	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/918/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/1594/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/2285/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/2281/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/1349/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/1/fd	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/761/fd	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/884/fd	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/884/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/1389/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/2038/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/720/fd	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/1465/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/1586/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/721/fd	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/1463/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/800/fd	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/800/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/801/fd	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/801/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/847/fd	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/847/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/6254/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/4430/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/3021/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/491/fd	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/2294/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/772/fd	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/2128/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/1599/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/774/fd	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/1477/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/654/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/896/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/1476/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/655/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/1475/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/2289/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/777/fd	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/656/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/2761/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/2882/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/657/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/658/fd	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/6204/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/936/fd	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/419/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/6209/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/6329/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/2208/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/2180/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/4443/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/1494/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/6381/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/1601/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/420/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/2018/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/1489/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/785/fd	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/2014/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/667/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/788/fd	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/789/fd	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/904/fd	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/904/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/1207/exe	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File opened: /proc/4517/exe	Jump to behavior

Source: /usr/bin/dash (PID: 6353)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.ETONCyvNdi /tmp/tmp.ubUHepXbGx /tmp/tmp.VYqvwG4YcB			Jump to behavior
Source: /usr/bin/dash (PID: 6354)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.ETONCyvNdi /tmp/tmp.ubUHepXbGx /tmp/tmp.VYqvwG4YcB			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/xd.x86_64.elf (PID: 6254)	File: /usr/sbin/gdm3	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File: /usr/lib/systemd/systemd	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File: /usr/lib/systemd/systemd (deleted)	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File: /usr/bin/dash	Jump to behavior
Source: /tmp/xd.x86_64.elf (PID: 6254)	File: /usr/bin/pulseaudio	Jump to behavior

Source: xd.x86_64.elf

Submission file: segment LOAD with 7.9483 entropy (max. 8.0)

Source: /usr/bin/pulseaudio (PID: 6336)

Reads CPU info from /sys: /sys/devices/system/cpu/online

Jump to behavior

Source: /usr/bin/pulseaudio (PID: 6336)

Queries kernel information via 'uname':

Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 6255.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6256.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6253.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6257.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6258.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6259.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xd.x86_64.elf PID: 6259, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 6255.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6256.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6253.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6257.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6258.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6259.1.0000000000400000.0000000000411000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xd.x86_64.elf PID: 6259, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 File Deletion	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
xd.x86_64.elf	44%	ReversingLabs	Linux.Backdoor.Mirai
xd.x86_64.elf	41%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	xd.x86_64.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
152.174.136.39	unknown	Chile	7418	TELEFONICACHILESACL	false
98.166.19.192	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
12.101.87.13	unknown	United States	7018	ATT-INTERNET4US	false
24.194.232.236	unknown	United States	11351	TWC-11351-NORTHEASTUS	false
207.96.68.177	unknown	United States	6079	RCN-ASUS	false
187.60.85.75	unknown	Brazil	28220	CABOSERVICOSDETELECOMUNICACOESLTDABR	false
124.255.249.23	unknown	Japan	4686	BEKKOAMEBEKKOAMEINTERNETINCJP	false
114.96.115.98	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
191.50.84.166	unknown	Brazil	26615	TIMSABR	false
71.51.242.235	unknown	United States	18494	CENTURYLINK-LEGACY-EMBARQ-WRBGUS	false
91.91.205.110	unknown	France	35238	CONNEXIA-ASFR	false
254.251.234.175	unknown	Reserved	unknown	unknown	false
92.174.92.247	unknown	France	3215	FranceTelecom-OrangeFR	false
243.150.52.182	unknown	Reserved	unknown	unknown	false
43.136.94.98	unknown	Japan	4249	LILLY-ASUS	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false
122.3.58.44	unknown	Philippines	9299	IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH	false
136.252.64.192	unknown	United States	10255	SINISTERUS	false
98.156.56.4	unknown	United States	11427	TWC-11427-TEXASUS	false
17.182.12.243	unknown	United States	714	APPLE-ENGINEERINGUS	false
141.32.134.40	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
120.52.249.6	unknown	China	133119	UNICOM-CNChinaUnicomIPnetworkCN	false
104.208.116.237	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
59.113.204.131	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
183.206.90.166	unknown	China	56046	CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN	false
4.206.55.32	unknown	United States	3356	LEVEL3US	false
211.217.205.48	unknown	Korea Republic of	45362	TRUSTONASSET-AS-KRTRUSTONASSETKR	false
221.150.20.20	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
8.42.167.17	unknown	United States	13335	CLOUDFLARENETUS	false
70.223.132.6	unknown	United States	22394	CELLCOUS	false
158.212.171.14	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
117.82.198.166	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
101.35.245.2	unknown	China	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	false
115.148.177.190	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
151.37.120.12	unknown	Italy	1267	ASN-WINDTREIUNETEU	false
90.120.34.196	unknown	France	3215	FranceTelecom-OrangeFR	false
222.153.227.124	unknown	New Zealand	4771	SPARKNZSparkNewZealandTradingLtdNZ	false
100.236.74.215	unknown	United States	21928	T-MOBILE-AS21928US	false
113.126.186.102	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
44.236.41.247	unknown	United States	16509	AMAZON-02US	false
14.228.33.68	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
217.204.74.148	unknown	United Kingdom	4589	EASYNETEasynetGlobalServicesEU	false
114.39.175.17	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
20.149.113.117	unknown	United States	4237	CSC-IGN-FTWUS	false
119.204.98.215	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
34.249.145.219	unknown	United States	16509	AMAZON-02US	false
13.145.171.235	unknown	United States	7018	ATT-INTERNET4US	false
241.71.4.66	unknown	Reserved	unknown	unknown	false
209.219.206.166	unknown	United States	7029	WINDSTREAMUS	false
12.179.225.205	unknown	United States	7018	ATT-INTERNET4US	false
117.66.139.247	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
19.122.3.137	unknown	United States	3	MIT-GATEWAYSUS	false
104.183.102.201	unknown	United States	7018	ATT-INTERNET4US	false
194.104.25.140	unknown	Netherlands	1136	KPNKPNNationalEU	false
190.186.190.158	unknown	Bolivia	25620	COTASLTDABO	false
130.38.204.213	unknown	United States	21899	ABBOTTUS	false
210.57.28.241	unknown	Hong Kong	4637	ASN-TELSTRA-GLOBALTelstraGlobalHK	false
197.211.47.179	unknown	Nigeria	37148	globacom-asNG	false
97.93.106.190	unknown	United States	20115	CHARTER-20115US	false
101.75.48.100	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
244.22.182.171	unknown	Reserved	unknown	unknown	false
147.61.104.40	unknown	United States	4193	WA-STATE-GOVUS	false
75.224.83.251	unknown	United States	22394	CELLCOUS	false
66.79.107.46	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
9.93.64.113	unknown	United States	3356	LEVEL3US	false
118.158.2.83	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
87.236.74.43	unknown	France	3215	FranceTelecom-OrangeFR	false
213.209.129.92	unknown	Germany	42821	RAPIDNET-DEHaunstetterStr19DE	false
13.216.164.217	unknown	United States	16509	AMAZON-02US	false
95.82.190.255	unknown	Czech Republic	31246	NETBOX-ASNETBOXAutonomoussystemCZ	false
218.43.173.248	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
180.216.62.175	unknown	Australia	4804	MPX-ASMicroplexPTYLTDAU	false
205.220.214.25	unknown	United States	55039	FATBEAM-ASUS	false
246.219.71.186	unknown	Reserved	unknown	unknown	false
205.151.7.109	unknown	Canada	376	RISQ-ASCA	false
189.214.238.199	unknown	Mexico	28509	CablemasTelecomunicacionesSAdeCVMX	false
110.54.86.5	unknown	Japan	7679	QTNETQTnetIncJP	false
4.187.24.73	unknown	United States	3356	LEVEL3US	false
135.95.204.32	unknown	United States	29705	MOTIVE-COMMUNICATIONS-INCORPORATEDUS	false
223.211.252.187	unknown	China	7497	CSTNET-AS-APComputerNetworkInformationCenterCN	false
84.164.183.16	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
83.9.10.165	unknown	Poland	5617	TPNETPL	false
169.65.254.4	unknown	United States	37611	AfrihostZA	false
144.13.116.162	unknown	United States	3128	BRUWS-AS3128US	false
62.73.180.135	unknown	United Kingdom	2914	NTT-COMMUNICATIONS-2914US	false
164.57.212.177	unknown	United States	3145	WESTPUB-ASUS	false
210.2.251.145	unknown	Japan	24276	ICNETJupiterTelecommunicationsCoLtdJP	false
148.69.56.69	unknown	Portugal	12353	VODAFONE-PTVodafonePortugalPT	false
160.231.88.25	unknown	France	41935	DASSAULTSYSTEMES-ASPleasevisithttpwww3dscomFR	false
197.168.5.245	unknown	South Africa	37168	CELL-CZA	false
102.188.122.173	unknown	Egypt	24835	RAYA-ASEG	false
133.34.80.227	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
162.213.35.25	unknown	United States	41231	CANONICAL-ASGB	false
17.155.74.159	unknown	United States	714	APPLE-ENGINEERINGUS	false
100.11.206.135	unknown	United States	701	UUNETUS	false
94.53.80.124	unknown	Romania	48161	NG-ASSosBucuresti-Ploiestinr42-44RO	false
36.184.241.75	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
197.168.197.123	unknown	South Africa	37168	CELL-CZA	false
60.154.187.87	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
240.45.188.129	unknown	Reserved	unknown	unknown	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
91.189.91.42	xd.arm.elf	Get hash	malicious	Mirai	Browse
	xd.m68k.elf	Get hash	malicious	Mirai	Browse
	xd.mips.elf	Get hash	malicious	Mirai	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	xd.mpsl.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	xd.i686.elf	Get hash	malicious	Mirai	Browse
	xd.arm.elf	Get hash	malicious	Mirai	Browse
	xd.sh4.elf	Get hash	malicious	Mirai	Browse
	xd.arm5.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	xd.arm.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	xd.m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	xd.mips.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	xd.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	xd.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	xd.x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	xd.x86_64.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TWC-11351-NORTHEASTUS	xd.arm.elf	Get hash	malicious	Mirai	Browse	98.82.158.255
	xd.x86.elf	Get hash	malicious	Mirai	Browse	98.81.87.240
	xd.sh4.elf	Get hash	malicious	Mirai	Browse	98.91.152.18
	-Lysisfinancial_Executives_Schedule 6cLKF4B .svg	Get hash	malicious	HTMLPhisher	Browse	98.82.154.76
	xd.mips.elf	Get hash	malicious	Mirai	Browse	98.90.130.223
	xd.mpsl.elf	Get hash	malicious	Mirai	Browse	184.74.55.220
	https://wetransfer.com/downloads/2971136d8b665852eb1f874db092eba220250401114650/596f3cb65b7858fdbbd45a98e463335420250401114650/9efedd?t_exp=1743767210&t_lsid=52fe332d-a748-433b-8af3-fc8487bab09a&t_network=email&t_rid=ZW1haWx8YWRyb2l0fDg1MzA4Yzg5LWMzYjktNDZiZS04MWU5LTViYTJmN2Y1ZjMyZg%3D%3D&t_s=download_link&t_ts=1743508010&utm_campaign=TRN_TDL_01&utm_source=sendgrid&utm_medium=email&trk=TRN_TDL_01	Get hash	malicious	Unknown	Browse	98.82.154.76
	x86_64.elf	Get hash	malicious	Unknown	Browse	67.248.51.240
	https://wetransfer.com/downloads/f0d1df3ef20023b7016e8ba0ead8821d20250331073743/af49c1?t_exp=1743665884	Get hash	malicious	Unknown	Browse	98.82.157.137
	https://snmk9.mjt.lu/lnk/AbwAACYavtgAAAAAAAAAA9w61AIAAYKJhcUAAAAAAC6lwQBn6to4aszawEFKTWWSkCgledCSEgAq1OY/1/JgYawQoManMiPR4Ur62Q1g/aHR0cHM6Ly9vYXV0aC5neXlwb28uY29tLw	Get hash	malicious	Unknown	Browse	98.82.158.241
ATT-INTERNET4US	xd.arm.elf	Get hash	malicious	Mirai	Browse	69.0.25.214
	xd.ppc.elf	Get hash	malicious	Mirai	Browse	99.182.134.173
	xd.spc.elf	Get hash	malicious	Mirai	Browse	99.169.34.134
	xd.mips.elf	Get hash	malicious	Mirai	Browse	13.141.213.197
	xd.x86.elf	Get hash	malicious	Mirai	Browse	107.128.57.24
	xd.powerpc-440fp.elf	Get hash	malicious	Mirai	Browse	45.16.142.91
	xd.x86.elf	Get hash	malicious	Mirai	Browse	206.121.192.0
	xd.sh4.elf	Get hash	malicious	Mirai	Browse	172.143.133.21
	xd.x86_64.elf	Get hash	malicious	Mirai	Browse	13.168.105.138
	http://vsuite-emea.omnicell.com	Get hash	malicious	Unknown	Browse	13.43.120.10
TELEFONICACHILESACL	xd.x86.elf	Get hash	malicious	Mirai	Browse	186.104.136.97
	bimbo-x86.elf	Get hash	malicious	Unknown	Browse	191.113.74.248
	vjwe68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	190.20.195.188
	bejv86.elf	Get hash	malicious	Mirai	Browse	200.28.64.231
	weje64.elf	Get hash	malicious	Gafgyt, Mirai	Browse	191.125.183.130
	sora.ppc.elf	Get hash	malicious	Unknown	Browse	190.20.147.247
	sora.x86.elf	Get hash	malicious	Mirai	Browse	190.21.225.115
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	200.112.64.95
	drea4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	200.90.189.114
	g4za.arm7.elf	Get hash	malicious	Mirai	Browse	186.106.106.183
ASN-CXA-ALL-CCI-22773-RDCUS	xd.spc.elf	Get hash	malicious	Mirai	Browse	98.175.169.159
	xd.sh4.elf	Get hash	malicious	Mirai	Browse	70.182.246.7
	xd.x86_64.elf	Get hash	malicious	Mirai	Browse	72.203.37.240
	utorrent_installer.exe	Get hash	malicious	Unknown	Browse	70.170.6.32
	xd.mips.elf	Get hash	malicious	Mirai	Browse	24.252.38.0
	xd.arm7.elf	Get hash	malicious	Mirai	Browse	70.176.53.221
	xd.i686.elf	Get hash	malicious	Mirai	Browse	70.169.18.31
	xd.mpsl.elf	Get hash	malicious	Mirai	Browse	70.188.235.18
	xd.i486.elf	Get hash	malicious	Mirai	Browse	174.64.40.90
	https://snu2i.mjt.lu/lnk/AVUAAGf9XKgAAAAAAAAAA9xrFsMAAYKJjLUAAAAAAC68kgBn7Bfqac3lXyTWRGaDtKriXw3emQAq56U/1/cdW9bHmcUWqJ_AB7I3vlvw/aHR0cHM6Ly9jb25zdC5mb3Jtc3RhY2suY29tL2Zvcm1zL2l0Zg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	23.58.157.16

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.5219280948873621
Encrypted:	false
SSDEEP:	3:dj:J
MD5:	5FC77DCCF0EFC30E3C69B7DCEEECF389
SHA1:	3B0255FD55F52F80F4086713174995D855AE29CE
SHA-256:	6B6388156BBDBB41C5D7670CEB44DA7DDF7319F2D652B736435261FE96E317DC
SHA-512:	F6B6FE318E8989E087425978D0E3F5A8E23A1DEA4A75517B0051D4C3173F9B096576174F7B5185CD421644111198B12FF511458EDABD6E9E6B7C61336F1FBC40
Malicious:	false
Reputation:	low
Preview:	6336.

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, no section header
Entropy (8bit):	7.944765349327055
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	xd.x86_64.elf
File size:	30'488 bytes
MD5:	da30210d545e603e163bac22726ed65d
SHA1:	9a2ce28ed93ee41f6f74808400c1e984a681c22b
SHA256:	4f728779fcd8935e6538a0496a5d9a925d704ef674c1492a448190757e1a640e
SHA512:	888554e52e2ebbde990a5ab2870cece96668ce4b907fe2511f6b603e59954cd79084802faaab8cec44bc903bfededfd0de33aabc3c9ca74222062f39dbc66431
SSDEEP:	768:Z2noTTyY+RHt+D14ir8TSkN+sQBBJx0f5:ooXqRHAPr8TSkdy65
TLSH:	89D2D0D7852B9379E4255CF981281EC4F1847863E1028BAE1EED31FF6C776145B50DB0
File Content Preview:	.ELF..............>......d......@...................@.8...@.....................................$v......$v................................Q.......Q.............................Q.td.....................................................F.DUPX!D..............

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x1064e8
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	64
Number of Section Headers:	0
Header String Table Index:	0

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x100000	0x100000	0x7624	0x7624	7.9483	0x5	R E	0x100000
LOAD	0x8a8	0x5118a8	0x5118a8	0x0	0x0	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 2, 2025 22:23:29.910542011 CEST	60540	7887	192.168.2.23	213.209.129.92
Apr 2, 2025 22:23:29.918884039 CEST	22175	23	192.168.2.23	47.74.245.4
Apr 2, 2025 22:23:29.918884993 CEST	22175	23	192.168.2.23	83.9.10.165
Apr 2, 2025 22:23:29.918891907 CEST	22175	23	192.168.2.23	169.65.254.4
Apr 2, 2025 22:23:29.918911934 CEST	22175	23	192.168.2.23	98.156.56.4
Apr 2, 2025 22:23:29.918911934 CEST	22175	23	192.168.2.23	159.83.115.254
Apr 2, 2025 22:23:29.918914080 CEST	22175	23	192.168.2.23	222.153.227.124
Apr 2, 2025 22:23:29.918914080 CEST	22175	23	192.168.2.23	113.126.186.102
Apr 2, 2025 22:23:29.918914080 CEST	22175	23	192.168.2.23	211.217.205.48
Apr 2, 2025 22:23:29.918914080 CEST	22175	23	192.168.2.23	197.211.47.179
Apr 2, 2025 22:23:29.918919086 CEST	22175	23	192.168.2.23	66.79.107.46
Apr 2, 2025 22:23:29.918924093 CEST	22175	23	192.168.2.23	20.109.185.224
Apr 2, 2025 22:23:29.918924093 CEST	22175	23	192.168.2.23	189.210.204.225
Apr 2, 2025 22:23:29.918927908 CEST	22175	23	192.168.2.23	152.174.136.39
Apr 2, 2025 22:23:29.918927908 CEST	22175	23	192.168.2.23	31.72.54.88
Apr 2, 2025 22:23:29.918930054 CEST	22175	23	192.168.2.23	223.211.252.187
Apr 2, 2025 22:23:29.919326067 CEST	22175	23	192.168.2.23	36.184.241.75
Apr 2, 2025 22:23:29.919326067 CEST	22175	23	192.168.2.23	177.24.242.225
Apr 2, 2025 22:23:29.919326067 CEST	22175	23	192.168.2.23	19.122.3.137
Apr 2, 2025 22:23:29.919326067 CEST	22175	23	192.168.2.23	147.61.104.40
Apr 2, 2025 22:23:29.919326067 CEST	22175	23	192.168.2.23	221.150.20.20
Apr 2, 2025 22:23:29.919326067 CEST	22175	23	192.168.2.23	185.221.153.116
Apr 2, 2025 22:23:29.919326067 CEST	22175	23	192.168.2.23	183.226.82.233
Apr 2, 2025 22:23:29.919326067 CEST	22175	23	192.168.2.23	59.113.204.131
Apr 2, 2025 22:23:29.919332027 CEST	22175	23	192.168.2.23	1.247.200.215
Apr 2, 2025 22:23:29.919332027 CEST	22175	23	192.168.2.23	98.166.19.192
Apr 2, 2025 22:23:29.919332027 CEST	22175	23	192.168.2.23	4.206.55.32
Apr 2, 2025 22:23:29.919332027 CEST	22175	23	192.168.2.23	243.111.219.72
Apr 2, 2025 22:23:29.919333935 CEST	22175	23	192.168.2.23	197.168.5.245
Apr 2, 2025 22:23:29.919333935 CEST	22175	23	192.168.2.23	98.80.139.237
Apr 2, 2025 22:23:29.919333935 CEST	22175	23	192.168.2.23	219.9.109.71
Apr 2, 2025 22:23:29.919333935 CEST	22175	23	192.168.2.23	12.101.87.13
Apr 2, 2025 22:23:29.919332027 CEST	22175	23	192.168.2.23	14.228.33.68
Apr 2, 2025 22:23:29.919334888 CEST	22175	23	192.168.2.23	183.206.90.166
Apr 2, 2025 22:23:29.919332027 CEST	22175	23	192.168.2.23	114.96.115.98
Apr 2, 2025 22:23:29.919333935 CEST	22175	23	192.168.2.23	101.75.48.100
Apr 2, 2025 22:23:29.919338942 CEST	22175	23	192.168.2.23	187.60.85.75
Apr 2, 2025 22:23:29.919332027 CEST	22175	23	192.168.2.23	243.150.52.182
Apr 2, 2025 22:23:29.919333935 CEST	22175	23	192.168.2.23	174.28.2.239
Apr 2, 2025 22:23:29.919338942 CEST	22175	23	192.168.2.23	117.66.139.247
Apr 2, 2025 22:23:29.919334888 CEST	22175	23	192.168.2.23	17.182.12.243
Apr 2, 2025 22:23:29.919338942 CEST	22175	23	192.168.2.23	189.214.238.199
Apr 2, 2025 22:23:29.919332027 CEST	22175	23	192.168.2.23	179.117.62.115
Apr 2, 2025 22:23:29.919334888 CEST	22175	23	192.168.2.23	71.182.67.197
Apr 2, 2025 22:23:29.919338942 CEST	22175	23	192.168.2.23	117.82.198.166
Apr 2, 2025 22:23:29.919332981 CEST	22175	23	192.168.2.23	126.229.210.98
Apr 2, 2025 22:23:29.919333935 CEST	22175	23	192.168.2.23	210.2.251.145
Apr 2, 2025 22:23:29.919332027 CEST	22175	23	192.168.2.23	125.69.202.61
Apr 2, 2025 22:23:29.919333935 CEST	22175	23	192.168.2.23	186.4.103.114
Apr 2, 2025 22:23:29.919338942 CEST	22175	23	192.168.2.23	205.151.7.109
Apr 2, 2025 22:23:29.919334888 CEST	22175	23	192.168.2.23	4.91.14.104
Apr 2, 2025 22:23:29.919338942 CEST	22175	23	192.168.2.23	220.168.243.163
Apr 2, 2025 22:23:29.919338942 CEST	22175	23	192.168.2.23	197.168.197.123
Apr 2, 2025 22:23:29.919334888 CEST	22175	23	192.168.2.23	13.145.171.235
Apr 2, 2025 22:23:29.919338942 CEST	22175	23	192.168.2.23	60.154.187.87
Apr 2, 2025 22:23:29.919353962 CEST	22175	23	192.168.2.23	167.239.184.30
Apr 2, 2025 22:23:29.919332027 CEST	22175	23	192.168.2.23	90.5.232.64
Apr 2, 2025 22:23:29.919334888 CEST	22175	23	192.168.2.23	171.111.91.198
Apr 2, 2025 22:23:29.919354916 CEST	22175	23	192.168.2.23	100.11.206.135
Apr 2, 2025 22:23:29.919338942 CEST	22175	23	192.168.2.23	9.93.64.113
Apr 2, 2025 22:23:29.919332027 CEST	22175	23	192.168.2.23	9.188.19.119
Apr 2, 2025 22:23:29.919338942 CEST	22175	23	192.168.2.23	97.93.106.190
Apr 2, 2025 22:23:29.919332027 CEST	22175	23	192.168.2.23	115.148.177.190
Apr 2, 2025 22:23:29.919354916 CEST	22175	23	192.168.2.23	135.95.204.32
Apr 2, 2025 22:23:29.919334888 CEST	22175	23	192.168.2.23	203.115.20.110
Apr 2, 2025 22:23:29.919338942 CEST	22175	23	192.168.2.23	19.214.35.202
Apr 2, 2025 22:23:29.919332027 CEST	22175	23	192.168.2.23	144.13.116.162
Apr 2, 2025 22:23:29.919334888 CEST	22175	23	192.168.2.23	190.186.190.158
Apr 2, 2025 22:23:29.919338942 CEST	22175	23	192.168.2.23	109.113.67.226
Apr 2, 2025 22:23:29.919338942 CEST	22175	23	192.168.2.23	192.2.108.73
Apr 2, 2025 22:23:29.919354916 CEST	22175	23	192.168.2.23	241.71.4.66
Apr 2, 2025 22:23:29.919338942 CEST	22175	23	192.168.2.23	164.57.212.177
Apr 2, 2025 22:23:29.919338942 CEST	22175	23	192.168.2.23	104.208.116.237
Apr 2, 2025 22:23:29.919354916 CEST	22175	23	192.168.2.23	242.107.201.176
Apr 2, 2025 22:23:29.919354916 CEST	22175	23	192.168.2.23	211.121.44.1
Apr 2, 2025 22:23:29.919394016 CEST	22175	23	192.168.2.23	148.69.56.69
Apr 2, 2025 22:23:29.919394016 CEST	22175	23	192.168.2.23	244.22.182.171
Apr 2, 2025 22:23:29.919394016 CEST	22175	23	192.168.2.23	92.174.92.247
Apr 2, 2025 22:23:29.919394016 CEST	22175	23	192.168.2.23	90.120.34.196
Apr 2, 2025 22:23:29.919394016 CEST	22175	23	192.168.2.23	71.51.242.235
Apr 2, 2025 22:23:29.919394016 CEST	22175	23	192.168.2.23	191.50.84.166
Apr 2, 2025 22:23:29.919415951 CEST	22175	23	192.168.2.23	101.35.245.2
Apr 2, 2025 22:23:29.919415951 CEST	22175	23	192.168.2.23	95.82.190.255
Apr 2, 2025 22:23:29.919415951 CEST	22175	23	192.168.2.23	44.236.41.247
Apr 2, 2025 22:23:29.919415951 CEST	22175	23	192.168.2.23	20.149.113.117
Apr 2, 2025 22:23:29.919415951 CEST	22175	23	192.168.2.23	221.4.245.127
Apr 2, 2025 22:23:29.919415951 CEST	22175	23	192.168.2.23	100.236.74.215
Apr 2, 2025 22:23:29.919415951 CEST	22175	23	192.168.2.23	101.107.234.247
Apr 2, 2025 22:23:29.919421911 CEST	22175	23	192.168.2.23	73.201.109.204
Apr 2, 2025 22:23:29.919423103 CEST	22175	23	192.168.2.23	61.78.60.11
Apr 2, 2025 22:23:29.919421911 CEST	22175	23	192.168.2.23	124.255.249.23
Apr 2, 2025 22:23:29.919423103 CEST	22175	23	192.168.2.23	133.34.80.227
Apr 2, 2025 22:23:29.919421911 CEST	22175	23	192.168.2.23	209.219.206.166
Apr 2, 2025 22:23:29.919423103 CEST	22175	23	192.168.2.23	141.32.134.40
Apr 2, 2025 22:23:29.919421911 CEST	22175	23	192.168.2.23	210.57.28.241
Apr 2, 2025 22:23:29.919423103 CEST	22175	23	192.168.2.23	118.158.2.83
Apr 2, 2025 22:23:29.919421911 CEST	22175	23	192.168.2.23	92.226.235.94
Apr 2, 2025 22:23:29.919423103 CEST	22175	23	192.168.2.23	102.188.122.173
Apr 2, 2025 22:23:29.919423103 CEST	22175	23	192.168.2.23	160.231.88.25
Apr 2, 2025 22:23:29.919423103 CEST	22175	23	192.168.2.23	130.38.204.213
Apr 2, 2025 22:23:29.919423103 CEST	22175	23	192.168.2.23	24.194.232.236
Apr 2, 2025 22:23:29.919423103 CEST	22175	23	192.168.2.23	4.187.24.73
Apr 2, 2025 22:23:29.919429064 CEST	22175	23	192.168.2.23	41.251.85.43
Apr 2, 2025 22:23:29.919429064 CEST	22175	23	192.168.2.23	122.3.58.44
Apr 2, 2025 22:23:29.919429064 CEST	22175	23	192.168.2.23	13.216.164.217
Apr 2, 2025 22:23:29.919429064 CEST	22175	23	192.168.2.23	93.137.245.165
Apr 2, 2025 22:23:29.919429064 CEST	22175	23	192.168.2.23	116.187.97.118
Apr 2, 2025 22:23:29.919429064 CEST	22175	23	192.168.2.23	43.136.94.98
Apr 2, 2025 22:23:29.919429064 CEST	22175	23	192.168.2.23	202.25.26.241
Apr 2, 2025 22:23:29.919429064 CEST	22175	23	192.168.2.23	217.204.74.148
Apr 2, 2025 22:23:29.919440985 CEST	22175	23	192.168.2.23	109.70.163.252
Apr 2, 2025 22:23:29.919440985 CEST	22175	23	192.168.2.23	91.91.205.110
Apr 2, 2025 22:23:29.919440985 CEST	22175	23	192.168.2.23	246.219.71.186
Apr 2, 2025 22:23:29.919440985 CEST	22175	23	192.168.2.23	120.52.249.6
Apr 2, 2025 22:23:29.919440985 CEST	22175	23	192.168.2.23	151.37.120.12
Apr 2, 2025 22:23:29.919440985 CEST	22175	23	192.168.2.23	53.235.226.186
Apr 2, 2025 22:23:29.919440985 CEST	22175	23	192.168.2.23	207.96.68.177
Apr 2, 2025 22:23:29.919440985 CEST	22175	23	192.168.2.23	204.248.160.182
Apr 2, 2025 22:23:29.919465065 CEST	22175	23	192.168.2.23	43.57.246.118
Apr 2, 2025 22:23:29.919465065 CEST	22175	23	192.168.2.23	62.73.180.135
Apr 2, 2025 22:23:29.919465065 CEST	22175	23	192.168.2.23	110.54.86.5
Apr 2, 2025 22:23:29.919465065 CEST	22175	23	192.168.2.23	218.43.173.248
Apr 2, 2025 22:23:29.919465065 CEST	22175	23	192.168.2.23	8.42.167.17
Apr 2, 2025 22:23:29.919465065 CEST	22175	23	192.168.2.23	223.34.108.80
Apr 2, 2025 22:23:29.919465065 CEST	22175	23	192.168.2.23	82.192.202.146
Apr 2, 2025 22:23:29.919465065 CEST	22175	23	192.168.2.23	63.177.177.60
Apr 2, 2025 22:23:29.919481993 CEST	22175	23	192.168.2.23	12.179.225.205
Apr 2, 2025 22:23:29.919481993 CEST	22175	23	192.168.2.23	19.42.7.190
Apr 2, 2025 22:23:29.919481993 CEST	22175	23	192.168.2.23	166.183.155.175
Apr 2, 2025 22:23:29.919488907 CEST	22175	23	192.168.2.23	254.251.234.175
Apr 2, 2025 22:23:29.919488907 CEST	22175	23	192.168.2.23	208.165.179.192
Apr 2, 2025 22:23:29.919488907 CEST	22175	23	192.168.2.23	17.155.74.159
Apr 2, 2025 22:23:29.919529915 CEST	22175	23	192.168.2.23	104.183.102.201
Apr 2, 2025 22:23:29.919529915 CEST	22175	23	192.168.2.23	42.151.231.223
Apr 2, 2025 22:23:29.919529915 CEST	22175	23	192.168.2.23	180.216.62.175
Apr 2, 2025 22:23:29.919539928 CEST	22175	23	192.168.2.23	75.224.83.251
Apr 2, 2025 22:23:29.919539928 CEST	22175	23	192.168.2.23	84.164.183.16
Apr 2, 2025 22:23:29.919539928 CEST	22175	23	192.168.2.23	203.213.196.226
Apr 2, 2025 22:23:29.919539928 CEST	22175	23	192.168.2.23	94.53.80.124
Apr 2, 2025 22:23:29.919539928 CEST	22175	23	192.168.2.23	70.223.132.6
Apr 2, 2025 22:23:29.919539928 CEST	22175	23	192.168.2.23	87.236.74.43
Apr 2, 2025 22:23:29.919539928 CEST	22175	23	192.168.2.23	186.116.114.9
Apr 2, 2025 22:23:29.919548988 CEST	22175	23	192.168.2.23	240.45.188.129
Apr 2, 2025 22:23:29.919548988 CEST	22175	23	192.168.2.23	158.212.171.14
Apr 2, 2025 22:23:29.919580936 CEST	22175	23	192.168.2.23	17.69.223.250
Apr 2, 2025 22:23:29.919580936 CEST	22175	23	192.168.2.23	2.206.191.95
Apr 2, 2025 22:23:29.919580936 CEST	22175	23	192.168.2.23	194.104.25.140
Apr 2, 2025 22:23:29.919594049 CEST	22175	23	192.168.2.23	114.39.175.17
Apr 2, 2025 22:23:29.919594049 CEST	22175	23	192.168.2.23	119.204.98.215
Apr 2, 2025 22:23:29.919594049 CEST	22175	23	192.168.2.23	136.252.64.192
Apr 2, 2025 22:23:29.919594049 CEST	22175	23	192.168.2.23	115.91.56.212
Apr 2, 2025 22:23:29.919594049 CEST	22175	23	192.168.2.23	205.220.214.25
Apr 2, 2025 22:23:29.919594049 CEST	22175	23	192.168.2.23	146.56.184.191
Apr 2, 2025 22:23:30.136642933 CEST	7887	60540	213.209.129.92	192.168.2.23
Apr 2, 2025 22:23:30.316831112 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 2, 2025 22:23:30.830245018 CEST	39256	443	192.168.2.23	34.249.145.219
Apr 2, 2025 22:23:39.019773006 CEST	39256	443	192.168.2.23	34.249.145.219
Apr 2, 2025 22:23:47.210596085 CEST	42516	80	192.168.2.23	109.202.202.202
Apr 2, 2025 22:23:51.306034088 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 2, 2025 22:23:52.341193914 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:52.341243029 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:52.341293097 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:53.677985907 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:53.678020000 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:53.893096924 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:53.893275023 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:53.893532991 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:53.893560886 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:53.893778086 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:53.893802881 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:53.893865108 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:53.893908978 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:53.893924952 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:53.893975019 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:53.894345999 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:53.936311007 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:54.082922935 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:54.083236933 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:54.083236933 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:54.083236933 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:54.083297014 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:54.083324909 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:54.083384037 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:54.083384037 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:54.083384037 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:54.083404064 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:54.083430052 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:54.083451986 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:54.083471060 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:54.083472013 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:54.083491087 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:54.083512068 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:54.083553076 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:54.083553076 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:54.083570957 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:54.083590984 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:54.083615065 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:54.083633900 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:54.083647966 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:54.083662987 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:54.083681107 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:54.083693981 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:54.083710909 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:54.083710909 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:54.083726883 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:54.083748102 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:54.083762884 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:54.083775043 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:54.083775997 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:54.083791018 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:54.083827972 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:54.083827972 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:54.083827972 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:54.083847046 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:54.083873987 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:54.655632973 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:54.655735970 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:54.655735016 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:54.655818939 CEST	53082	443	192.168.2.23	162.213.35.25
Apr 2, 2025 22:23:54.655842066 CEST	443	53082	162.213.35.25	192.168.2.23
Apr 2, 2025 22:23:55.145539045 CEST	39256	443	192.168.2.23	34.249.145.219
Apr 2, 2025 22:24:32.260608912 CEST	43928	443	192.168.2.23	91.189.91.42

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 2, 2025 22:23:52.076868057 CEST	60751	53	192.168.2.23	1.1.1.1
Apr 2, 2025 22:23:52.076927900 CEST	55816	53	192.168.2.23	1.1.1.1
Apr 2, 2025 22:23:52.178714991 CEST	53	55816	1.1.1.1	192.168.2.23
Apr 2, 2025 22:23:52.179019928 CEST	53	60751	1.1.1.1	192.168.2.23
Apr 2, 2025 22:23:52.225713968 CEST	41630	53	192.168.2.23	1.1.1.1
Apr 2, 2025 22:23:52.335910082 CEST	53	41630	1.1.1.1	192.168.2.23

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 2, 2025 22:23:58.666994095 CEST	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Apr 2, 2025 22:25:18.681658030 CEST	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2025-04-02 20:23:53 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2025-04-02 20:23:54 UTC	25	IN	HTTP/1.1 100 Continue
2025-04-02 20:23:54 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2025-04-02 20:23:54 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2025-04-02 20:23:54 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2025-04-02 20:23:54 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2025-04-02 20:23:54 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2025-04-02 20:23:54 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2025-04-02 20:23:54 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2025-04-02 20:23:54 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2025-04-02 20:23:54 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2025-04-02 20:23:54 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2025-04-02 20:23:54 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Wed, 02 Apr 2025 20:23:54 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	20:23:29
Start date (UTC):	02/04/2025
Path:	/tmp/xd.x86_64.elf
Arguments:	/tmp/xd.x86_64.elf
File size:	30488 bytes
MD5 hash:	da30210d545e603e163bac22726ed65d

Start time (UTC):	20:23:39
Start date (UTC):	02/04/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:23:40
Start date (UTC):	02/04/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:23:50
Start date (UTC):	02/04/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:23:51
Start date (UTC):	02/04/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:23:52
Start date (UTC):	02/04/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:23:54
Start date (UTC):	02/04/2025
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:24:21
Start date (UTC):	02/04/2025
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Start time (UTC):	20:24:23
Start date (UTC):	02/04/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	20:24:53
Start date (UTC):	02/04/2025
Path:	/usr/lib/systemd/systemd (deleted)
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:24:54
Start date (UTC):	02/04/2025
Path:	/usr/lib/systemd/systemd (deleted)
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:25:51
Start date (UTC):	02/04/2025
Path:	/usr/lib/systemd/systemd (deleted)
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report xd.x86_64.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/run/user/1000/pulse/pid

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

System Behavior

Analysis Process: xd.x86_64.elf PID: 6253, Parent PID: 6175

General

Process Activities

Process Forked

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: xd.x86_64.elf PID: 6254, Parent PID: 6253

General

File Activities

Linux Analysis Report
xd.x86_64.elf

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre